Mcafee audit plugin not working for MySQL Galera 5.6 version

[subhajit1987]

Getting error:

2017-02-16 23:59:32 4737 [ERROR] Audit Plugin: Offsets: 5.6.30 (84dd43523b638e4b2817ca9b53f204fe) match thread validation check fails with value: 0. Skipping offset.
2017-02-16 23:59:32 4737 [ERROR] Audit Plugin: Offsets: 5.6.30 (84dd43523b638e4b2817ca9b53f204fe) match thread validation check fails with value: 0. Skipping offset.
2017-02-16 23:59:32 4737 [ERROR] Plugin 'AUDIT' init function returned error.
2017-02-16 23:59:32 4737 [ERROR] Plugin 'AUDIT' registration as a AUDIT failed.

[subhajit1987]

I'm using audit-plugin-mysql-5.6-1.1.2-684-linux-x86_64 version and my Linux is: RedHat Linux 7 x86_64
MySql is 5.6.30

[subhajit1987]

Any help will be greatly appreciated.

[aharonrobbins]

Hi. Please see if you can follow the troubleshooting instructions on the Wiki to extract the offsets for your version of Galera.

If you cannot, you will have to follow the instructions for building Galera from source, and then extract the offsets.

Thanks,

Aharon

[subhajit1987]

I am getting the following error:

[root@hostname bin]# ./offset-extract.sh /usr/bin/mysqld
./offset-extract.sh: line 12: /usr/bin/mysqld: No such file or directory
md5sum: /usr/bin/mysqld: No such file or directory
//offsets for: /usr/bin/mysqld ()
{"",""offsets.gdb:7: Error in sourced command file:
No symbol table is loaded. Use the "file" command.,

[aharonrobbins]

Your mysqld is apparently not in /usr/bin - perhaps it is in /usr/sbin?

[subhajit1987]

Similar error:

[root@hostname bin]# ./offset-extract.sh /usr/sbin/mysqld
//offsets for: /usr/sbin/mysqld (5.6.30)
{"5.6.30","92477ed697b1515bd51a408e00e18676"offsets.gdb:7: Error in sourced command file:
No symbol table is loaded. Use the "file" command.,

[aharonrobbins]

This is a different error. You found the correct file, but it does not have symbols.

At this point, your only option is to build the Galera version of MySQL from source code and extract the offsets from the compiled version.

[subhajit1987]

Can you guide me how to do this.
Or I can share you the binary also.

[aharonrobbins]

Sending me the binary won't help.

Please see http://galeracluster.com/documentation-webpages/installmysqlsrc.html which would appear to be instructions on how to build the Galera version from source. I have not tried this myself. You may wish to build from source, extract offsets, and then also run the version that you built to make sure that everything is in sync.

Hope this helps.