search

Ericsson / ecaudit

Ericsson Audit plug-in for Apache Cassandra
Apache License 2.0
43 stars 36 forks source link

ALTER KEYSPACE statement is treated as unrecognized CQLStatement in audit mapping #198

Closed FO-H closed 1 year ago

FO-H commented 1 year ago

Hi,

Found a bug which ALTER KEYSPACE statement is treated as unrecognized CQLStatement in audit mapping.

I tried to run below statement in cqlsh: ALTER KEYSPACE system_traces WITH replication = {'class': 'NetworkTopologyStrategy', 'dc2': '2', 'dc1': '2'} AND durable_writes = true;

and i got a warn msg in cassandra log: [Native-Transport-Requests-1] [com.ericsson.bss.cassandra.ecaudit.entry.factory.AuditEntryBuilderFactory] Detected unrecognized CQLStatement in audit mapping"

tommystendahl commented 1 year ago

I think this is limited to the release for Cassandra 4.0. In AuditEntryBuilderFactory.createEntryBuilder(Raw parsedStatement) we have lost the check to see if the statement is a altering schema statement.