Consider the Mysql Enterprise Audit plugin.
You are checking user accounts and attempt the following query:
Mysql> SELECT user, host, plugin FROM mysql.users;
ERROR 1146 (42S02): Table ‘mysql.users’ doesn’t exist
Which subset of event attributes would indicate this error in the audit.log file?
A.
NAME=”Query”
STATUS=”1146”
SQLTEXT=”select user,host from users”/>
B.
NAME=”Error”
STATUS=”1146”
SQLTEXT=”Error 1146 (42S02): Table ‘mysql.users’ doesn’t exist”/>
C.
NAME=”Query”
STATUS=”1146”
SQLTEXT=” Error 1146 (42S02): Table ‘mysql.users’ doesn’t exist”/>
D.
NAME=”Error”
STATUS=”1146”
SQLTEXT=”select user,host from users”/>
E.
NAME=”Error”
STATUS=”0”
SQLTEXT=”Error 1146 (42S02): Table ‘mysql.users’ doesn’t exist”/>
Explanation:
A appears to be the answer. Can anyone explain why it should be C?
Thanks
The answer is “A”, confirmed from personal trial.
For answer A
The original select query is SELECT user, host, plugin FROM mysql.users;
But the SQLTEXT in answer A refers to “SELECT user,host from users”
The plugin column is missing in SQLTEXT.C
The confusion is that the select queries are inaccurate according to the query stated as ran.
However, the audit log does not have a name value of Error allowed, so all the answers using Error are thrown out.
The only possible answer left is A, due to the correct SQLTEXT value.
Steve, as usual, is right again. The NAME field is misleading, but can contain only like 15 or so values as QUERY, CONNECT, QUIT, SHUTDOWN, EXECUTE, AUDIT and NO AUDIT (and others, but definitely no ERROR). The value of ERROR is not something that can exist in the NAME field. (so B, D, E are wrong).
If an error occurs, then it’s number will be in STATUS. If STATUS is zero, then it means that no error occurred. (so E can’t be right)
SQL_TEXT must be the query, if any. It’s not the error.
The Error string is not stored in the audit-file. The mysql documentation actually says “The audit log does not contain the SQLSTATE value or error message…” which is sad.
So A is the correct answer.
A
Seems A because according to manual SQLSTATE/error text is not stored in audit log
So, A? OK, but given the question, what I understand is that for A to be the right answer, it must states:
SQLTEXT=”select user,host,plugin from users”/>
Because the original question includes “plugin” in the query.
So, for A to be the correct answer, it has to include a correction to that typo.