general_log = 1 writes every query to a file, including the passwords in them

MySQL and MariaDB can record every statement they receive. The setting is called the general query log, it is off by default, and turning it on creates a plaintext record of everything the server was asked to do.

What gets written

With general_log = 1 , the server writes each connection, each statement and each disconnection to the configured destination. That destination is set by log_output , which selects a file, a table, or both.

The content is the statement as received. CREATE USER ... IDENTIFIED BY 'password' , ALTER USER ... IDENTIFIED BY , GRANT ... IDENTIFIED BY , and any application query that includes a literal secret appear in the file exactly as sent. Statements that carry session values, one-time tokens or personal data appear as well.

The dynamic variable can be enabled at runtime by an account with the SYSTEM_VARIABLES_ADMIN privilege, and the file location is controlled by general_log_file .…