github
/
mysql-audit
mirror of https://github.com/mcafee-enterprise/mysql-audit
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Updated Troubleshooting (markdown)

master
Aharon Robbins 2018-01-30 17:35:45 +02:00
parent fb2c0a215f
commit 64032b362a
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
Troubleshooting.md

@ -6,6 +6,10 @@ If the AUDIT plugin fails to install, error messages will be logged in the MySQL
Check the error log for AUDIT plugin messages to better understand what is happening during the install process.
### Plugin Fails To Load With Hot-patching Problems
On systems with SELinux enabled (Fedora, RHEL, CentOS), the plugin may fail to load with an error during hot patching. There may be an error message in the MySQL error log recommending that you disable SELinux execmod protection for mysqld. Try that, or even more simply, try disabling SELinux, and see if that allows the plugin to load. Similar issues may occur on Debian-based systems with AppArmor.
### Checksum Validation
AUDIT plugin uses compiled offsets for accessing built-in MySQL data structures that are not exposed through a consistent API. The use of offsets is used for supporting multiple MySQL versions with a single binary distribution. The plugin will use the proper offsets according to the MySQL server version. To verify that the plugin is running on a MySQL version which we know and tested the offsets for, we've added a checksum verification on the mysqld binary. Thus, if a MySQL server distribution, which we haven't extracted the offsets and checksum for, is being used, the plugin will fail installation as the checksum of mysqld will not match a known checksum. Usually, the offsets between different MySQL distributions are the same for a specific version. Thus, it is possible to run the AUDIT plugin with the offsets of a specific MySQL server version without checksum verification. If checksum verification fails the log will contain an error of the form: