MySQL5.5 安装mcafee mysql-audit插件 不成功

主页：https://github.com/mcafee/mysql-audit/wiki

各版本安装包：https://bintray.com/mcafee/mysql-audit-plugin/release

安装步骤还是比较简单的，只有几步：

1）查看插件目录

mysql> SHOW GLOBAL VARIABLES LIKE 'plugin_dir';

+---------------+--------------------+
| Variable_name | Value              |
+---------------+--------------------+
| plugin_dir    | /mysql/lib/plugin/ |
+---------------+--------------------+
1 row in set (0.00 sec)

2）复制下载的so文件至plugin_dir

3）安装插件，不报错即为成功

mysql> INSTALL PLUGIN AUDIT SONAME 'libaudit_plugin.so';

4）可以查看安装的版本

mysql> SHOW GLOBAL STATUS LIKE 'AUDIT_version';

5）开启审计

mysql> SET GLOBAL audit_json_file=ON;

问题是，在第三步安装插件时总是不成功，报错

mysql> INSTALL PLUGIN AUDIT SONAME 'libaudit_plugin.so';
ERROR 1123 (HY000): Can't initialize function 'AUDIT'; Plugin initialization function failed.

查看错误日志，注意到offsets_by_version: 1，即为打开Offsets检验，但提示Offsets检验失败

140917 18:04:02 [Note] Audit Plugin: setup_offsets audit_offsets: (null) validate_checksum: 1 offsets_by_version: 1
140917 18:04:03 [Note] Audit Plugin: mysqld: /mysql/bin/mysqld (325edbcbbfaabdddd7b22e3036c2d774) 
140917 18:04:03 [ERROR] Audit Plugin: Offsets: 5.5.21 (4a03ad064ed393dabdde175f3ea05ff2) match thread validation check fails with value: 0. Skipping offest.
140917 18:04:03 [ERROR] Audit Plugin: Offsets: 5.5.21 (4a03ad064ed393dabdde175f3ea05ff2) match thread validation check fails with value: 0. Skipping offest.
140917 18:04:03 [ERROR] Audit Plugin: Offsets: 5.5.21-55 (e4f1b39e9dca4edc51b8eb6aa09e2fa4) match thread validation check fails with value: 0. Skipping offest.
140917 18:04:03 [ERROR] Audit Plugin: Offsets: 5.5.21-55 (e4f1b39e9dca4edc51b8eb6aa09e2fa4) match thread validation check fails with value: 0. Skipping offest.
140917 18:04:03 [ERROR] Audit Plugin: Offsets: 5.5.21 (66d23cb577e2bcfe29da08833f5e7d8b) match thread validation check fails with value: 0. Skipping offest.
140917 18:04:03 [ERROR] Audit Plugin: Offsets: 5.5.21 (66d23cb577e2bcfe29da08833f5e7d8b) match thread validation check fails with value: 0. Skipping offest.
140917 18:04:03 [ERROR] Audit Plugin: Offsets: 5.5.21-rel25.0 (346a87d97dbf5d7aad3a9f7f707f9477) match thread validation check fails with value: 0. Skipping offest.
140917 18:04:03 [ERROR] Audit Plugin: Offsets: 5.5.21-rel25.0 (346a87d97dbf5d7aad3a9f7f707f9477) match thread validation check fails with value: 0. Skipping offest.
140917 18:04:03 [Note] Audit Plugin: Couldn't find proper THD offsets for: 5.5.21-log
140917 18:04:03 [ERROR] Plugin 'AUDIT' init function returned error.
140917 18:04:03 [Note] Audit Plugin: deinit

关闭audit_offsets_by_version后再试试，将audit_offsets_by_version=OFF写入/etc/my.cnf，重启数据库，再安装插件，仍然报错

140917 18:11:02 [Note] Audit Plugin: setup_offsets audit_offsets: (null) validate_checksum: 1 offsets_by_version: 0
140917 18:11:02 [Note] Audit Plugin: mysqld: /mysql/bin/mysqld (325edbcbbfaabdddd7b22e3036c2d774)
140917 18:11:02 [Note] Audit Plugin: Couldn't find proper THD offsets for: 5.5.21-log
140917 18:11:02 [ERROR] Plugin 'AUDIT' init function returned error.
140917 18:11:02 [Note] Audit Plugin: deinit
140917 18:11:42 [Note] Start binlog_dump to slave_server(1204), pos(mysql-bin.000011, 107)
140917 18:11:48 [Note] Audit Plugin: Set interface version to: 12933376 (50521)
140917 18:11:48 [Note] Audit Plugin: starting up. Version: 1.0.5 , Revision: 479 (64bit). AUDIT plugin interface version: 50521 (0xc559). MySQL Server versi
on: 5.5.21-log.
140917 18:11:48 [Note] Audit Plugin: setup_offsets audit_offsets: (null) validate_checksum: 1 offsets_by_version: 0
140917 18:11:48 [Note] Audit Plugin: mysqld: /mysql/bin/mysqld (325edbcbbfaabdddd7b22e3036c2d774)
140917 18:11:48 [Note] Audit Plugin: Couldn't find proper THD offsets for: 5.5.21-log
140917 18:11:48 [ERROR] Plugin 'AUDIT' init function returned error.
140917 18:11:48 [Note] Audit Plugin: deinit

都是跟offsets有关，那就按照https://github.com/mcafee/mysql-audit/wiki/Troubleshooting
所写，获取本机上mysql版本对应的offsets后，写入my.cnf试试

下载offset计算脚本 https://raw.github.com/mcafee/mysql-audit/master/offset-extract/offset-extract.sh

由于我的是percona server，另外需要指明mysqld.debug路径来计算，可能还需要mysqld-debug.debug

# ./offset-extract.sh /mysql/bin/mysqld /usr/lib/debug/usr/sbin/mysqld.debug
//offsets for: /mysql/bin/mysqld (5.5.21-log)
{"5.5.21","325edbcbbfaabdddd7b22e3036c2d774", 6584, 6632, 4120, 4632, 104, 2608, 96, 0, 32, 104},

# ./offset-extract.sh /mysql/bin/mysqld /usr/lib/debug/usr/sbin/mysqld-debug.debug
//offsets for: /mysql/bin/mysqld (5.5.21-log)
{"5.5.21","325edbcbbfaabdddd7b22e3036c2d774", 6608, 6656, 4136, 4656, 104, 2608, 96, 0, 32, 104},

加入my.cnf的插件参数：

plugin-load=AUDIT=libaudit_plugin.so
audit_json_file=1
audit_json_socket_name=/mysql/data/audit.sock
audit_json_socket=OFF
audit_json_file=ON audit_json_log_file=/mysql/data/audit.log audit_record_cmds=connect,update,delete audit_validate_checksum=OFF audit_offsets=6608, 6656, 4136, 4656, 104, 2608, 96, 0, 32, 104

mysqld.debug和mysqld-debug.debug的offsets我都加入my.cnf试了下，仍然报错，崩溃！

140917 15:38:26 [Note] Audit Plugin: starting up. Version: 1.0.5 , Revision: 479 (64bit). AUDIT plugin interface version: 50521 (0xc559). MySQL Server versi
on: 5.5.21-log.
140917 15:38:26 [Note] Audit Plugin: setup_offsets audit_offsets: 6608, 6656, 4136, 4656, 104, 2608, 96, 0, 32, 104 validate_checksum: 0 offsets_by_version:
 1
140917 15:38:26 [Note] Audit Plugin: mysqld: /mysql/bin/mysqld (325edbcbbfaabdddd7b22e3036c2d774)
140917 15:38:26 [Note] Audit Plugin: setup_offsets Audit_formatter::thd_offsets values: 6608 6656 4136 4656 104 2608 96 0 32 104
140917 15:38:26 [ERROR] Audit Plugin: Offsets: (null) ((null)) match thread validation check fails with value: 0. Skipping offest.
140917 15:38:26 [ERROR] Audit Plugin: Offsets set didn't pass validation. audit_offsets: 6608, 6656, 4136, 4656, 104, 2608, 96, 0, 32, 104 .
140917 15:38:26 [ERROR] Plugin 'AUDIT' init function returned error.
140917 15:38:26 [Note] Audit Plugin: deinit
140917 15:38:26 [Warning] 'proxies_priv' entry '@ root@zm03' ignored in --skip-name-resolve mode.
140917 15:38:26 [Note] Event Scheduler: Loaded 0 events
140917 15:38:26 [Note] /mysql/bin/mysqld: ready for connections.
Version: '5.5.21-log'  socket: '/mysql/mysqld.sock'  port: 3306  Source distribution
140917 15:38:39 [Note] Audit Plugin: Set interface version to: 12933376 (50521)
140917 15:38:39 [Note] Audit Plugin: starting up. Version: 1.0.5 , Revision: 479 (64bit). AUDIT plugin interface version: 50521 (0xc559). MySQL Server versi
on: 5.5.21-log.
140917 15:38:39 [Note] Audit Plugin: setup_offsets audit_offsets: 6608, 6656, 4136, 4656, 104, 2608, 96, 0, 32, 104 validate_checksum: 0 offsets_by_version:
 1
140917 15:38:39 [Note] Audit Plugin: mysqld: /mysql/bin/mysqld (325edbcbbfaabdddd7b22e3036c2d774)
140917 15:38:39 [Note] Audit Plugin: setup_offsets Audit_formatter::thd_offsets values: 6608 6656 4136 4656 104 2608 96 0 32 104
140917 15:38:39 [ERROR] Audit Plugin: Offsets: (null) ((null)) match thread validation check fails with value: 0. Skipping offest.
140917 15:38:39 [ERROR] Audit Plugin: Offsets set didn't pass validation. audit_offsets: 6608, 6656, 4136, 4656, 104, 2608, 96, 0, 32, 104 .
140917 15:38:39 [ERROR] Plugin 'AUDIT' init function returned error.
140917 15:38:39 [Note] Audit Plugin: deinit

问题出在哪儿呢，该怎么配置呢？这里先记一笔！

转载于:https://www.cnblogs.com/leonora/p/3977806.html