Error installing plugin AUDIT in Debian with MySQL Server version: 5.5.28-1~dotdeb.0.

Greetings, I'm having issues installing the MySQL plugin of McAfee Database Security on Debian . I've tried the two procedures indicated in the documentation receiving the following errors:

1. Using the statement: INSTALL PLUGIN AUDIT SONAME 'libaudit_plugin.so':

MySQL> INSTALL PLUGIN AUDIT SONAME 'libaudit_plugin.so';
ERROR 1123 (HY000): Can't initialize function 'AUDIT'; Plugin initialization function failed.

2. Adding to the MySQL option file (my.cnf) at the [mysqld] section the option: plugin-load=AUDIT=libaudit_plugin.so:
   Nov 2 04:52:51 debian64 mysqld: 121102 4:52:51 [Note] Audit Plugin: Set interface version to: 12931328 (50513)
   Nov 2 04:52:51 debian64 mysqld: 121102 4:52:51 [Note] Audit Plugin: starting up. Version: 1.0.0, Revision: 304. AUDIT plugin interface version: 50513. MySQL Server version: 5.5.13-2.
   Nov 2 04:52:51 debian64 mysqld: 121102 4:52:51 [Note] Audit Plugin: setup_offsets offsets_string (null)
   Nov 2 04:52:51 debian64 mysqld: 121102 4:52:51 [Note] Audit Plugin: Audit validate checksum enabled. Mysqld /usr/sbin/mysqld
   Nov 2 04:52:51 debian64 mysqld: 121102 4:52:51 [Note] Audit Plugin: Couldn't find proper THD offsets for: 5.5.13-2
   Nov 2 04:52:51 debian64 mysqld: 121102 4:52:51 [ERROR] Plugin 'AUDIT' init function returned error.
   Nov 2 04:52:51 debian64 mysqld: 121102 4:52:51 [Note] Audit Plugin: removing hot patching function: 0xf5adf9c0
   Nov 2 04:52:51 debian64 mysqld: 121102 4:52:51 [Note] Audit Plugin: targetPage: 0xf5adf000 targetFunction: 0xf5adf9c0
   Nov 2 04:52:51 debian64 mysqld: 121102 4:52:51 [Note] Audit Plugin: removing hot patching function: 0xf5aa3ef0
   Nov 2 04:52:51 debian64 mysqld: 121102 4:52:51 [Note] Audit Plugin: targetPage: 0xf5aa3000 targetFunction: 0xf5aa3ef0
   Nov 2 04:52:51 debian64 mysqld: 121102 4:52:51 [Note] Audit Plugin: removing hot patching function: 0xf5ab2080
   Nov 2 04:52:51 debian64 mysqld: 121102 4:52:51 [Note] Audit Plugin: targetPage: 0xf5ab2000 targetFunction: 0xf5ab2080
   Nov 2 04:52:51 debian64 mysqld: 121102 4:52:51 [Note] Audit Plugin: removing hot patching function: 0xf5ab5610
   Nov 2 04:52:51 debian64 mysqld: 121102 4:52:51 [Note] Audit Plugin: targetPage: 0xf5ab5000 targetFunction: 0xf5ab5610
   Nov 2 04:52:51 debian64 mysqld: 121102 4:52:51 [Note] Audit Plugin: removing hot patching function: 0xf5ae0cb0
   Nov 2 04:52:51 debian64 mysqld: 121102 4:52:51 [Note] Audit Plugin: targetPage: 0xf5ae0000 targetFunction: 0xf5ae0cb0
   Nov 2 04:52:51 debian64 mysqld: 121102 4:52:51 [Note] Audit Plugin: removing hot patching function: 0xf5ae50e0
   Nov 2 04:52:51 debian64 mysqld: 121102 4:52:51 [Note] Audit Plugin: targetPage: 0xf5ae5000 targetFunction: 0xf5ae50e0

The problem probably is that the OFFSET parameters should be indicated but we don't know them and we were unable to run the ./offset-extract.sh /usr/sbin/mysqld to find them. It trows the next error:

root@Debian64:/etc/mysql# ./offset-extract.sh /usr/sbin/mysqld
set logging on
printf "{"5.5.28-1","2eaab403212b52f78a22835c79d15175", %d, %d, %d, %d, %d, %d}", ((size_t)&((THD )log_slow_statement)->query_id) - (size_t)log_slow_statement, ((size_t)&((THD *)log_slow_statement)->thread_id) - (size_t)log_slow_statement, ((size_t)&((THD *)log_slow_statement)->main_security_ctx) - (size_t)log_slow_statement, ((size_t)&((THD *)log_slow_statement)->command) - (size_t)log_slow_statement, ((size_t)&((THD *)log_slow_statement)->lex) - (size_t)log_slow_statement, (size_t)&((LEX)log_slow_statement)->comment - (size_t) log_slow_statement
//offsets for: /usr/sbin/mysqld (5.5.28-1)
/etc/mysql/offsets.gdb:2: Error in sourced command file:
No symbol table is loaded. Use the "file" command.,

Using the parameter audit_validate_checksum=OFF doesn't fx the problem either.

We've tried with different versions of MySQL Server 5.5.28-1~dotdeb.0. and MySql 5.1

Please help us, what can we try now? Any information should be useful, thanks in advance,

[glicht]

You are using an old version of the plugin. Please try using version 1.0.2. It is available for download from:

https://github.com/mcafee/mysql-audit/downloads

Offsets for 5.5.28 are still not compiled in the 1.0.2 release. This will be included in 1.0.3 release which is due out soon.

You can try adding the following to my.cnf to support 5.5.28:

audit_offsets=6032, 6080, 3784, 4208, 88, 2568

Keep us updated if this helps.

[soneca]

Thank you very much it working,
but i have a other mysql version 5.1.63-otsqveezc1 and failed charging pluging 5.1.102 of https://github.com/mcafee/mysql-audit/downloads

Please give me the offset?

[glicht]

5.1.63 should be supported in 1.0.2 version. Did you add the following to my.cnf:

plugin-load=AUDIT=libaudit_plugin.so
audit_validate_checksum=OFF

Please make sure that these params are set and report back if you have issues. If so please include the output in the mysql error log.

[glicht]

Closing issue as no reply in over 5 days. If you still need help feel free to re-open.

[deivuh]

I'm having the same problem as soneca. After adding those lines, I'm unable to start mysql.

[glicht]

Hi Deivuh,

Can you send out the exact version of MySQL you are using and also include
the MySQL error log.

Much thanks,

Guy

On Sat, Nov 17, 2012 at 9:38 PM, Deivuh notifications@github.com wrote:

I'm having the same problem as soneca. After adding those lines, I'm
unable to start mysql.

—
Reply to this email directly or view it on GitHubhttps://github.com//issues/16#issuecomment-10477949.

[deivuh]

Hi Guy,

Sorry for late response. Not sure if I should open another issue.

MySQL version is 5.1.63-0+squeeze1-log

When I try to install it through install command I get the following:

ERROR 1126 (HY000): Can't open shared library '/usr/lib/mysql/plugin/libaudit_plugin.so' (errno: 2 undefined symbol: mysql_mandatory_plugins)

Thanks.

[glicht]

Please make sure you are installing the plugin version meant for mysql 5.1.
The error you specify will occur if you install the 5.5 version of the
plugin on mysql 5.1.x.

Best,

Guy

---

Sent from my mobile device
On Nov 30, 2012 9:41 PM, "Deivuh" notifications@github.com wrote:

Hi Guy,

Sorry for late response. Not sure if I should open another issue.

MySQL version is 5.1.63-0+squeeze1-log

When I try to install it through install command I get the following:

ERROR 1126 (HY000): Can't open shared library
'/usr/lib/mysql/plugin/libaudit_plugin.so' (errno: 2 undefined symbol:
mysql_mandatory_plugins)

Thanks.

—
Reply to this email directly or view it on GitHubhttps://github.com//issues/16#issuecomment-10901116.

[deivuh]

Thanks it solved this problem, now I'm having the following error:

Can't initialize function 'AUDIT'; Plugin initialization function failed.

Which is the same one as the OP's. Since it's the newest version for mySQL 5.1, do I need to set offsets?

Thanks.

[glicht]

Not sure. Need to see the mysql error log output. It is best to open a new
issue with the full details and the mysql error log.

Best,

Guy

---

Sent from my mobile device
On Dec 1, 2012 8:43 PM, "Deivuh" notifications@github.com wrote:

Thanks it solved this problem, now I'm having the following error:

Can't initialize function 'AUDIT'; Plugin initialization function failed.

Which is the same one as the OP's. Since it's the newest version for mySQL
5.1, do I need to set offsets?

Thanks.

—
Reply to this email directly or view it on GitHubhttps://github.com//issues/16#issuecomment-10920433.

[sachindba]

Hi All,

Greetings, I'm having issues installing the MySQL Audit plugin in Ubuntu 16.04 and CentOS 7 with MySQL Server version: 5.7 following errors:

Using the statement: INSTALL PLUGIN AUDIT SONAME 'libaudit_plugin.so':

MySQL> INSTALL PLUGIN AUDIT SONAME 'libaudit_plugin.so';
ERROR 1123 (HY000): Can't initialize function 'AUDIT'; Plugin initialization function failed.

Error Log :

2016-11-04T13:46:06.107020Z 3 [Warning] option 'audit-json-file-bufsize': signed value 0 adjusted to 1
2016-11-04T13:46:06.107077Z 3 [Warning] option 'plugin-audit-json-file-bufsize': signed value 0 adjusted to 1
2016-11-04T13:46:06.107177Z 3 [Note] Audit Plugin: starting up. Version: 1.0.9 , Revision: 585 (64bit). AUDIT plugin interface version: 1025 (0x401). MySQL Server version: 5.7.16-0ubuntu0.16.04.1-log.
2016-11-04T13:46:06.107200Z 3 [Note] Audit Plugin: setup_offsets audit_offsets: (null) validate_checksum: 0 offsets_by_version: 1
2016-11-04T13:46:06.196736Z 3 [Note] Audit Plugin: mysqld: /usr/sbin/mysqld (e661c94ddf9b0fcc5ac4160380f24659)
2016-11-04T13:46:06.196770Z 3 [Note] Audit Plugin: Couldn't find proper THD offsets for: 5.7.16-0ubuntu0.16.04.1-log
2016-11-04T13:46:06.196775Z 3 [ERROR] Plugin 'AUDIT' init function returned error.
2016-11-04T13:46:06.196779Z 3 [ERROR] Plugin 'AUDIT' registration as a AUDIT failed.
2016-11-04T13:46:06.196797Z 3 [Note] Shutting down plugin 'AUDIT'
2016-11-04T13:46:06.196802Z 3 [Note] Audit Plugin: deinit

Using the parameter plugin-load=AUDIT=libaudit_plugin.so, audit_validate_checksum=OFF
doesn't fx the problem either.

Please help us, what can we try now? Any information should be useful, thanks in advance,

[glicht]

Try using the the dev-snapshot build (it is planned to replace the release
build soon). It contains offsets for the version you are using:

https://bintray.com/mcafee/mysql-audit-plugin/dev-snapshot

Guy

On Nov 4, 2016 9:58 AM, "sachindba" notifications@github.com wrote:

Hi All,

Greetings, I'm having issues installing the MySQL Audit plugin in Ubuntu
16.04 and CentOS 7 with MySQL Server version: 5.7 following errors:

Using the statement: INSTALL PLUGIN AUDIT SONAME 'libaudit_plugin.so':

MySQL> INSTALL PLUGIN AUDIT SONAME 'libaudit_plugin.so';
ERROR 1123 (HY000): Can't initialize function 'AUDIT'; Plugin
initialization function failed.

Error Log :

2016-11-04T13:46:06.107020Z 3 [Warning] option 'audit-json-file-bufsize':
signed value 0 adjusted to 1
2016-11-04T13:46:06.107077Z 3 [Warning] option 'plugin-audit-json-file-bufsize':
signed value 0 adjusted to 1
2016-11-04T13:46:06.107177Z 3 [Note] Audit Plugin: starting up. Version:
1.0.9 , Revision: 585 (64bit). AUDIT plugin interface version: 1025
(0x401). MySQL Server version: 5.7.16-0ubuntu0.16.04.1-log.
2016-11-04T13:46:06.107200Z 3 [Note] Audit Plugin: setup_offsets
audit_offsets: (null) validate_checksum: 0 offsets_by_version: 1
2016-11-04T13:46:06.196736Z 3 [Note] Audit Plugin: mysqld:
/usr/sbin/mysqld (e661c94ddf9b0fcc5ac4160380f24659)
2016-11-04T13:46:06.196770Z 3 [Note] Audit Plugin: Couldn't find proper
THD offsets for: 5.7.16-0ubuntu0.16.04.1-log
2016-11-04T13:46:06.196775Z 3 [ERROR] Plugin 'AUDIT' init function
returned error.
2016-11-04T13:46:06.196779Z 3 [ERROR] Plugin 'AUDIT' registration as a
AUDIT failed.
2016-11-04T13:46:06.196797Z 3 [Note] Shutting down plugin 'AUDIT'
2016-11-04T13:46:06.196802Z 3 [Note] Audit Plugin: deinit

Using the parameter plugin-load=AUDIT=libaudit_plugin.so,
audit_validate_checksum=OFF
doesn't fx the problem either.

Please help us, what can we try now? Any information should be useful,
thanks in advance,

—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub
#16 (comment),
or mute the thread
https://github.com/notifications/unsubscribe-auth/ABVMVdSshuXPMCIHR_Qo4kLUiBSAIUkAks5q6zoggaJpZM4AO80m
.