Question: We saw some unexpected queries from some database users we would like to identify,
for example, preprod user is doing queries on our production databases but we do not know from where (we checked the codebase without any success). Before deleting the account, i would like to know what it is doing.

I took a look at mariadb general log (file format) but it looks like it does not log the mariadb username. Do you have a method to help us identify this ?

Thanks !

Answer: 
> 
> ... preprod user is doing queries on our production databases ...
> 
> 
> 

If your Security Policies say that preprod users are not *allowed* to run queries against production databases (which is a very Good Idea, BTW) then lock the account down immediately. No warning, no "Communications"; just do it.

* If it's a *program* that's [mis]using the account, that program will break and someone will complain.
* If it's a user that's [mis]using the account, then *they* will complain.

Either way, you'll find out who/what was the source of the queries.
The general log *does* show the user running the queries, it's just that it's not shown on every line. Simply find the `Id` column of the line with the query in question, then look at lines before that to find the first line with that `Id` value which should have a `Command` equal to "Connect". The database user is then shown in the `Argument` column.

Alternatively, you can log to a table instead of a file. In that case, the user is shown for every row (column `user_host`).