search

trellix-enterprise / mysql-audit

AUDIT Plugin for MySQL. See wiki and readme for description. If you find the plugin useful, please star us on GitHub. We love stars and it's a great way to show your feedback.
Other
239 stars 57 forks source link

Mcafee audit plugin not working for MySQL Galera 5.6 version #160

Closed subhajit1987 closed 7 years ago

subhajit1987 commented 7 years ago

Getting error:

2017-02-16 23:59:32 4737 [ERROR] Audit Plugin: Offsets: 5.6.30 (84dd43523b638e4b2817ca9b53f204fe) match thread validation check fails with value: 0. Skipping offset. 2017-02-16 23:59:32 4737 [ERROR] Audit Plugin: Offsets: 5.6.30 (84dd43523b638e4b2817ca9b53f204fe) match thread validation check fails with value: 0. Skipping offset. 2017-02-16 23:59:32 4737 [ERROR] Plugin 'AUDIT' init function returned error. 2017-02-16 23:59:32 4737 [ERROR] Plugin 'AUDIT' registration as a AUDIT failed.

subhajit1987 commented 7 years ago

I'm using audit-plugin-mysql-5.6-1.1.2-684-linux-x86_64 version and my Linux is: RedHat Linux 7 x86_64 MySql is 5.6.30

subhajit1987 commented 7 years ago

Any help will be greatly appreciated.

aharonrobbins commented 7 years ago

Hi. Please see if you can follow the troubleshooting instructions on the Wiki to extract the offsets for your version of Galera.

If you cannot, you will have to follow the instructions for building Galera from source, and then extract the offsets.

Thanks,

Aharon

subhajit1987 commented 7 years ago

I am getting the following error:

[root@hostname bin]# ./offset-extract.sh /usr/bin/mysqld ./offset-extract.sh: line 12: /usr/bin/mysqld: No such file or directory md5sum: /usr/bin/mysqld: No such file or directory //offsets for: /usr/bin/mysqld () {"",""offsets.gdb:7: Error in sourced command file: No symbol table is loaded. Use the "file" command.,

aharonrobbins commented 7 years ago

Your mysqld is apparently not in /usr/bin - perhaps it is in /usr/sbin?

subhajit1987 commented 7 years ago

Similar error:

[root@hostname bin]# ./offset-extract.sh /usr/sbin/mysqld //offsets for: /usr/sbin/mysqld (5.6.30) {"5.6.30","92477ed697b1515bd51a408e00e18676"offsets.gdb:7: Error in sourced command file: No symbol table is loaded. Use the "file" command.,

aharonrobbins commented 7 years ago

This is a different error. You found the correct file, but it does not have symbols.

At this point, your only option is to build the Galera version of MySQL from source code and extract the offsets from the compiled version.

subhajit1987 commented 7 years ago

Can you guide me how to do this. Or I can share you the binary also.

aharonrobbins commented 7 years ago

Sending me the binary won't help.

Please see http://galeracluster.com/documentation-webpages/installmysqlsrc.html which would appear to be instructions on how to build the Galera version from source. I have not tried this myself. You may wish to build from source, extract offsets, and then also run the version that you built to make sure that everything is in sync.

Hope this helps.