Audit plugin is loggin everything, despite the configuration parameters
My goal is to configure audit plugin with MariaDB with the forwarding of the auditing log entries to Syslog. This so far works. Unfortunately, I also want to limit the auditing log entries to just the queries which produced an error. I achieved the target of having only the queries logged setting the audit configuration variable 'server_audit_events' to 'QUERY'. This works, since now I can see in Syslog only the queries done in MySQL client, while the "CONNECT" and "DISCONNECT" actions are hidden. Unfortunately, I can see in Syslog ALL the queries, not only the queries which produced errors. Setting the audit configuration variable 'server_audit_syslog_priority' to 'LOG_WARNING' or 'LOG_ERR' didn't change the situation. My MariaDB version is '10.0.22'. The plugin configuration variables are shown below (*) Any help is welcomed.
Cheers, Teresa
--- (*)
MariaDB [(none)]> show global variables like 'server_audit%'; +-------------------------------+-----------------------+ | Variable_name | Value | +-------------------------------+-----------------------+ | server_audit_events | QUERY | | server_audit_excl_users | | | server_audit_file_path | server_audit.log | | server_audit_file_rotate_now | OFF | | server_audit_file_rotate_size | 1000000 | | server_audit_file_rotations | 9 | | server_audit_incl_users | | | server_audit_logging | ON | | server_audit_mode | 0 | | server_audit_output_type | syslog | | server_audit_query_log_limit | 1024 | | server_audit_syslog_facility | LOG_LOCAL6 | | server_audit_syslog_ident | mysql-server_auditing | | server_audit_syslog_info | | | server_audit_syslog_priority | LOG_WARNING | +-------------------------------+-----------------------+ 15 rows in set (0.00 sec)
Answer Answered by Ian Gilfillan in this comment.
Wouldn't it make more sense to use the error log for this rather than the audit log? I don't think you can achieve what you want though the audit log.