2-Binlog Event Header

All the binlog events stored in a binary log file have a common structure:

• An event header;

• Event data.

Event Header Structure, 19 Bytes

• Timestamp (creation time).

• (type_code).

• Server_id (server which created the event).

• Event Length (header + data).

Encrypted Binlog Events

For encrypted binlog events, only the event length is in plaintext, and everything else is encrypted.

To decrypt the binlog event:

• Store the event length in memory;

• Move the timestamp into the event length position;

• Decrypt the whole payload except the first four bytes;

• Move the timestamp back to its original position;

Regardless of the cipher used to encrypt the binlogs, the encrypted data are the same size as the original unencrypted event. For events that are encrypted in CBC mode, and whose length is not a multiple of the cipher block size, the final partial block is encrypted using a form of :

• Encrypt the current IV of the binlog file in ECB mode;

• XOR the remaining bytes with the encrypted IV.

Event Type

Fake Events

These are generated on the fly, never written:

Event Flag

Event Header Example of FORMAT_DESCRIPTION_EVENT

This is the first event in the binlog file at pos 4:

Interpretation of First 19 Bytes of the Event (the Event Header)

• a4 85 9e 59 [4] Timestamp => 59 9e 85 a4 => 1503561124 = 2017-08-24 09:52:04

• 0f [1] Event Type = 0x0f = FORMAT_DESCRIPTION_EVENT

• 8c 27 00 00 [4] Server_id => 00 00 27 8c = 10124

• f5 00 00 00 [4] Event length => 00 00 00 f5 => 245

_{This page is licensed: CC BY-SA / Gnu FDL}