Comments on: Introducing audit_login: simple MySQL login logfile based auditing

By: Tommaso

Tommaso — Fri, 06 Nov 2015 08:24:53 +0000

Is this plugin going to work with MySQL 5.1?

Thank you

By: egezon

egezon — Wed, 12 Nov 2014 23:08:06 +0000

Awesome! thank you.

By: shlomi

shlomi — Sat, 01 Nov 2014 06:52:53 +0000

1. Sorry, only logging to data directory; no configuration to modify that
2. Via logrotate, e.g. like this:
# # Rotate audit_login logs #

/path/to/datadir/audit_login.log { daily compress create 660 mysql mysql missingok ifempty copytruncate rotate 7 }

By: egezon

egezon — Fri, 31 Oct 2014 21:59:56 +0000

This is really cool. I have couple of questions though.
By default this is logging into data directory.
1. How can I change the directory? and
2. How can I rotate log(s)?

By: tlastowka

tlastowka — Thu, 24 Oct 2013 18:58:51 +0000

I didn’t get too deep into the code, but I tried the old “comment out once of the lines that gets mentioned and see how it changes the error messages” trick.

When I commented out line 46, #include the compile completed just fine… and the plugin worked, again on both versions.

I wasn’t expecting that to happen. I’m a little worried about what else that might have impacted, but I’ll run it for a few days and post back if anything unexpected crops up.

By: shlomi

shlomi — Thu, 24 Oct 2013 18:22:13 +0000

Not off the top of my head, and will take a couple days before I can look into this…

By: tlastowka

tlastowka — Thu, 24 Oct 2013 15:48:51 +0000

Hey shlomi,

When trying to compile the plugin using the instructions on github, the same error is being thrown using source from 5.5.33 and 5.6.14. This is under Centos 6.4 x64. Any ideas?

Thanks!

Scanning dependencies of target audit_login
[ 68%] Building C object plugin/audit_login/CMakeFiles/audit_login.dir/audit_log
In file included from /home/tlastowka/src/mysql-5.5.33/include/my_sys.h:19,
from /home/tlastowka/src/mysql-5.5.33/plugin/audit_login/audit_
/home/tlastowka/src/mysql-5.5.33/include/my_global.h:522: error: redefinition of
/home/tlastowka/src/mysql-5.5.33/include/mysql.h:66: note: previous declaration
In file included from /home/tlastowka/src/mysql-5.5.33/include/my_sys.h:19,
from /home/tlastowka/src/mysql-5.5.33/plugin/audit_login/audit_
/home/tlastowka/src/mysql-5.5.33/include/my_global.h:939: error: redefinition of
/home/tlastowka/src/mysql-5.5.33/include/mysql.h:127: note: previous declaration
/home/tlastowka/src/mysql-5.5.33/include/my_global.h:995: error: redefinition of
/home/tlastowka/src/mysql-5.5.33/include/mysql.h:52: note: previous declaration
make[2]: *** [plugin/audit_login/CMakeFiles/audit_login.dir/audit_login.c.o] Err
make[1]: *** [plugin/audit_login/CMakeFiles/audit_login.dir/all] Error 2
make: *** [all] Error 2

By: shlomi

shlomi — Tue, 17 Sep 2013 17:36:35 +0000

Todd — thanks! Will look into this.

By: Todd Farmer

Todd Farmer — Tue, 17 Sep 2013 14:47:54 +0000

Hi Shlomi,

Cool stuff! As a suggestion, you might consider including the error (“status”) code in the output, rather than interpreting it as a successful or unsuccessful login – I’ve found it very useful when using the MySQL Enterprise Audit Log plugin (with audit_log_policy=LOGINS) and I want to identify particular error conditions (is it a bad password, or a blocked host, or is an authentication plugin not supported on the client, or …).