Skip to main content

SEC.CFG.GENERAL_LOG — Every statement is being written down, verbatim

  • Category: security
  • Severity: high
  • Level: 0
  • Confidence: deterministic
  • Downtime class: none — the finding is about a server setting, not about a statement
  • Stability: stable
  • Suites: audit
  • Applies to: MySQL 8.4

What ends up in the file​

Everything. CREATE USER … IDENTIFIED BY 'secret' goes in with the password. So does an UPDATE that sets a token, and any value interpolated into SQL rather than bound.

The general query log does not redact, because it is a debugging tool: it records what was sent.

MySQL does rewrite passwords before logging — in the error log and the slow query log. Not here. A reader who has heard that MySQL redacts passwords has heard something true about a different log.

Why that is worse than it sounds​

The result is a file that is often world-readable, usually outside whatever protects the database itself, and routinely swept into log shipping. It holds a copy of what the database was guarding.

And the credentials in it stay valid until somebody rotates them — which nobody does, because nobody rotates what they do not know leaked.

Why it is a finding rather than a preference​

It is off by default and meant to be on for minutes, while somebody is looking at something. A server that has it on is almost always one where that was forgotten. The cost is silent and grows with uptime, which is exactly the shape a person does not notice.

What it looks like​

# my.cnf: every statement written down, verbatim and unredacted.
general_log = ON

What to do about it​

# Off is the vendor default, and where a server should be between debugging sessions.
general_log = OFF

SET GLOBAL general_log = OFF takes effect immediately and without downtime. The variable is GLOBAL-only, so no individual session may set it.

What this rule cannot see​

Whether the destination is a file or a table, who can read it, and whether anything ships it elsewhere. Those are questions about the host rather than about the server's catalog, and this finding does not claim them.

The fix material this rule carries​

A finding from this rule carries a payload whose strategy is none: this rule has looked, and there is no safe standard sequence. That is a conclusion rather than an omission — a finding with no payload at all says only that nobody wrote one.

The payload is material for you or an agent to apply. SQLens writes no migration and runs no DDL. See the remediation payload for every field, the placeholder semantics, and the version rules a consumer has to follow.