0

We saw some unexpected queries from some database users we would like to identify, for example, preprod user is doing queries on our production databases but we do not know from where (we checked the codebase without any success). Before deleting the account, i would like to know what it is doing.

I took a look at mariadb general log (file format) but it looks like it does not log the mariadb username. Do you have a method to help us identify this ?

Thanks !

0

2 Answers 2

1

... preprod user is doing queries on our production databases ...

If your Security Policies say that preprod users are not allowed to run queries against production databases (which is a very Good Idea, BTW) then lock the account down immediately. No warning, no "Communications"; just do it.

  • If it's a program that's [mis]using the account, that program will break and someone will complain.
  • If it's a user that's [mis]using the account, then they will complain.

Either way, you'll find out who/what was the source of the queries.

1
  • ok got that, but that was not exactly my point :) I see some other mariadb legacy user i would like to know what they are doing
    – Alex T.
    Nov 4, 2022 at 15:48
0

The general log does show the user running the queries, it's just that it's not shown on every line. Simply find the Id column of the line with the query in question, then look at lines before that to find the first line with that Id value which should have a Command equal to "Connect". The database user is then shown in the Argument column.

Alternatively, you can log to a table instead of a file. In that case, the user is shown for every row (column user_host).

2
  • thank you very much
    – Alex T.
    Nov 14, 2022 at 16:13
  • @AlexT. if you think that was the correct answer, feel free to mark it as such :)
    – dbdemon
    Nov 15, 2022 at 11:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.