Audit Log Plugin audit_log_exclude_accounts setting incompatible when host contains ip address
Affects | Status | Importance | Assigned to | Milestone | ||
---|---|---|---|---|---|---|
Percona Server moved to https://jira.percona.com/projects/PS | Status tracked in 5.7 | |||||
5.5 |
Invalid
|
Undecided
|
Unassigned | |||
5.6 |
Triaged
|
Medium
|
Unassigned | |||
5.7 |
Invalid
|
Undecided
|
Unassigned |
Bug Description
If we set the value of option audit_log_
###### 5.6.35 ######
mysql> select @@version;
+-------------+
| @@version |
+-------------+
| 5.6.35-81.0 |
+-------------+
1 row in set (0.00 sec)
mysql> set global audit_log_
Query OK, 0 rows affected (0.00 sec)
mysql> show global variables like 'audit';
Empty set (0.00 sec)
mysql> show global variables like 'audit%';
+------
| Variable_name | Value |
+------
| audit_log_
| audit_log_
| audit_log_
| audit_log_file | /var/log/
| audit_log_flush | OFF |
| audit_log_format | JSON |
| audit_log_handler | FILE |
| audit_log_
| audit_log_
| audit_log_policy | ALL |
| audit_log_
| audit_log_rotations | 10 |
| audit_log_strategy | PERFORMANCE |
| audit_log_
| audit_log_
| audit_log_
+------
16 rows in set (0.00 sec)
mysql> exit
Bye
mysql@c5ff27595
Warning: Using a password on the command line interface can be insecure.
Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 16
Server version: 5.6.35-81.0 Percona Server (GPL), Release 81.0, Revision c96c427
Copyright (c) 2009-2016 Percona LLC and/or its affiliates
Copyright (c) 2000, 2016, Oracle and/or its affiliates. All rights reserved.
Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
mysql> show databases;
+------
| Database |
+------
| information_schema |
| mysql |
| performance_schema |
+------
3 rows in set (0.00 sec)
##### /var/log/
...
{"audit_
This does not occur in 5.7.16+ Audit Plugin.
Semi-Workaround is possible by omitting the ipaddr if your intentions are for all accounts with the username to be excluded from audit logging.
setting audit_log_
tags: | added: audit |
Still reproducible in latest 5.6.36 builds
+------ +------ ------+ +------ ------+ +------ ------+
| user | host |
+------
| aud | 10.0.3.194 |
| aud1 | centos7 |
+------
+------ ------- ------- ------- -+----- ------- ----+ ------- ------- ------- -+----- ------- ----+ buffer_ size | 1048576 | exclude_ accounts | aud@10.0.3.194 | exclude_ commands | | include_ accounts | | include_ commands | | rotate_ on_size | 0 | syslog_ facility | LOG_USER | syslog_ ident | percona-audit | syslog_ priority | LOG_INFO | ------- ------- ------- -+----- ------- ----+
| Variable_name | Value |
+------
| audit_log_
| audit_log_
| audit_log_
| audit_log_file | audit.log |
| audit_log_flush | OFF |
| audit_log_format | OLD |
| audit_log_handler | FILE |
| audit_log_
| audit_log_
| audit_log_policy | ALL |
| audit_log_
| audit_log_rotations | 0 |
| audit_log_strategy | ASYNCHRONOUS |
| audit_log_
| audit_log_
| audit_log_
+------
User with IP in hostname is logged while user with hostname is not logged, hence exclude_accounts only works when non-IP addresses are used.