MySQL5.7.34安装Mariadb审计插件crash with signal11

一、环境：

阿里ECS
系统:CentOS Linux release 7.6.1810 (Core)
mysql版本5.7.34
Mariadb版本: mariadb-10.2.17-linux-glibc_214-x86_64
Mariadb版本: mariadb-10.1.48-linux-glibc_214-x86_64
Mariadb版本: mariadb-10.4.24-linux-glibc_214-x86_64
Mariadb版本: mariadb-10.1.10-linux-glibc_214-x86_64.tar.gz

Mariadb下载地址:

登录后复制

https://downloads.mariadb.com/MariaDB/mariadb-10.1/bintar-linux-glibc_214-x86_64/mariadb-10.1.48-linux-glibc_214-x86_64.tar.gz
1.

Mariadb官方提供审计插件对应的版本号如下:

二、GA版MySQL5.7.34安装mariadb审计插件

安装 mariadb-10.2.17-linux-glibc_214-x86_64 下的审计插件 mysql服务直接crash掉
报错日志如下:

登录后复制

Version: '5.7.34-log'  socket: '/tmp/mysql.sock'  port: 3306  MySQL Community Server (GPL)
16:08:59 UTC - mysqld got signal 11 ;
This could be because you hit a bug. It is also possible that this binary
or one of the libraries it was linked against is corrupt, improperly built,
or misconfigured. This error can also be caused by malfunctioning hardware.
Attempting to collect some information that could help diagnose the problem.
As this is a crash and something is definitely wrong, the information
collection process might fail.

key_buffer_size=33554432
read_buffer_size=8388608
max_used_connections=1
max_threads=1000
thread_count=1
connection_count=1
It is possible that mysqld could use up to 
key_buffer_size + (read_buffer_size + sort_buffer_size)*max_threads = 12334158 K  bytes of memory
Hope that's ok; if not, decrease some variables in the equation.

Thread pointer: 0x7f0d58000ae0
Attempting backtrace. You can use the following information to find out
where mysqld died. If you see no messages after this, something went
terribly wrong...
stack_bottom = 7f0d8700de68 thread_stack 0x80000
mysqld(my_print_stacktrace+0x35)[0xf74295]
mysqld(handle_fatal_signal+0x4b9)[0x7fa379]
/lib64/libpthread.so.0(+0xf630)[0x7f0e84b4a630]
/usr/local/mysql-5.7.34-linux-glibc2.12-x86_64/lib/plugin/server_audit.so(get_db_mysql57+0x30)[0x7f0d8709dd40]
/usr/local/mysql-5.7.34-linux-glibc2.12-x86_64/lib/plugin/server_audit.so(+0xce4b)[0x7f0d8709de4b]
mysqld(_Z18mysql_audit_notifyP3THD30mysql_event_general_subclass_tPKciS3_m+0x2f1)[0x7fc9d1]
mysqld(my_message_sql+0x134)[0x7ec5b4]
mysqld(my_error+0xe0)[0xf6f0b0]
mysqld[0xcfac8f]
mysqld(_Z22thd_prepare_connectionP3THD+0x5e)[0xcfb19e]
mysqld(handle_connection+0x28b)[0xe10bdb]
mysqld(pfs_spawn_thread+0x174)[0x13e1e64]
/lib64/libpthread.so.0(+0x7ea5)[0x7f0e84b42ea5]
/lib64/libc.so.6(clone+0x6d)[0x7f0e835fa9fd]

Trying to get some variables.
Some pointers may be invalid and cause the dump to abort.
Query (0): is an invalid pointer
Connection ID (thread ID): 2
Status: NOT_KILLED

The manual page at http://dev.mysql.com/doc/mysql/en/crashing.html contains
information that should help you find out what is causing the crash.
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
13.
14.
15.
16.
17.
18.
19.
20.
21.
22.
23.
24.
25.
26.
27.
28.
29.
30.
31.
32.
33.
34.
35.
36.
37.
38.
39.
40.
41.
42.
43.
44.
45.
46.
47.

官方说这个是mariadb审计插件的一个bug 出现在 audit审计插件1.4.10版本以下
官方BUG地址:
 https://jira.mariadb.org/browse/MDEV-25498?jql=text ~ "server_audit"

三、测试验证官方的说法

尝试 mariadb-10.5.15-linux-x86_64 版本的插件 同样 mysql5.7.34 直接crash
尝试mariadb-10.1.48-linux-glibc_214-x86_64版本的插件 同样 mysql5.7.34 直接crash
尝试 mariadb-10.4.24-linux-glibc_214-x86_64.tar.gz版本的插件 同样 mysql5.7.34 直接crash

尝试 mariadb-10.6.7-linux-systemd-x86_64.tar.gz版本的插件报错如下:

登录后复制

root@tsdb05 00:43:  [(none)]> install plugin server_audit soname 'server_audit.so';
ERROR 1126 (HY000): Can't open shared library '/usr/local/mysql-5.7.34-linux-glibc2.12-x86_64/lib/plugin/server_audit.so' (errno: 2 /usr/local/mysql-5.7.34-linux-glibc2.12-x86_64/lib/plugin/server_audit.so: undefined symbol: psi_prlock_wrlock)
1.
2.

尝试mariadb-10.1.10-linux-glibc_214-x86_64.tar.gz 版本的插件报错如下:

登录后复制

root@tsdb05 01:21:  [(none)]> install plugin server_audit soname 'server_audit.so';
ERROR 1126 (HY000): Can't open shared library '/usr/local/mysql-5.7.34-linux-glibc2.12-x86_64/lib/plugin/server_audit.so' (errno: 2 /usr/local/mysql-5.7.34-linux-glibc2.12-x86_64/lib/plugin/server_audit.so: undefined symbol: _my_thread_var)
1.
2.

总结: mariadb的审计插件和GA版本MySQL5.7.32以上的版本基本不兼容了，而且感觉mariadb官方对自己的审计插件兼容GA版MySQL5.7.32以上的版本基本不在维护和修复bug了。而且提交官方https://jira.mariadb.org/browse/ 众多关于审计插件不兼容GA版本MySQL的bug基本不修复了。
同样在多版本mariadb审计插件 测试GA版本MySQL8.0.28时，发现mariadb插件都安装失败。例如下面：

mysql8.0.28 安装 mariadb-10.2.17-linux-glibc_214-x86_64 下的审计插件报错如下:

登录后复制

root@mysqldb 21:13:  [(none)]> install plugin server_audit soname 'server_audit.so';
ERROR 1126 (HY000): Can't open shared library '/usr/local/mysql8/lib/plugin/server_audit.so' (errno: 13 /usr/local/mysql8/lib/plugin/server_audit.so: undefined symbol: fn_format)
1.
2.

mysql8.0.28 安装 mariadb-10.5.15-linux-x86_64 下的审计插件报错如下:

登录后复制

root@mysqldb 23:06:  [(none)]> install plugin server_audit soname 'server_audit.so';
ERROR 1126 (HY000): Can't open shared library '/usr/local/mysql8/lib/plugin/server_audit.so' (errno: 13 /usr/local/mysql8/lib/plugin/server_audit.so: undefined symbol: PSI_server)
root@mysqldb 23:06:  [(none)]> 
1.
2.
3.

看mariadb官方说是部分版本修复bug,部分版本支持mysql8.0 但是还没来得及验证
Make Audit Plugin working with MySQL 8.0.
 https://jira.mariadb.org/browse/MDEV-11904?jql=text ~ "server_audit"