diff -purN --exclude=Makefile.in mysql-4.0.22/libmysql/Makefile.shared mysql-4.0.22-patched/libmysql/Makefile.shared
--- mysql-4.0.22/libmysql/Makefile.shared	2004-10-27 17:48:37.000000000 -0700
+++ mysql-4.0.22-patched/libmysql/Makefile.shared	2005-01-18 21:49:32.000000000 -0800
@@ -35,7 +35,7 @@ CHARSET_OBJS=@CHARSET_OBJS@
 LTCHARSET_OBJS= ${CHARSET_OBJS:.o=.lo}
 
 target_sources = 	libmysql.c password.c manager.c \
-			get_password.c errmsg.c
+			get_password.c errmsg.c audit.c
 
 mystringsobjects =	strmov.lo strxmov.lo strxnmov.lo strnmov.lo \
 			strmake.lo strend.lo \
diff -purN --exclude=Makefile.in mysql-4.0.22/libmysql/audit.c mysql-4.0.22-patched/libmysql/audit.c
--- mysql-4.0.22/libmysql/audit.c	1969-12-31 16:00:00.000000000 -0800
+++ mysql-4.0.22-patched/libmysql/audit.c	2008-01-29 17:16:14.000000000 -0800
@@ -0,0 +1,65 @@
+#include "audit.h"
+#include <stdio.h>
+#include <stdint.h>
+#include <unistd.h>
+#include <sys/time.h>
+
+#define AUDIT_FILENAME "/tmp/mysql.audit"
+#define SMART_UID 13776
+
+typedef enum { AUDIT_TYPE_OPEN, AUDIT_TYPE_CLOSE, AUDIT_TYPE_COMMAND } AuditType;
+
+typedef struct {
+  struct timeval timestamp;
+  AuditType type; 
+  ulong len;
+} AuditHeader;
+
+typedef struct {
+  AuditHeader header;
+  uchar command;
+} AuditCommandHeader;
+
+static FILE* audit_file = NULL;
+
+void mysql_audit_init() {
+  //fprintf(stderr, "mysql_audit_init()\n");
+  audit_file = fopen(AUDIT_FILENAME, "a");
+  if(audit_file) {
+    AuditHeader record;
+    gettimeofday(&record.timestamp, NULL);
+    record.type = AUDIT_TYPE_OPEN;
+    record.len = 0;
+    fwrite(&record, sizeof(AuditHeader), 1, audit_file);
+    fflush(audit_file);
+  }
+}
+
+void mysql_audit_cleanup() {
+  //fprintf(stderr, "mysql_audit_cleanup()\n");
+  if(audit_file) {
+    AuditHeader record;
+    gettimeofday(&record.timestamp, NULL);
+    record.type = AUDIT_TYPE_CLOSE;
+    record.len = 0;
+    fwrite(&record, sizeof(AuditHeader), 1, audit_file);
+    fclose(audit_file);
+    audit_file = NULL;
+  }
+}
+
+void mysql_audit_command(uchar command,const char *packet, ulong len) {
+  //fprintf(stderr, "mysql_audit_command(%hhu, %lu, %s)\n", command, len, packet);
+
+  if (audit_file && geteuid() == SMART_UID ) {
+    AuditCommandHeader* record = (AuditCommandHeader*)malloc(len + sizeof(AuditCommandHeader));
+    gettimeofday(&record->header.timestamp, NULL);
+    record->header.type = AUDIT_TYPE_COMMAND;
+    record->header.len = len + sizeof(uchar);    
+    record->command = command;
+    memcpy(&(record->command) + 1, packet, len);
+    fwrite(record, sizeof(AuditHeader) + len + 1, 1, audit_file);
+    fflush(audit_file);
+    free(record);
+  }
+}
diff -purN --exclude=Makefile.in mysql-4.0.22/libmysql/audit.h mysql-4.0.22-patched/libmysql/audit.h
--- mysql-4.0.22/libmysql/audit.h	1969-12-31 16:00:00.000000000 -0800
+++ mysql-4.0.22-patched/libmysql/audit.h	2005-01-18 21:44:15.000000000 -0800
@@ -0,0 +1,11 @@
+#ifndef __AUDIT_H__
+#define __AUDIT_H__
+
+#include <my_global.h>
+
+void mysql_audit_init();
+void mysql_audit_cleanup();
+void mysql_audit_command(uchar command,const char *packet, ulong len);
+
+
+#endif
--- mysql-4.0.22/sql/net_serv.cc	2004-10-27 17:48:41.000000000 -0700
+++ mysql-4.0.22-patched/sql/net_serv.cc	2005-01-18 21:47:39.000000000 -0800
@@ -40,6 +40,7 @@
 #include <violite.h>
 #include <signal.h>
 #include <errno.h>
+#include "audit.h"
 
 /*
   The following handles the differences when this is linked between the
@@ -88,6 +89,7 @@ static my_bool net_write_buff(NET *net,c
 int my_net_init(NET *net, Vio* vio)
 {
   DBUG_ENTER("my_net_init");
+  mysql_audit_init();
   my_net_local_init(net);			/* Set some limits */
   if (!(net->buff=(uchar*) my_malloc((uint32) net->max_packet+
 				     NET_HEADER_SIZE + COMP_HEADER_SIZE,
@@ -124,6 +126,7 @@ int my_net_init(NET *net, Vio* vio)
 void net_end(NET *net)
 {
   DBUG_ENTER("net_end");
+  mysql_audit_cleanup();
   my_free((gptr) net->buff,MYF(MY_ALLOW_ZERO_PTR));
   net->buff=0;
   DBUG_VOID_RETURN;
@@ -269,7 +272,9 @@ net_write_command(NET *net,uchar command
   uint header_size=NET_HEADER_SIZE+1;
   DBUG_ENTER("net_write_command");
   DBUG_PRINT("enter",("length: %lu", len));
-
+  
+  mysql_audit_command(command, packet, len);
+  
   buff[4]=command;				/* For first packet */
 
   if (length >= MAX_PACKET_LENGTH)