Audit Log Creates Unparsable Date String

Bug #1642376 reported by Matthew B
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Percona Server moved to https://jira.percona.com/projects/PS
Status tracked in 5.7
5.5
Triaged
Medium
Unassigned
5.6
Triaged
Medium
Unassigned
5.7
Triaged
Medium
Unassigned

Bug Description

The audit log currently produces time stamps like this: 2016-11-15T12:12:34 UTC

This is not a recognized standard for ISO8601. (https://en.wikipedia.org/wiki/ISO_8601#UTC)

-- QUOTE
If the time is in UTC, add a Z directly after the time without a space. Z is the zone designator for the zero UTC offset. "09:30 UTC" is therefore represented as "09:30Z" or "0930Z". "14:45:15 UTC" would be "14:45:15Z" or "144515Z".
-- END

Please consider the following patch to correct this:

diff --git a/audit_log.c b/audit_log.c
index 39078fa..4c3224d 100644
--- a/audit_log.c
+++ b/audit_log.c
@@ -134,7 +134,7 @@ char *make_timestamp(char *buf, size_t buf_len, time_t t)
   struct tm tm;

   memset(&tm, 0, sizeof(tm));
- strftime(buf, buf_len, "%FT%T UTC", gmtime_r(&t, &tm));
+ strftime(buf, buf_len, "%FT%TZ", gmtime_r(&t, &tm));

   return buf;
 }

Tags: audit
tags: added: audit
Revision history for this message
Sveta Smirnova (svetasmirnova) wrote :

Since simply changing timestamp format may break existent applications I believe this should be implemented as an option.

If we believe going standard is right way to fix Audit plugin such change should be done only in the next major version.

Changed in percona-server:
status: New → Confirmed
Revision history for this message
Matthew B (utdrmac) wrote :

The system that parses these logs, Logstash / Elasticsearch, complains that the timestamp provided in the JSON string does not conform to any established RFCs and therefor drops the audit record completely.

Revision history for this message
Shahriyar Rzayev (rzayev-sehriyar) wrote :

Percona now uses JIRA for bug reports so this bug report is migrated to: https://jira.percona.com/browse/PS-1763

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.