1

I understand this is extremely strange and just started to happen out of the blue. I noticed while looking at my server disk usage that it was going pretty high. Turns out that /var/lib/mysql/my.cnf is being filled with logs... yes, if I vi my.cnf I get this:

170217  0:56:49 587333144 Query SET NAMES utf8
170217  0:56:46 587333157 Connect       XXX@localhost on XXX
170217  0:56:49 587333151 Init DB       XXX
170217  0:56:47 587333159 Connect       XXX@localhost on XXX
170217  0:56:48 587333160 Connect       XXX@localhost on XXX
                587333161 Connect       XXX@localhost on XXX
170217  0:56:33 587333089 Connect       XXX@localhost on XXX
170217  0:56:49 587333157 Init DB       XXX
                587333160 Init DB       XXX
170217  0:56:34 587333093 Connect       XXX@localhost on XXX
170217  0:56:49 587333091 Init DB       XXX
                587333092 Init DB       XXX
                587333089 Init DB       XXX
                587333151 Query SET NAMES utf8
170217  0:56:35 587333098 Connect       XXX@localhost on XXX
170217  0:56:49 587333093 Init DB       XXX
                587333094 Query SET NAMES utf8
170217  0:56:37 587333103 Connect       XXX@localhost on
170217  0:56:49 587333089 Query SET NAMES utf8
                587333100 Query SET NAMES utf8
170217  0:56:37 587333105 Connect       XXX@localhost on XXX
170217  0:56:49 587333091 Query SET NAMES utf8
                587333103 Init DB       XXX
                587333092 Query SET NAMES utf8
                587333097 Query SET NAMES utf8
                587333107 Init DB       XXX
                587333106 Init DB       XXX
                587333108 Init DB       XXX
                587333113 Init DB       XXX
                587333104 Query SET NAMES utf8
                587333114 Init DB       XXX
                587333112 Init DB       XXX
                587333113 Query SET NAMES utf8

XXX = database name.

Any idea of what I can do to stop this?

Ricardo
  • 11
  • 1
  • Sounds like `mysqld` is being started with one of the `--log-XXX` option pointing to the `my.cnf` file instead of the correct name of the log file. – Barmar Feb 17 '17 at 19:24
  • 1
    Or... this could be evidence of an attempted or successful security breach. There's a convoluted privilege escalation exploit in [CVE-2016-6662](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6662) where the general query log destination is changed to write to the config file, allowing an attacker to inject configuration directives, which of course take effect on next startup if successful. What version of MySQL Server? – Michael - sqlbot Feb 18 '17 at 02:02

0 Answers0