Skip to main content

SEC.CFG.GENERAL_LOG — Every statement is being written down, verbatim

  • Category: security
  • Severity: high
  • Level: 0
  • Confidence: deterministic
  • Downtime class: none — the finding is about a server setting, not about a statement
  • Stability: stable
  • Suites: audit
  • Applies to: MySQL 8.4

What ends up in the file​

Everything. CREATE USER … IDENTIFIED BY 'secret' goes in with the password. So does an UPDATE that sets a token, and any value interpolated into SQL rather than bound.

The general query log does not redact, because it is a debugging tool: it records what was sent.

MySQL does rewrite passwords before logging — in the error log and the slow query log. Not here. A reader who has heard that MySQL redacts passwords has heard something true about a different log.

Why that is worse than it sounds​

The result is a file that is often world-readable, usually outside whatever protects the database itself, and routinely swept into log shipping. It holds a copy of what the database was guarding.

And the credentials in it stay valid until somebody rotates them — which nobody does, because nobody rotates what they do not know leaked.

Why it is a finding rather than a preference​

It is off by default and meant to be on for minutes, while somebody is looking at something. A server that has it on is almost always one where that was forgotten. The cost is silent and grows with uptime, which is exactly the shape a person does not notice.

What it looks like​

# my.cnf: every statement written down, verbatim and unredacted.
general_log = ON

What to do about it​

# Off is the vendor default, and where a server should be between debugging sessions.
general_log = OFF

SET GLOBAL general_log = OFF takes effect immediately and without downtime. The variable is GLOBAL-only, so no individual session may set it.

What this rule cannot see​

Whether the destination is a file or a table, who can read it, and whether anything ships it elsewhere. Those are questions about the host rather than about the server's catalog, and this finding does not claim them.