Audit plugin, log values used in prepared statements
Description
Environment
Smart Checklist
Activity
Oleksandr Kachan June 12, 2023 at 3:32 PM
This works with the new audit plugin. For example, executing
will log audit events with the following fields (not including the whole output here)
Oleksandr Kachan May 31, 2023 at 10:30 AM
This should work for our new audit plugin. Added MTR test to make sure there is separate record with actual parameters values for each prepared statement execution.
Michael Coburn May 2, 2017 at 12:47 PM
Hi , thanks for submitting this request. In terms of logging actual queries you have available the Slow log or Performance Schema so you'll see the final input values there. The audit log isn't designed to replicate the Slow log, but rather provide an audit trail of activity within the database.
Prepared statements by design submit their first request without values to the MySQL server in order to evaluate the query execution plan that will be used on subsequent requests. This is something the client library applies and thus there isn't anything the MySQL server can do about it. I might be mistaken on how prepared statements work across audit log and Slow log, please share a reproducible test case if you see behaviour differently.
I'll move this also into the Percona Server queue so that the Development team can have a review. Thanks for your submission,
Details
Details
Assignee
Reporter
Fix versions
Priority
Smart Checklist
Open Smart Checklist
Smart Checklist

The Percona audit plugin does not currently log values used in prepared statements. An example of the log file can be found here:
https://github.com/apolloclark/vagrant-lamp/blob/master/data/logs_examples/percona_audit_prepared_statement.txt
Vagrant based Ubuntu 16.04 box, with Percona 5.6.35 to test this, here:
https://github.com/apolloclark/vagrant-lamp/tree/master/ubuntu16/percona-5.6.35
Configuration:
https://github.com/apolloclark/vagrant-lamp/blob/master/ubuntu16/percona-5.6.35/provision/mysql/my.cnf#L115
None prepared statements are including logged values, which is very helpful when I'm doing security audits and investigations. Without logging for prepared statements, I have to spend a lot of time guessing what the final input values where after being processed through a front-end CMS.