Comments on: Experiences with the McAfee MySQL Audit Plugin https://www.percona.com/blog/experiences-with-the-mcafee-mysql-audit-plugin/ Thu, 11 May 2023 18:29:24 +0000 hourly 1 https://wordpress.org/?v=6.5.2 By: jadhavmanoj096 https://www.percona.com/blog/experiences-with-the-mcafee-mysql-audit-plugin/#comment-10966776 Wed, 10 Aug 2016 04:29:29 +0000 https://www.percona.com/blog/?p=15577#comment-10966776 Hi,

I am not able to generate offset on ubuntu 14.04 and mysql version – 5.5.50-0ubuntu0.14.04.1

while running below code caught error:

./offset-extract.sh /usr/sbin/mysqld
//offsets for: /usr/sbin/mysqld (5.5.50-0ubuntu0.14.04.1)
offsets.gdb:2: Error in sourced command file:
No symbol table is loaded. Use the “file” command.,

Can anyone help me!!

]]>
By: Tom Diederich https://www.percona.com/blog/experiences-with-the-mcafee-mysql-audit-plugin/#comment-4311631 Sat, 11 Jan 2014 17:07:47 +0000 https://www.percona.com/blog/?p=15577#comment-4311631 Hi Flavian,

I’m Percona’s community manager. This post is several months old – the best place to ask specific questions is on our MySQL discussions forums at https://www.percona.com/forums/

I invite you to join the community of your MySQL peers and also our own Percona experts (free to join and participate). I hope to see you there!

]]>
By: Flavian https://www.percona.com/blog/experiences-with-the-mcafee-mysql-audit-plugin/#comment-4289801 Fri, 10 Jan 2014 14:04:19 +0000 https://www.percona.com/blog/?p=15577#comment-4289801 Hi Guys,

Im trying to install audit plugin into Percona 5.6.14 on Centos 5

When i try to get the offset i get this error

./offset-extract.sh /usr/sbin/mysqld Z16aclauthenticateP3THDjj
//offsets for: /usr/sbin/mysqld (5.6.14-56)
/root/flavian/mysql-audit/offset-extract/offsets.gdb:2: Error in sourced command file:
No symbol table is loaded. Use the “file” command.,

Installed Packages:
Percona-Server-56-debuginfo.x86_64 5.6.14-rel62.0.483.rhel5 installed
Percona-Server-client-56.x86_64 5.6.14-rel62.0.483.rhel5 installed
Percona-Server-devel-56.x86_64 5.6.14-rel62.0.483.rhel5 installed
Percona-Server-server-56.x86_64 5.6.14-rel62.0.483.rhel5 installed
Percona-Server-shared-56.x86_64 5.6.14-rel62.0.483.rhel5 installed

Also when i try to load the plugin im getting

mysql> INSTALL PLUGIN AUDIT SONAME ‘libaudit_plugin.so’;
ERROR 1126 (HY000): Can’t open shared library ‘/usr/lib64/mysql/plugin/libaudit_plugin.so’ (errno: 2 /usr/lib64/mysql/plugin/libaudit_plugin.so: undefined symbol: Z16aclauthenticateP3THDjj)

ll -h /usr/lib64/mysql/plugin/libaudit_plugin.so
total 1.2M
-rwxr-xr-x 1 root root 721K Jan 10 04:27 libaudit_plugin.so

I Also tried to compile audit plugin with percona source code but no luck with dat too.

This is wat i get on 2nd last step of compile

CXX=’gcc -static-libgcc’ CC=’gcc -static-libgcc’ ./configure –with-mysql=Percona-Server-5.6.14 –with-mysql-libservices=Percona-Server-5.6.14-rel62.0/libservices/libmysqlservices.a
checking build system type… x86_64-unknown-linux-gnu
checking host system type… x86_64-unknown-linux-gnu
checking target system type… x86_64-unknown-linux-gnu
checking for a BSD-compatible install… /usr/bin/install -c
checking whether build environment is sane… yes
checking for a thread-safe mkdir -p… /bin/mkdir -p
checking for gawk… gawk
checking whether make sets $(MAKE)… yes
checking how to create a ustar tar archive… gnutar
checking whether to enable debugging… no
checking for mysql source code… configure: error: Failed to find required header file include/my_dir.h in Percona-Server-5.6.13, check the path and make sure you’ve run ‘./configure …. && cd include && make’ in MySQL 5.1 sources dir or ‘cmake . && make’ in MySQL 5.5 sources dir.

]]>
By: Miguel Angel Nieto https://www.percona.com/blog/experiences-with-the-mcafee-mysql-audit-plugin/#comment-3597752 Tue, 10 Dec 2013 11:46:53 +0000 https://www.percona.com/blog/?p=15577#comment-3597752 Hi Jeremiah,

Try to install the debuginfo package:

https://www.percona.com/redir/downloads/Percona-Server-5.6/LATEST/RPM/rhel6/x86_64/Percona-Server-56-debuginfo-5.6.14-rel62.0.483.rhel6.x86_64.rpm

Regards.

]]>
By: Jeremiah Ware https://www.percona.com/blog/experiences-with-the-mcafee-mysql-audit-plugin/#comment-3537330 Fri, 06 Dec 2013 21:06:23 +0000 https://www.percona.com/blog/?p=15577#comment-3537330 Have you tried to get the offsets for the latest version of Percona? I installed percona via yum so it seems that debug symbols are not included.

Here’s details of my perconal install and running the extract script. Do you by chance have a set of audit offsets that work with this version?

[root@db4 ~]# ./extract_offsets.sh /usr/sbin/mysqld _Z16acl_authenticateP3THDjj
//offsets for: /usr/sbin/mysqld (5.6.14-56)
offsets.gdb:2: Error in sourced command file:
No symbol table is loaded. Use the “file” command.,
[root@db4 ~]# mysql –version
mysql Ver 14.14 Distrib 5.6.14, for Linux (x86_64) using EditLine wrapper
[root@db4 ~]# yum list installed | grep Percona
Percona-Server-client-56.x86_64 5.6.14-rel62.0.483.rhel6 @percona
Percona-Server-devel-56.x86_64 5.6.14-rel62.0.483.rhel6 @percona
Percona-Server-server-56.x86_64 5.6.14-rel62.0.483.rhel6 @percona
Percona-Server-shared-56.x86_64 5.6.14-rel62.0.483.rhel6 @percona
[root@db4 ~]#

]]>
By: Shantanu Oak https://www.percona.com/blog/experiences-with-the-mcafee-mysql-audit-plugin/#comment-3244735 Mon, 28 Oct 2013 11:31:39 +0000 https://www.percona.com/blog/?p=15577#comment-3244735 “Quit” will log failed connections. But is there any way to log failed queries?

]]>
By: Fernando Ipar https://www.percona.com/blog/experiences-with-the-mcafee-mysql-audit-plugin/#comment-1778105 Wed, 29 May 2013 22:19:16 +0000 https://www.percona.com/blog/?p=15577#comment-1778105 Peter:

The docs say these are offsets in the mysqld binary to some data structures. By looking at the offset extraction script it seems these are query_id, thread_id, main_security_ctx, command and lex from THD, and comment from LEX.

]]>
By: Peter Zaitsev https://www.percona.com/blog/experiences-with-the-mcafee-mysql-audit-plugin/#comment-1777857 Wed, 29 May 2013 21:19:28 +0000 https://www.percona.com/blog/?p=15577#comment-1777857 Fernando,
And what is about it (most confusing option):
audit_offsets=6464, 6512, 4072, 4512, 104, 2584

]]>
By: Fernando Ipar https://www.percona.com/blog/experiences-with-the-mcafee-mysql-audit-plugin/#comment-1759456 Thu, 23 May 2013 19:36:57 +0000 https://www.percona.com/blog/?p=15577#comment-1759456 Miguel: Filters can be combined, but there’s no way (that I know) to achieve what you want with this plugin. You could add mysql.user to the audit_record_objs variable, for example, but not indicate a specific user for which you want to audit changes.

]]>
By: Miguel Angel Nieto https://www.percona.com/blog/experiences-with-the-mcafee-mysql-audit-plugin/#comment-1759388 Thu, 23 May 2013 18:45:25 +0000 https://www.percona.com/blog/?p=15577#comment-1759388 Can different filters be combined? For example, all the select queries in mysql.user from a particular user.

]]>