maria-discuss team mailing list archive

[Philippe Maladjian <pmaladjian@xxxxxxxxxx>]

Hi there,

In order to monitor a database and especially the requests that could
be in error, I activated the server_audit plugin.

Plugin setup:

show global VARIABLES like '%server_audit%';
+-------------------------------+---------------------------------+
| Variable_name                 | Value                           |
+-------------------------------+---------------------------------+
| server_audit_events           | QUERY                           |
| server_audit_excl_users       | user                            |
| server_audit_file_path        | /var/log/mysql/server_audti.log |
| server_audit_file_rotate_now  | OFF                             |
| server_audit_file_rotate_size | 1000000                         |
| server_audit_file_rotations   | 9                               |
| server_audit_incl_users       | user                            |
| server_audit_logging          | ON                              |
| server_audit_mode             | 0                               |
| server_audit_output_type      | file                            |
| server_audit_query_log_limit  | 1024                            |
| server_audit_syslog_facility  | LOG_USER                        |
| server_audit_syslog_ident     | mysql-server_auditing           |
| server_audit_syslog_info      |                                 |
| server_audit_syslog_priority  | LOG_ERR                         |
+-------------------------------+---------------------------------+

My problem is that the separator between each value is the comma and
bad luck it's the same separator as in the query.

Example of a line:

20220622 08:35:03,sserver,user,localhost,14858,7002875,QUERY,database,'UPDATE sorderq SET `odlqty` = "6", `soqsta` = "3", `sdhnum` = "LIVHIL22062", `sddlin` = 24000 WHERE `sohnum` = "NORHIL220601" AND `soplin` = 24000 AND `soqseq` = 24000',0
[...]
20220622 08:35:03,server,user,localhost,14858,7002878,QUERY,database,'INSERT INTO sdeliveryd(`sdhnum`, `itmref`, `sddlin`, `netprinot`, `qty`, `rtnqty`, `tsicod0`, `tsicod1`, `tsicod2`, `tsicod3`, `tsicod4`, `rep1`) VALUES("LIVHIL22061", "1-11325", 26000, 0.0, "12", "0", "STA", "05", " ", " ", " ", "093")',0

It is the last field that interests me because it is the return code of
the request. Now if I want to automate the error processing (last field
<> 0) I simply cannot because due to the identical separator between
the fields of the request and the fields of the log line, the number of
columns varies and the return code never has the same position.

Is it possible to change the field separator in the plugin?

Thanks in advance