1install plugin server_audit soname 'server_audit'; 2show variables like 'server_audit%'; 3Variable_name Value 4server_audit_events 5server_audit_excl_users 6server_audit_file_path server_audit.log 7server_audit_file_rotate_now OFF 8server_audit_file_rotate_size 1000000 9server_audit_file_rotations 9 10server_audit_incl_users 11server_audit_logging OFF 12server_audit_mode 0 13server_audit_output_type file 14server_audit_query_log_limit 1024 15server_audit_syslog_facility LOG_USER 16server_audit_syslog_ident mysql-server_auditing 17server_audit_syslog_info 18server_audit_syslog_priority LOG_INFO 19set global server_audit_file_path=null; 20set global server_audit_incl_users=null; 21set global server_audit_file_path='server_audit.log'; 22set global server_audit_output_type=file; 23set global server_audit_logging=on; 24connect con1,localhost,root,,mysql; 25connection default; 26disconnect con1; 27connect(localhost,no_such_user,,mysql,MASTER_PORT,MASTER_SOCKET); 28connect con1,localhost,no_such_user,,mysql; 29ERROR 28000: Access denied for user 'no_such_user'@'localhost' (using password: NO) 30connection default; 31set global server_audit_incl_users='odin, dva, tri'; 32create table t1 (id int); 33set global server_audit_incl_users='odin, root, dva, tri'; 34create table t2 (id int); 35set global server_audit_excl_users='odin, dva, tri'; 36Warnings: 37Warning 1 User 'odin' is in the server_audit_incl_users, so wasn't added. 38Warning 1 User 'dva' is in the server_audit_incl_users, so wasn't added. 39Warning 1 User 'tri' is in the server_audit_incl_users, so wasn't added. 40insert into t1 values (1), (2); 41select * from t1; 42id 431 442 45set global server_audit_incl_users='odin, root, dva, tri'; 46insert into t2 values (1), (2); 47select * from t2; 48id 491 502 51alter table t1 rename renamed_t1; 52set global server_audit_events='connect,query'; 53select 1, 542, 55# comment 563; 571 2 3 581 2 3 59insert into t2 values (1), (2); 60select * from t2; 61id 621 632 641 652 66select * from t_doesnt_exist; 67ERROR 42S02: Table 'test.t_doesnt_exist' doesn't exist 68syntax_error_query; 69ERROR 42000: You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near 'syntax_error_query' at line 1 70drop table renamed_t1, t2; 71show variables like 'server_audit%'; 72Variable_name Value 73server_audit_events CONNECT,QUERY 74server_audit_excl_users 75server_audit_file_path server_audit.log 76server_audit_file_rotate_now OFF 77server_audit_file_rotate_size 1000000 78server_audit_file_rotations 9 79server_audit_incl_users odin, root, dva, tri 80server_audit_logging ON 81server_audit_mode 0 82server_audit_output_type file 83server_audit_query_log_limit 1024 84server_audit_syslog_facility LOG_USER 85server_audit_syslog_ident mysql-server_auditing 86server_audit_syslog_info 87server_audit_syslog_priority LOG_INFO 88set global server_audit_mode=1; 89set global server_audit_events=''; 90create database sa_db; 91connect con1,localhost,root,,test; 92connection con1; 93create table t1 (id2 int); 94insert into t1 values (1), (2); 95select * from t1; 96id2 971 982 99drop table t1; 100use sa_db; 101create table sa_t1(id int); 102insert into sa_t1 values (1), (2); 103drop table sa_t1; 104drop database sa_db; 105connection default; 106disconnect con1; 107create database sa_db; 108use sa_db; 109CREATE USER u1 IDENTIFIED BY 'pwd-123'; 110GRANT ALL ON sa_db TO u2 IDENTIFIED BY "pwd-321"; 111SET PASSWORD FOR u1 = PASSWORD('pwd 098'); 112CREATE USER u3 IDENTIFIED BY ''; 113drop user u1, u2, u3; 114set global server_audit_events='query_ddl'; 115create table t1(id int); 116insert into t1 values (1), (2); 117select * from t1; 118id 1191 1202 121select 2; 1222 1232 124(select 2); 1252 1262 127/*! select 2*/; 1282 1292 130/*comment*/ select 2; 1312 1322 133drop table t1; 134set global server_audit_events='query_ddl,query_dml'; 135create table t1(id int); 136insert into t1 values (1), (2); 137select * from t1; 138id 1391 1402 141select 2; 1422 1432 144drop table t1; 145set global server_audit_events='query_dml'; 146create table t1(id int); 147insert into t1 values (1), (2); 148select * from t1; 149id 1501 1512 152select 2; 1532 1542 155(select 2); 1562 1572 158/*! select 2*/; 1592 1602 161/*comment*/ select 2; 1622 1632 164drop table t1; 165set global server_audit_events='query_dcl'; 166create table t1(id int); 167insert into t1 values (1), (2); 168select * from t1; 169id 1701 1712 172CREATE USER u1 IDENTIFIED BY 'pwd-123'; 173GRANT ALL ON sa_db TO u2 IDENTIFIED BY "pwd-321"; 174SET PASSWORD 175# comment 176FOR u1 = PASSWORD('pwd 098'); 177SET PASSWORD FOR u1=<secret>; 178ERROR 42000: You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near '<secret>' at line 1 179CREATE USER u3 IDENTIFIED BY ''; 180drop user u1, u2, u3; 181select 2; 1822 1832 184(select 2); 1852 1862 187/*! select 2*/; 1882 1892 190/*comment*/ select 2; 1912 1922 193drop table t1; 194set global server_audit_events=''; 195set global server_audit_query_log_limit= 15; 196select (1), (2), (3), (4); 1971 2 3 4 1981 2 3 4 199select 'A', 'B', 'C', 'D'; 200A B C D 201A B C D 202set global server_audit_query_log_limit= 1024; 203drop database sa_db; 204set global server_audit_file_path='.'; 205show status like 'server_audit_current_log'; 206Variable_name Value 207Server_audit_current_log HOME_DIR/server_audit.log 208set global server_audit_file_path=''; 209show status like 'server_audit_current_log'; 210Variable_name Value 211Server_audit_current_log server_audit.log 212set global server_audit_file_path=' '; 213show status like 'server_audit_current_log'; 214Variable_name Value 215Server_audit_current_log server_audit.log 216set global server_audit_file_path='nonexisting_dir/'; 217Warnings: 218Warning 1 SERVER AUDIT plugin can't create file 'nonexisting_dir/'. 219show status like 'server_audit_current_log'; 220Variable_name Value 221Server_audit_current_log server_audit.log 222show variables like 'server_audit%'; 223Variable_name Value 224server_audit_events 225server_audit_excl_users 226server_audit_file_path 227server_audit_file_rotate_now OFF 228server_audit_file_rotate_size 1000000 229server_audit_file_rotations 9 230server_audit_incl_users odin, root, dva, tri 231server_audit_logging ON 232server_audit_mode 1 233server_audit_output_type file 234server_audit_query_log_limit 1024 235server_audit_syslog_facility LOG_USER 236server_audit_syslog_ident mysql-server_auditing 237server_audit_syslog_info 238server_audit_syslog_priority LOG_INFO 239uninstall plugin server_audit; 240Warnings: 241Warning 1620 Plugin is busy and will be uninstalled on shutdown 242TIME,HOSTNAME,root,localhost,ID,ID,QUERY,test,'set global server_audit_logging=on',0 243TIME,HOSTNAME,root,localhost,ID,0,CONNECT,mysql,,0 244TIME,HOSTNAME,root,localhost,ID,0,DISCONNECT,mysql,,0 245TIME,HOSTNAME,no_such_user,localhost,ID,0,FAILED_CONNECT,,,ID 246TIME,HOSTNAME,no_such_user,localhost,ID,0,DISCONNECT,,,0 247TIME,HOSTNAME,root,localhost,ID,ID,QUERY,test,'set global server_audit_incl_users=\'odin, dva, tri\'',0 248TIME,HOSTNAME,root,localhost,ID,ID,QUERY,test,'set global server_audit_incl_users=\'odin, root, dva, tri\'',0 249TIME,HOSTNAME,root,localhost,ID,ID,CREATE,test,t2, 250TIME,HOSTNAME,root,localhost,ID,ID,QUERY,test,'create table t2 (id int)',0 251TIME,HOSTNAME,root,localhost,ID,ID,QUERY,test,'set global server_audit_excl_users=\'odin, dva, tri\'',0 252TIME,HOSTNAME,root,localhost,ID,ID,QUERY,test,'SHOW WARNINGS',0 253TIME,HOSTNAME,root,localhost,ID,ID,WRITE,test,t1, 254TIME,HOSTNAME,root,localhost,ID,ID,READ,mysql,table_stats, 255TIME,HOSTNAME,root,localhost,ID,ID,READ,mysql,column_stats, 256TIME,HOSTNAME,root,localhost,ID,ID,READ,mysql,index_stats, 257TIME,HOSTNAME,root,localhost,ID,ID,QUERY,test,'insert into t1 values (1), (2)',0 258TIME,HOSTNAME,root,localhost,ID,ID,READ,test,t1, 259TIME,HOSTNAME,root,localhost,ID,ID,QUERY,test,'select * from t1',0 260TIME,HOSTNAME,root,localhost,ID,ID,QUERY,test,'set global server_audit_incl_users=\'odin, root, dva, tri\'',0 261TIME,HOSTNAME,root,localhost,ID,ID,WRITE,test,t2, 262TIME,HOSTNAME,root,localhost,ID,ID,READ,mysql,table_stats, 263TIME,HOSTNAME,root,localhost,ID,ID,READ,mysql,column_stats, 264TIME,HOSTNAME,root,localhost,ID,ID,READ,mysql,index_stats, 265TIME,HOSTNAME,root,localhost,ID,ID,QUERY,test,'insert into t2 values (1), (2)',0 266TIME,HOSTNAME,root,localhost,ID,ID,READ,test,t2, 267TIME,HOSTNAME,root,localhost,ID,ID,QUERY,test,'select * from t2',0 268TIME,HOSTNAME,root,localhost,ID,ID,ALTER,test,t1, 269TIME,HOSTNAME,root,localhost,ID,ID,RENAME,test,t1|test.renamed_t1, 270TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,table_stats, 271TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,column_stats, 272TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,index_stats, 273TIME,HOSTNAME,root,localhost,ID,ID,QUERY,test,'alter table t1 rename renamed_t1',0 274TIME,HOSTNAME,root,localhost,ID,ID,QUERY,test,'set global server_audit_events=\'connect,query\'',0 275TIME,HOSTNAME,root,localhost,ID,ID,QUERY,test,'select 1,\n2,\n# comment\n3',0 276TIME,HOSTNAME,root,localhost,ID,ID,QUERY,test,'insert into t2 values (1), (2)',0 277TIME,HOSTNAME,root,localhost,ID,ID,QUERY,test,'select * from t2',0 278TIME,HOSTNAME,root,localhost,ID,ID,QUERY,test,'select * from t_doesnt_exist',ID 279TIME,HOSTNAME,root,localhost,ID,ID,QUERY,test,'syntax_error_query',ID 280TIME,HOSTNAME,root,localhost,ID,ID,QUERY,test,'drop table renamed_t1, t2',0 281TIME,HOSTNAME,root,localhost,ID,ID,QUERY,test,'show variables like \'server_audit%\'',0 282TIME,HOSTNAME,root,localhost,ID,ID,QUERY,test,'set global server_audit_mode=1',0 283TIME,HOSTNAME,root,localhost,ID,ID,QUERY,test,'set global server_audit_events=\'\'',0 284TIME,HOSTNAME,root,localhost,ID,ID,QUERY,test,'create database sa_db',0 285TIME,HOSTNAME,root,localhost,ID,0,CONNECT,test,,0 286TIME,HOSTNAME,root,localhost,ID,ID,CREATE,test,t1, 287TIME,HOSTNAME,root,localhost,ID,ID,QUERY,test,'create table t1 (id2 int)',0 288TIME,HOSTNAME,root,localhost,ID,ID,WRITE,test,t1, 289TIME,HOSTNAME,root,localhost,ID,ID,READ,mysql,table_stats, 290TIME,HOSTNAME,root,localhost,ID,ID,READ,mysql,column_stats, 291TIME,HOSTNAME,root,localhost,ID,ID,READ,mysql,index_stats, 292TIME,HOSTNAME,root,localhost,ID,ID,QUERY,test,'insert into t1 values (1), (2)',0 293TIME,HOSTNAME,root,localhost,ID,ID,READ,test,t1, 294TIME,HOSTNAME,root,localhost,ID,ID,QUERY,test,'select * from t1',0 295TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,table_stats, 296TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,column_stats, 297TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,index_stats, 298TIME,HOSTNAME,root,localhost,ID,ID,DROP,test,t1, 299TIME,HOSTNAME,root,localhost,ID,ID,QUERY,test,'drop table t1',0 300TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'use sa_db',0 301TIME,HOSTNAME,root,localhost,ID,ID,CREATE,sa_db,sa_t1, 302TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'create table sa_t1(id int)',0 303TIME,HOSTNAME,root,localhost,ID,ID,WRITE,sa_db,sa_t1, 304TIME,HOSTNAME,root,localhost,ID,ID,READ,mysql,table_stats, 305TIME,HOSTNAME,root,localhost,ID,ID,READ,mysql,column_stats, 306TIME,HOSTNAME,root,localhost,ID,ID,READ,mysql,index_stats, 307TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'insert into sa_t1 values (1), (2)',0 308TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,table_stats, 309TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,column_stats, 310TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,index_stats, 311TIME,HOSTNAME,root,localhost,ID,ID,DROP,sa_db,sa_t1, 312TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'drop table sa_t1',0 313TIME,HOSTNAME,root,localhost,ID,ID,READ,mysql,proc, 314TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,proc, 315TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,event, 316TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'drop database sa_db',0 317TIME,HOSTNAME,root,localhost,ID,0,DISCONNECT,,,0 318TIME,HOSTNAME,root,localhost,ID,ID,QUERY,test,'create database sa_db',0 319TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'use sa_db',0 320TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,db, 321TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,tables_priv, 322TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,columns_priv, 323TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,procs_priv, 324TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,proxies_priv, 325TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,roles_mapping, 326TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,global_priv, 327TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'CREATE USER u1 IDENTIFIED BY *****',0 328TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,tables_priv, 329TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,global_priv, 330TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'GRANT ALL ON sa_db TO u2 IDENTIFIED BY *****',0 331TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,global_priv, 332TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'SET PASSWORD FOR u1 = PASSWORD(*****)',0 333TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,db, 334TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,tables_priv, 335TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,columns_priv, 336TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,procs_priv, 337TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,proxies_priv, 338TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,roles_mapping, 339TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,global_priv, 340TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'CREATE USER u3 IDENTIFIED BY *****',0 341TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,db, 342TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,tables_priv, 343TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,columns_priv, 344TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,procs_priv, 345TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,proxies_priv, 346TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,roles_mapping, 347TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,global_priv, 348TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'drop user u1, u2, u3',0 349TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'create table t1(id int)',0 350TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'drop table t1',0 351TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'create table t1(id int)',0 352TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'insert into t1 values (1), (2)',0 353TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'select * from t1',0 354TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'select 2',0 355TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'drop table t1',0 356TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'insert into t1 values (1), (2)',0 357TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'select * from t1',0 358TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'select 2',0 359TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'(select 2)',0 360TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'/*! select 2*/',0 361TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'/*comment*/ select 2',0 362TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'CREATE USER u1 IDENTIFIED BY *****',0 363TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'GRANT ALL ON sa_db TO u2 IDENTIFIED BY *****',0 364TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'SET PASSWORD\n# comment\nFOR u1 = PASSWORD(*****)',0 365TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'SET PASSWORD FOR u1=<secret>',ID 366TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'CREATE USER u3 IDENTIFIED BY *****',0 367TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'drop user u1, u2, u3',0 368TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'set global server_audit_events=\'\'',0 369TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'set global serv',0 370TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'select (1), (2)',0 371TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'select \'A\', ',0 372TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'set global server_audit_query_log_limit= 1024',0 373TIME,HOSTNAME,root,localhost,ID,ID,READ,mysql,proc, 374TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,proc, 375TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,event, 376TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'drop database sa_db',0 377TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'set global server_audit_file_path=\'.\'',0 378TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'set global server_audit_file_path=\'.\'',0 379TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'show status like \'server_audit_current_log\'',0 380TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'set global server_audit_file_path=\'\'',0 381TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'set global server_audit_file_path=\'\'',0 382TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'show status like \'server_audit_current_log\'',0 383TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'set global server_audit_file_path=\' \'',0 384TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'set global server_audit_file_path=\' \'',0 385TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'show status like \'server_audit_current_log\'',0 386TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'set global server_audit_file_path=\'nonexisting_dir/\'',0 387TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'set global server_audit_file_path=\'nonexisting_dir/\'',0 388TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'SHOW WARNINGS',0 389TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'show status like \'server_audit_current_log\'',0 390TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'show variables like \'server_audit%\'',0 391TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,plugin, 392TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'uninstall plugin server_audit',0 393