After some major league Googling all over the planet, I think I found the answer.

• http://dbaspot.com/mysql/70551-how-disable-any-logging-mysql.html
• https://lists.drupal.org/pipermail/support/2014-June/025447.html

From these posts I saw something interesting

• 13679547 Connect @localhost as anonymous on test
• 140612 12:33:07 3 Connect gk_admin at localhost as anonymous on dTEST_db

My conjecture is the following: What follows as anonymous on is the currently connected database

mysql -u root -Dmysql -p -BNe 'SELECT USER(),CURRENT_USER()'

The general log entry must say as anonymous on mysql

mysql -u root -Dtest -p -BNe 'SELECT USER(),CURRENT_USER()'

The general log entry must say as anonymous on test

mysql -u root -p -BNe 'SELECT USER(),CURRENT_USER()'

The general log entry must say as anonymous on

Give it a Try !!!

UPDATE 2014-12-04 14:26 EST

Are you ready for this? I have an old post where someone has the source code with as anonymous on

log_warnings doesn't seem to work for aborted connections in MySQL 5.1

In the code from my 2-year-old post, as anonymous on is hardcoded !!!

Look at the code again

[29 Sep 2008 8:03] Konstantin Osipov
OK, it was fixed differently:
      /*
        Log the command before authentication checks, so that the user can
        check the log for the tried login tried and also to detect
        break-in attempts.
      */
      general_log_print(thd, command,
                        (thd->main_security_ctx.priv_user ==
                         thd->main_security_ctx.user ?
                         (char*) "%s@%s on %s" :
                         (char*) "%s@%s as anonymous on %s"),
                        thd->main_security_ctx.user,
                        thd->main_security_ctx.host_or_ip,
                        db ? db : (char*) "");

So, this is logged in the general log at least.

I was reviewing a patch that added more logging,
but I can't remember the worklog task number.

Please note the part of the code that references the database db ? db : (char*) "");. Either the db variable (the current database) points to a database name or an empty string.

The weird part about answering this question is that this is the second time I had to refer back to a post I myself wrote years ago. The first time was this: Does MySQL still handle indexes in this way?

UPDATE 2014-12-17 16:45 EST

Based on your last comment

But what exactly is your answer? That it doesn't matter what "as anonymous" mean? Otherwise, we've got yet to find out why thd->main_security_ctx.user is falsy.

In your question, you asked What is this "as anonymous on" thing even means? The answer I said was Either the db variable (the current database) points to a database name or an empty string. As for thd->main_security_ctx.user, thd->main_security_ctx.host_or_ip, that would be root@localhost. What comes after as anonymous on is the current DB. This is nothing left to figure out.

You then asked Am I still anonymous, or even "anonymous on"?. The answer would have to yes because you have been authenticated as a user of a DB Connection and your connection becomes an active thread like any other thread.

Any connection

• DB connection from an authenticated user
• system user (internal DB Connection for Replication)
• Event Scheduler (DB Connection for Processing events)

are all equal threads. The general log does not differentiate one DB Connection from another. The code checks all connections the same way regardless of connections being internal or external.

If what my answer has stated still does not answer your question, there is really one thing you can do: Go to the MySQL Forums and post this question to the Developers. Since Konstantin Osipov was the developer who was responding to the Bug List and refers to this source code (bugs.mysql.com/bug.php?id=24761) that uses the expression as anonymous on in the general_log_print function, he would have to know the correct context and reason for using the expression as anonymous on.

UPDATE 2018-08-12 19:46 EDT

In ight of your conjecture, I went Googling around and found sample output from a general log:

131021 17:43:50    43 Connect root@localhost as anonymous on pnet_blog
       43 Init DB pnet_blog
       43 Query SELECT count(id) as total_posts FROM posts WHERE date_published is not null AND date_published <= '20131021144350'
       43 Query SELECT * FROM posts WHERE date_published is not null AND date_published <= '20131021144350' ORDER BY date_published DESC LIMIT 0,10
       44 Connect root@localhost as anonymous on pnet_blog
       44 Query SELECT id, title, impressions FROM tips WHERE date_published IS NOT NULL AND date_published <= '20131021144350' ORDER BY date_published DESC LIMIT 0, 10
       44 Quit
       43 Quit
131021 17:44:28    45 Connect root@localhost as anonymous on pnet_blog
       45 Init DB pnet_blog
       45 Query SELECT * FROM posts WHERE url='how-and-when-to-enable-mysql-logs'
       45 Query UPDATE posts SET impressions=impressions+1 WHERE id='41'
       45 Query SELECT url, post_title FROM posts WHERE date_published IS NOT NULL AND date_published < '20131020150000' ORDER BY date_published DESC LIMIT 0,1
       45 Query SELECT url, post_title FROM posts WHERE date_published IS NOT NULL AND date_published > '20131020150000' ORDER BY date_published ASC LIMIT 0,1
       45 Query SELECT * FROM posts WHERE date_published is not null AND date_published <= '20131021144428' AND date_published >= '20130421144428' ORDER BY impressions DESC LIMIT 0,10
       46 Connect root@localhost as anonymous on pnet_blog
       46 Query SELECT id, title, impressions FROM tips WHERE date_published IS NOT NULL AND date_published <= '20131021144428' ORDER BY date_published DESC LIMIT 0, 10
       46 Quit
       45 Quit

Please look at both timestamp entries from the sample log:

131021 17:43:50    43 Connect root@localhost as anonymous on pnet_blog
131021 17:44:28    45 Connect root@localhost as anonymous on pnet_blog

as well as the original log entry from your question:

141017  8:57:31     4 Connect   root@localhost as anonymous on

At these points in time, the user is not authenticated even though root@localhost appears. The comment for the code does support your conjecture. You now have the answer directly from the source code's author.

Thank you for accepting my posted answer (which lead to you finding the real answer)