Percona XtraDB and the McAfee MySQL Audit Plugin

I am attempting to enable the McAfee audit plugin on a Percona XtraDB installation to validate its functionality to meet security requirements.

Percona XtraDB: 5.5.34

i am stuck getting the offset to work. I can generate the offset correctly, but with the XtraDB build, its 10 numbers.

6576, 6624, 4104, 4616, 104, 2608, 96, 0, 32, 104

If I generate the offset against the server build, its six.

6552, 6600, 4080, 4592, 104, 2608

When starting the XtraDB server with the 10 numbers, the plugin fails to load with this error:

[ERROR] Audit Plugin: Failed parsing audit_offsets: 6576, 6624, 4104, 4616, 104, 2608, 96, 0, 32, 104
[ERROR] Plugin ‘AUDIT’ init function returned error.

I read the post with getting this plugin to work with the server and those instructions were helpful. My question is has the plugin been successfully installed on the XtraDB server?

The offsets are correct. I compiled the plugin against mysql 5.5.16 and the plugin installs just fine.

  1. Install the debug packages for XtraDB cluster and galera on a dev/test member. Get your offsets.
  2. Compile the auditor plugin against the base mysql version for your install. In my case, 5.5.16.
    3, Load the plugin.

I’m having the same issue with 5.5.35-rel33.0. I would appreciate if someone could help.

140204 16:17:09 Percona XtraDB (http://www.percona.com) 5.5.35-rel33.0 started; log sequence number 1597945
140204 16:17:09 [Note] Audit Plugin: starting up. Version: 1.0.2 , Revision: 345 (64bit). AUDIT plugin interface version: 50535. MySQL Server version: 5.5.35-33.0.
140204 16:17:09 [Note] Audit Plugin: setup_offsets audit_offsets: 6560, 6608, 4088, 4600, 104, 2608, 96, 0, 32, 104
140204 16:17:09 [Note] Audit Plugin: Validate checksum enabled. Mysqld /usr/sbin/mysqld
140204 16:17:09 [ERROR] Audit Plugin: Failed parsing audit_offsets: 6560, 6608, 4088, 4600, 104, 2608, 96, 0, 32, 104
140204 16:17:09 [ERROR] Plugin ‘AUDIT’ init function returned error.
140204 16:17:09 [Note] Audit Plugin: deinit

rpm -qa|grep Percona
Percona-Server-server-55-5.5.35-rel33.0.611.rhel5
Percona-Server-shared-55-5.5.35-rel33.0.611.rhel5
Percona-Server-55-debuginfo-5.5.35-rel33.0.611.rhel5
Percona-Server-shared-compat-5.5.35-rel33.0.611.rhel5
Percona-Server-client-55-5.5.35-rel33.0.611.rhel5

gdb is installed

which gdb

/usr/bin/gdb

Thank you.

Hi fleveneur,

Try using the latest dev snapshot build from: [url]JFrog Distribution: Get your software to where it needs to be -- ASAP!

If you have questions please feel free to open an issue at: [url]Issues · mcafee-enterprise/mysql-audit · GitHub

Best,

Guy

Guy,
Thank you, it worked. Much appreciated.