From e2e7f96515c519e35f2341141f2b14d1c0e9bba8 Mon Sep 17 00:00:00 2001
From: zhongwencool <zhongwencool@gmail.com>
Date: Tue, 12 Dec 2023 14:29:39 +0800
Subject: [PATCH] fix: incorrect behavior in audit logs during stop and start
 of EMQX

---
 apps/emqx_ctl/src/emqx_ctl.erl                | 52 ++++++++++++-------
 .../src/emqx_machine_terminator.erl           |  2 +-
 2 files changed, 33 insertions(+), 21 deletions(-)

diff --git a/apps/emqx_ctl/src/emqx_ctl.erl b/apps/emqx_ctl/src/emqx_ctl.erl
index 60413fb83..eaaf15574 100644
--- a/apps/emqx_ctl/src/emqx_ctl.erl
+++ b/apps/emqx_ctl/src/emqx_ctl.erl
@@ -336,30 +336,42 @@ audit_log(Level, From, Log) ->
         {error, _} ->
             ignore;
         {ok, {Mod, Fun}} ->
-            try
-                apply(Mod, Fun, [Level, From, normalize_audit_log_args(Log)])
-            catch
-                _:{aborted, {no_exists, emqx_audit}} ->
-                    case Log of
-                        #{cmd := cluster, args := ["leave"]} ->
-                            ok;
-                        _ ->
-                            ?LOG_ERROR(#{
-                                msg => "ctl_command_crashed",
-                                reason => "emqx_audit table not found",
-                                log => normalize_audit_log_args(Log),
-                                from => From
-                            })
-                    end;
-                _:Reason:Stacktrace ->
+            case prune_unnecessary_log(Log) of
+                false -> ok;
+                {ok, Log1} -> apply_audit_command(Log1, Mod, Fun, Level, From)
+            end
+    end.
+
+apply_audit_command(Log, Mod, Fun, Level, From) ->
+    try
+        apply(Mod, Fun, [Level, From, Log])
+    catch
+        _:{aborted, {no_exists, emqx_audit}} ->
+            case Log of
+                #{cmd := cluster, args := [<<"leave">>]} ->
+                    ok;
+                _ ->
                     ?LOG_ERROR(#{
                         msg => "ctl_command_crashed",
-                        stacktrace => Stacktrace,
-                        reason => Reason,
-                        log => normalize_audit_log_args(Log),
+                        reason => "emqx_audit table not found",
+                        log => Log,
                         from => From
                     })
-            end
+            end;
+        _:Reason:Stacktrace ->
+            ?LOG_ERROR(#{
+                msg => "ctl_command_crashed",
+                stacktrace => Stacktrace,
+                reason => Reason,
+                log => Log,
+                from => From
+            })
+    end.
+
+prune_unnecessary_log(Log) ->
+    case normalize_audit_log_args(Log) of
+        #{args := [<<"emqx:is_running()">>]} -> false;
+        Log1 -> {ok, Log1}
     end.
 
 audit_level(ok, _Duration) -> info;
diff --git a/apps/emqx_machine/src/emqx_machine_terminator.erl b/apps/emqx_machine/src/emqx_machine_terminator.erl
index 28603b9f6..67a21c7fd 100644
--- a/apps/emqx_machine/src/emqx_machine_terminator.erl
+++ b/apps/emqx_machine/src/emqx_machine_terminator.erl
@@ -69,7 +69,7 @@ graceful() ->
 graceful_wait() ->
     ?AUDIT(alert, #{
         cmd => emqx,
-        args => ["stop"],
+        args => [<<"stop">>],
         version => emqx_release:version(),
         from => cli,
         duration_ms => element(1, erlang:statistics(wall_clock))