Resolving Crash Issues When Installing MariaDB Audit Plugin on MySQL 5.7

Background : When installing the MariaDB audit plugin server_audit.so on a CentOS 7.5 virtual machine running MySQL 5.7.34, the server crashes immediately after plugin installation, prompting questions about version compatibility.

Compatibility Check (Before Source Modification) :

MariaDB10.1.34

MariaDB10.1.34

MariaDB10.1.41

MariaDB10.1.48

server_audit.so

1.4.0

1.4.4

1.4.7

1.4.7

MySQL5.7.39

×

×

×

×

MySQL5.7.34

×

×

×

×

MySQL5.7.33

√

√

√

√

Compatibility Check (After Source Modification) shows all MySQL 5.7 versions becoming compatible (√) with the same plugin versions.

Verification Process :

Install three MySQL 5.7 versions (details omitted).

Download four MariaDB packages from the official site.

Extract the packages and obtain server_audit.so .

Install the plugin into MySQL and verify its availability.

# 安装插件示例
# 获取 MariaDB 安装包
https://mariadb.org/download/
# 上传并解压安装包
[root@10-186-60-13 10.1.11]# tar -zxvf mariadb-10.1.11-linux-glibc_214-x86_64.tar.gz
# 获取 server_audit.so
[root@10-186-60-13 10.1.11]# cd mariadb-10.1.11-linux-glibc_214-x86_64/lib/plugin/
# 复制该插件到 MySQL 的 plugin 目录并修改权限
[root@10-186-60-13 plugin]# cp server_audit.so /data/mysql/base/5.7.33/lib/plugin/
[root@10-186-60-13 plugin]# chmod 755 server_audit.so
# 登录 MySQL 客户端进行插件的安装
[root@10-186-60-13 plugin]# /data/mysql/base/5.7.33/bin/mysql -uroot -p -S /data/mysql/data/3306/mysqld.sock
mysql> install plugin server_audit SONAME 'server_audit.so';

Crash Occurrence : Installing the plugin on MySQL 5.7.39 triggers a crash (signal 11). The error log shows the plugin version 1.4.7 started, then MySQL aborts, providing a stack trace that points to server_audit.so functions.

# 安装审计插件
mysql> install plugin server_audit SONAME 'server_audit.so';
ERROR 2013 (HY000): Lost connection to MySQL server during query
# 检查插件安装情况
mysql> show plugins;
ERROR 2006 (HY000): MySQL server has gone away
# 错误日志片段
Version: '5.7.39-log' socket: '/data/mysql/data/3308/mysqld.sock' port: 3308 MySQL Community Server (GPL)
... stack trace ... /data/mysql/base/5.7.39/lib/plugin/server_audit.so(get_db_mysql57+0x2f)

Solution :

After a crash, restore MySQL service.

Obtain the MariaDB source package.

Compile the MariaDB audit plugin from source.

Replace the original server_audit.so with the newly compiled one and reinstall.

# 删除插件后重启 MySQL
[root@10-186-60-13 plugin]# rm -rf server_audit.so
[root@10-186-60-13 plugin]# systemctl restart mysqld_3308

Source Code Modification : Edit server_audit.c to adjust the offsets that cause incompatibility.

# 打开 server_audit.c 文件
db_off = 536;   // 改为 544
db_len_off = 544; // 改为 552

After editing, compile with CMake and make :

cmake . -DCMAKE_INSTALL_PREFIX=/usr/local/mysql \
    -DMYSQL_DATADIR=/mydata/data \
    -DWITH_INNOBASE_STORAGE_ENGINE=1 \
    ...
make

Compilation Error : Installing the plugin on MariaDB 10.1.41 version 1.4.7 may initially return ERROR 1030 (HY000): Got error 1 from storage engine . Restarting MySQL resolves the issue and the plugin loads successfully.

Summary : The crash is caused by mismatched offset definitions ( #ifdef __x86_64__ block) in the MariaDB audit plugin source. Adjusting db_off and db_len_off , recompiling, and reinstalling the plugin eliminates the crash for MySQL 5.7.33/34/39. For production use, verify compatibility with the specific MySQL version or prefer newer MariaDB (10.2.x, 10.3.x) audit plugins.