# Audit plugin is not honouring configuration parameters **URL:** \ **Category:** Percona Server for MySQL 5.7\ **Tags:** percona\ **Created:** [March 6, 2024, 3:24pm UTC](https://forums.percona.com/t/audit-plugin-is-not-honouring-configuration-parameters/28998 "2024-03-06T15:24:01Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![macbar](https://avatars.discourse-cdn.com/v4/letter/m/e8c25b/32.png) [@macbar](https://forums.percona.com/u/macbar)\ **Post date:** [March 6, 2024, 3:24pm UTC](https://forums.percona.com/t/audit-plugin-is-not-honouring-configuration-parameters/28998/1 "2024-03-06T15:24:01Z")
Hi all, I’m having issues in making the audit log plugin behave correctly, notably, ignoring audit\_log\_syslog\_facility, audit\_log\_syslog\_ident and audit\_log\_include\_accounts. First of all, here’s my config: ```auto mysql> show variables like 'audit%'; +-----------------------------+--------------+ | Variable_name | Value | +-----------------------------+--------------+ | audit_log_buffer_size | 1048576 | | audit_log_exclude_accounts | | | audit_log_exclude_commands | | | audit_log_exclude_databases | | | audit_log_file | audit.log | | audit_log_flush | OFF | | audit_log_format | JSON | | audit_log_handler | SYSLOG | | audit_log_include_accounts | | | audit_log_include_commands | | | audit_log_include_databases | | | audit_log_policy | ALL | | audit_log_rotate_on_size | 0 | | audit_log_rotations | 0 | | audit_log_strategy | ASYNCHRONOUS | | audit_log_syslog_facility | LOG_LOCAL1 | | audit_log_syslog_ident | myaudit | | audit_log_syslog_priority | LOG_INFO | +-----------------------------+--------------+ 18 rows in set (0.00 sec) ``` Using this config, I’m seeing audit\_record messages being logged using the ‘mysqld’ ident instead of the ‘myaudit’ ident. The audit\_record messages are also being logged using the ‘LOG\_AUTH’ facility instead of ‘LOG\_LOCAL1’. The strange thing is, that neither ‘mysqld’ nor ‘LOG\_AUTH’ are defailt values for ident respectively facility. Mysql starts with this config file: ```auto [mysqld] plugin-load="audit_log=audit_log.so" audit_log_format = JSON audit_log_handler = SYSLOG audit_log_syslog_ident='myaudit' audit_log_syslog_facility = LOG_LOCAL1 audit_log_syslog_priority = LOG_INFO audit_log_policy = ALL ``` The first log entry upon starting is: ```auto Mar 6 11:40:49 mydb myaudit: {"audit_record":{"name":"Audit","record":"1_1970-01-01T00:00:00","timestamp":"2024-03-06T10:40:49 UTC","mysql_version":"5.7.44-48-log","startup_optionsi":"--daemonize --pid-file=/var/run/mysqld/mysqld.pid","os_version":"x86_64-debian-linux-gnu"}} ``` This message uses the correct ident and is using the correct facility as well. All subsequent audit log entries are using LOG\_AUTH and mysqld: ```auto Mar 6 11:40:50 mydb mysqld[2614148]: {"audit_record":{"name":"Connect","record":"2_1970-01-01T00:00:00","timestamp":"2024-03-06T10:40:49 UTC","connection_id":"2","status":0,"user":"pt_heartbeat","priv_user":"pt_heartbeat","os_login":"","proxy_user":"","host":"localhost","ip":"","db":"pt_heartbeat"}} ``` up until the last log entry: ```auto Mar 6 11:41:34 mydb mysqld[2614148]: {"audit_record":{"name":"NoAudit","record":"389_1970-01-01T00:00:00","timestamp":"2024-03-06T10:41:34 UTC","mysql_version":"5.7.44-48-log","startup_optionsi":"--daemonize --pid-file=/var/run/mysqld/mysqld.pid","os_version":"x86_64-debian-linux-gnu"}} ``` Furthermore, as soon as I start using the audit\_log\_include\_accounts, no logging is produced. I’ve been trying to get the audit log to behave for the last few days, using strace, tcpdump, etc. All to no avail. What am I doing wrong or am I using a buggy version? Thanks, Pieter. ---
**Author:** ![Agustin\_G](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/agustin_g/32/14111_2.png) [@Agustin\_G](https://forums.percona.com/u/Agustin_G)\ **Post date:** [March 9, 2024, 2:28am UTC](https://forums.percona.com/t/audit-plugin-is-not-honouring-configuration-parameters/28998/2 "2024-03-09T02:28:21Z")
Hi Pieter, I quickly tested this and couldn’t reproduce what you are getting with the ident string: ```auto [root@default ~]# journalctl -u mysqld -- Logs begin at Sat 2024-03-09 01:59:45 UTC, end at Sat 2024-03-09 02:05:54 UTC. -- Mar 09 02:03:48 default myaudit[1301]: {"audit_record":{"name":"Audit","record":"1_1970-01-01T00:00:00","timestamp":"2024-03-09T02:03:48 UTC","mysql_version":"5.7.44-48-log",> Mar 09 02:03:51 default myaudit[1301]: {"audit_record":{"name":"Connect","record":"2_1970-01-01T00:00:00","timestamp":"2024-03-09T02:03:51 UTC","connection_id":"2","status":0> Mar 09 02:03:51 default myaudit[1301]: {"audit_record":{"name":"Query","record":"3_1970-01-01T00:00:00","timestamp":"2024-03-09T02:03:51 UTC","command_class":"select","connec> Mar 09 02:03:52 default myaudit[1301]: {"audit_record":{"name":"Query","record":"4_1970-01-01T00:00:00","timestamp":"2024-03-09T02:03:52 UTC","command_class":"show_variables"> Mar 09 02:03:58 default myaudit[1301]: {"audit_record":{"name":"Quit","record":"5_1970-01-01T00:00:00","timestamp":"2024-03-09T02:03:58 UTC","connection_id":"2","status":0,"u> Mar 09 02:05:48 default myaudit[1301]: {"audit_record":{"name":"Connect","record":"6_1970-01-01T00:00:00","timestamp":"2024-03-09T02:05:48 UTC","connection_id":"3","status":0> ... ``` I copy/pasted the configurations you sent over here. Note that 5.7 is EOL already (since Nov 2023) and it’s likely it won’t get any work done in this area. I suggest you to test with 8.0, and if you are still seeing these issues, report a bug in [https://jira.percona.com/](https://jira.percona.com/).