trellix-enterprise / mysql-audit

AUDIT Plugin for MySQL. See wiki and readme for description. If you find the plugin useful, please star us on GitHub. We love stars and it's a great way to show your feedback.
Other
239 stars 57 forks source link

can not record DDL sql #282

Open luban-130 opened 1 day ago

luban-130 commented 1 day ago

mysql version: 5.7.25 audit_plugin version: audit-plugin-mysql-5.7-1.1.7-913-linux-x86_64.zip

my.cnf: plugin-load=AUDIT=libaudit_plugin.so audit_json_file=on audit_json_log_file=/home/logs/mysql/audit.log audit_sess_connect_attrs=false audit_record_cmds=drop,alter,update,delete

problem: When I execute DML statements (such as update or delete), logs are recorded normally. However, when I execute DDL statements (such as alter or drop), they are not recorded in the audit logs.

audit.log {"msg-type":"activity","date":"1732080563700","thread-id":"1337","query-id":"160","user":"root","priv_user":"root","ip":"1.202.237.155","host":"1.202.237.155","rows":"1","status":"0","cmd":"update","objects":[{"db":"zdgs-cloud","name":"xinxi2","obj_type":"TABLE"}],"query":"/ ApplicationName=DBeaver 24.2.4 - Main / UPDATE zdgs-cloud.xinxi2\n\tSET xuehao='4',id=4\n\tWHERE id=3"} {"msg-type":"activity","date":"1732080586021","thread-id":"1337","query-id":"165","user":"root","priv_user":"root","ip":"1.202.237.155","host":"1.202.237.155","rows":"1","status":"0","cmd":"delete","objects":[{"db":"zdgs-cloud","name":"xinxi2","obj_type":"TABLE"}],"query":"/ ApplicationName=DBeaver 24.2.4 - Main / DELETE FROM zdgs-cloud.xinxi2\n\tWHERE id=4"}

luban-130 commented 1 day ago

After upgrading the MySQL version from 5.7.25 to 5.7.38 and the audit version from 1.1.7 to 1.1.13 in the testing environment, the issue persists: only DML execution records are present in the audit logs, but no DDL execution records. Is there a problem with the parameter configuration in the my.cnf file?

luban-130 commented 1 day ago

![Uploading audit.png…]() When I commented out the configuration item audit_record_cmds=drop,alter,update,delete in the configuration file, DDL statements started being recorded. Why is that?