MDEV-35511: Backport fix for Audit log not reporting user in Galera cluster #4412
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
|
janlindstrom
approved these changes
Nov 5, 2025
sql/sql_show.cc
Outdated
| /* USER */ | ||
| val= tmp_sctx->user && tmp_sctx->user != slave_user ? tmp_sctx->user : | ||
| val= tmp_sctx->user && (tmp_sctx->user != slave_user && | ||
| tmp_sctx->user != cluster_user) ? tmp_sctx->user : |
Contributor
There was a problem hiding this comment.
Nick-pit: Formatting is incorrect.
sjaakola
force-pushed
the
bb-10.6-MDEV-35511
branch
from
38d35d7 to
2e04278
Compare
…luster Setting a nae for the the THD::security_ctx:user field for wsrep applier threads. With this, the audit log events related to wsrep applying will be written in the audit log. Using user name <cluster user> for wsrep appliers. This is for having identical look with async replication, which uses: <replication_user> user name. Another option for <cluster user> could be e.g. <wsrep user>. Hoever, using galera for user name is not a good pick, as the cluster may have (and soon will have) other GCS backends. Using same approach as async replication to replace the security_ctx user name with "system user" for processlist output. Commit has also mtr test galera.MDEV-35511, to vevrify wsrep applier audit logging. The test does not install/uninstall audit log plugin, bu loads the audit log plugin before the test. This is because uninstalling the audit log plugin gives a warning saying that plugin is busy and uninstall will be delayed until server shutdown. This anomaly must be because of the applier thread being active audit logger. Same problem with plugin unsinstall happens also with async relication workers. If plugn remains installed, the post test sanity check will complain of mismatching state of pre and post test states.
sjaakola
force-pushed
the
bb-10.6-MDEV-35511
branch
from
2e04278 to
41a2ccc
Compare
vuvova
reviewed
Nov 13, 2025
| const char *my_localhost= "localhost", | ||
| *delayed_user= "delayed", *slave_user= "<replication_slave>"; | ||
| *delayed_user= "delayed", *slave_user= "<replication_slave>", | ||
| *cluster_user= "<cluster applier>"; |
Member
There was a problem hiding this comment.
isn't it supposed to be "wsrep applier" ?
Contributor
Author
|
moved to another PR for 10.11 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
This PR assigns a user name "" for wsrep applier threads. With this change, audit log plugin will recognize applier threads and print events for their activities in the audit log.
Release Notes
audit log will have events for galera cluster replication applier operations with generic name
How can this PR be tested?
PR has a new mtr test: galera.MDEV-35511
TODO: modify the automated test suite to verify that the PR causes MariaDB to behave as intended.
Consult the documentation on "Writing good test cases".
If the changes are not amenable to automated testing, please explain why not and carefully describe how to test manually.
Basing the PR against the correct MariaDB version
mainbranch.PR quality check