审计报错
docker启动greatsql:8.0.32-26，安装audit插件后，查询报错# mysql -uroot -p1 --binary-as-hex=0
mysql: Using a password on the command line interface can be insecure.
Welcome to the MySQL monitor.Commands end with ; or \g.
Your MySQL connection id is 33
Server version: 8.0.32-26 GreatSQL (GPL), Release 26, Revision a68b3034c3d
Copyright (c) 2021-2024 GreatDB Software Co., Ltd
Copyright (c) 2009-2024 Percona LLC and/or its affiliates
Copyright (c) 2000, 2024, Oracle and/or its affiliates.
Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
(Mon Aug5 09:34:22 2024)[(none)]>SELECT audit_login_messages(10);
+--------------------------------+
| audit_login_messages(10) |
+--------------------------------+
| Function failed with sql error |
+--------------------------------+
1 row in set (0.00 sec)
(Mon Aug5 09:37:08 2024)[(none)]>show variables like 'audit%';
+-----------------------------+---------------+
| Variable_name | Value |
+-----------------------------+---------------+
| audit_log_buffer_size | 1048576 |
| audit_log_enabled | 1 |
| audit_log_exclude_accounts| |
| audit_log_exclude_commands| |
| audit_log_exclude_databases | |
| audit_log_file | audit.log |
| audit_log_flush | OFF |
| audit_log_format | OLD |
| audit_log_handler | FILE |
| audit_log_include_accounts| |
| audit_log_include_commands| |
| audit_log_include_databases | |
| audit_log_policy | ALL |
| audit_log_rotate_on_size | 0 |
| audit_log_rotations | 0 |
| audit_log_strategy | ASYNCHRONOUS|
| audit_log_syslog_facility | LOG_USER |
| audit_log_syslog_ident | percona-audit |
| audit_log_syslog_priority | LOG_INFO |
| audit_log_to_table | 1 |
+-----------------------------+---------------+
20 rows in set (0.00 sec)
本功能基于审计插件，所以需要先开启审计插件才能使用，并且必须确保设置参数 audit_log_enabled = 1，和audit_log_to_table = 1，启用审计和审计日志入表特性。
启用审计插件方法参考 https://greatsql.cn/docs/8.0.32-26/5-enhance/5-4-security-audit.html
yejr 发表于 2024-8-5 17:47
本功能基于审计插件，所以需要先开启审计插件才能使用，并且必须确保设置参数 audit_log_enabled = 1，和au ...
| audit_log_enabled | 1 |
| audit_log_to_table | 1 |
开的 ShawnYan 发表于 2024-8-5 18:00
| audit_log_enabled | 1 |
| audit_log_to_table | 1 |
日志也请提供下，可能首次初始化失败报错了。
另外，在当前session中启用审计后，在新建的session里才能生效。 测试验证了一番，应该是因为docker build影响导致的，具体原因还未知，后续待查。
如果改用docker启动一个全新的环境，再安装GreatSQL rpm包，这种方式则可以正常工作。 问题已修复，docker镜像也已更新，严老师可以再重试下 yejr 发表于 2024-8-7 19:41
问题已修复，docker镜像也已更新，严老师可以再重试下
感谢叶老师帮忙解决，顺便问下，这个现象是符合预期的么？
(Wed Aug7 15:07:58 2024)[(none)]>SELECT audit_login_messages(10);
+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| audit_login_messages(10) |
+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| | name | time | connection_id | status | user | host | ip | server_id |
| Connect | 2024-08-07 15:07:56 | 178 | 1045 | root | localhost || 3306186 |
| Connect | 2024-08-07 15:07:38 | 171 | 0 | root | localhost || 3306186 |
| Total 2 rows | |
+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
1 row in set (0.00 sec)
(Wed Aug7 15:08:00 2024)[(none)]>\r
Connection id: 187
Current database: *** NONE ***
(Wed Aug7 15:08:05 2024)[(none)]>SELECT audit_login_messages(10);
+----------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| audit_login_messages(10) |
+----------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| | name | time | connection_id | status | user | host | ip | server_id |
| Connect | 2024-08-07 15:07:58 | 180 | 0 | root | localhost || 3306186 |
| Total 1 rows | |
+----------------------------------------------------------------------------------------------------------------------------------------------------------------------+
1 row in set (0.01 sec)
ShawnYan 发表于 2024-8-7 23:08
感谢叶老师帮忙解决，顺便问下，这个现象是符合预期的么？
是的，这个插件记录的是：上一次成功登录以及上一次成功登录后所有的失败登录信息。
问题原因查明了，是因为在初始化脚本中执行了下面这条删除操作，导致该问题
DELETE FROM mysql.user WHERE user NOT IN ('mysql.sys', 'mysqlxsys', 'mysql.infoschema', 'mysql.session', 'root') OR host NOT IN ('localhost') ;
详见commit log：https://gitee.com/GreatSQL/GreatSQL-Docker/commit/172b12cc1fe20aeb12be176c64516a06061a4ee2
这个问题在MySQL、Percona的Docker镜像构建过程同样存在。
页:
[1]