sqlreplay, api: support replay traffic from plugin-based audit logs

[djshow832]

What problem does this PR solve?

Issue Number: close #859

Problem Summary:
Support plugin-based audit logs.

What is changed and how it works:

• Add a parameter --format="audit_log_plugin" for command traffic replay
• Parse commands from audit logs and deduplicate the commands

Check List

Tests

• Unit test
• Integration test
• Manual test (add detailed scripts or steps below)
• No code

Steps:

1. Execute some statements in a new connection:

mysql> create table t(id int);
Query OK, 0 rows affected (0.03 sec)

mysql> insert t value(1);
Query OK, 1 row affected (0.01 sec)

mysql> select * from t where id=1;
+------+
| id   |
+------+
|    1 |
+------+
1 row in set (0.01 sec)

mysql> exit
Bye

2. Replay traffic using tiproxyctl:

bin/tiproxyctl traffic replay --host 127.1 --port 3080 --username="root" --password="" --input="/Users/zhangming/gopath/src/github.com/pingcap/tiproxy/test" --format="audit_log_plugin"

TiProxy logs:

[2025/09/08 21:16:29.674 +08:00] [INFO] [main.replay] [manager/manager.go:138] [start replay]  [job="{\"type\":\"replay\",\"status\":\"running\",\"start_time\":\"2025-09-08T21:16:29+08:00\",\"progress\":\"0%\",\"input\":\"/Users/zhangming/gopath/src/github.com/pingcap/tiproxy/test\",\"username\":\"root\",\"format\":\"audit_log_plugin\",\"speed\":1}"]
[2025/09/08 21:16:29.676 +08:00] [INFO] [main.replay.replay.loader] [store/rotate.go:214] [reading next file]  [file=traffic-1.log]
[2025/09/08 21:16:54.523 +08:00] [INFO] [main.replay.replay] [replay/replay.go:237] [replay reads EOF]  [reader="curFile: traffic-1.log, curLineIdx: 21"]
[2025/09/08 21:16:54.523 +08:00] [INFO] [main.replay.replay] [replay/replay.go:284] [finished decoding commands, draining connections]  [max_pending_cmds=7] [total_wait_time=0s] [alive_conns=1]
[2025/09/08 21:16:54.524 +08:00] [INFO] [main.replay.replay] [replay/replay.go:388] [replay finished]  [start_time=2025-09-08 21:16:29.565328 +0800 CST] [end_time=2025-09-08 21:16:54.52402 +0800 CST] [decoded_cmds=17] [replayed_cmds=15] [filtered_cmds=0]

4. Check TiDB audit log file again, the file size increases.
   Check the job:

bin/tiproxyctl traffic show --host 127.1 --port 3080
[
  {
    "type": "replay",
    "status": "done",
    "start_time": "2025-09-08T21:16:29+08:00",
    "end_time": "2025-09-08T21:16:54+08:00",
    "progress": "0%",
    "input": "/Users/zhangming/gopath/src/github.com/pingcap/tiproxy/test",
    "username": "root",
    "format": "audit_log_plugin",
    "speed": 1
  }
]

Check the replay result:

mysql> use tiproxy_traffic_replay
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A

Database changed
mysql> select * from fail;
+---------------------+----------+------------------------------------------------------------------+------------------------+---------------------------------------------------------+----------------+---------------------+---------------------+-------+
| replay_start_time   | cmd_type | digest                                                           | sample_stmt            | sample_err_msg                                          | sample_conn_id | sample_capture_time | sample_replay_time  | count |
+---------------------+----------+------------------------------------------------------------------+------------------------+---------------------------------------------------------+----------------+---------------------+---------------------+-------+
| 2025-09-08 21:16:30 | Query    | b4f126c134a4830e06b3e040158d2dc52c6e13ac66555bec9a23e8fd52ce7f94 | select $$              | ERROR 1054 (42S22): Unknown column '$$' in 'field list' |     3552575510 | 2025-09-08 21:15:13 | 2025-09-08 21:16:32 |     2 |
| 2025-09-08 21:16:30 | Query    | cc3faba83603ed83733eaad5298484023b72022ab54e438bcc3ee2675d1b2d2a | create table t(id int) | ERROR 1050 (42S01): Table 'test.t' already exists       |     3552575510 | 2025-09-08 21:15:23 | 2025-09-08 21:16:41 |     2 |
+---------------------+----------+------------------------------------------------------------------+------------------------+---------------------------------------------------------+----------------+---------------------+---------------------+-------+
2 rows in set (0.01 sec)

Notable changes

• Has configuration change
• Has HTTP API interfaces change
• Has tiproxyctl change
• Other user behavior changes

Release note

Please refer to Release Notes Language Style Guide to write a quality release note.

None

[codecov-commenter]

Codecov Report

❌ Patch coverage is 75.00000% with 74 lines in your changes missing coverage. Please review.
⚠️ Please upload report for BASE (main@4e26315). Learn more about missing BASE report.

Files with missing lines	Patch %	Lines
pkg/sqlreplay/cmd/native.go	60.86%	31 Missing and 14 partials ⚠️
pkg/sqlreplay/cmd/audit_log_plugin.go	87.67%	13 Missing and 5 partials ⚠️
pkg/sqlreplay/conn/conn.go	20.00%	4 Missing ⚠️
lib/cli/traffic.go	0.00%	2 Missing ⚠️
pkg/sqlreplay/cmd/cmd.go	77.77%	2 Missing ⚠️
pkg/sqlreplay/replay/replay.go	86.66%	2 Missing ⚠️
pkg/sqlreplay/capture/capture.go	50.00%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #860   +/-   ##
=======================================
  Coverage        ?   67.53%           
=======================================
  Files           ?      132           
  Lines           ?    12564           
  Branches        ?        0           
=======================================
  Hits            ?     8485           
  Misses          ?     3485           
  Partials        ?      594           

Flag	Coverage Δ
unit	67.53% <75.00%> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[ti-chi-bot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: xhebox

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [xhebox]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[ti-chi-bot]

[LGTM Timeline notifier]

Timeline:

• 2025-09-09 02:14:13.935326256 +0000 UTC m=+327520.495207743: ☑️ agreed by xhebox.