The Error Log Suppose that a rule set with error numbers looks like this: IF err_code == 10927 OR err_code == 10914 THEN drop. IF err_code == 1131 THEN drop. Using  perror , determine the error symbols: Substituting error symbols for numbers, the rule set becomes: Symbolic names can be specified as quoted strings for comparison with string fields, but in such cases the names are strings that have no special meaning and  log_filter_dragnet  does not resolve them to the corresponding numeric value. Also, typos may go undetected, whereas an error occurs immediately on SET  for attempts to use an unquoted symbol unknown to the server. This rule throttles plugin-shutdown messages to 5 occurrences per 60 seconds: IF err_code == ER_PLUGIN_SHUTTING_DOWN_PLUGIN THEN throttle 5. This rule throttles errors and warnings to 1000 occurrences per hour and information messages to 100 occurrences per hour: IF prio <= INFORMATION THEN throttle 1000/3600 ELSE throttle 100/3600. In the special case that the condition refers to exactly one field name, the field name following  unset  is optional and  unset  discards the named field. These rules are equivalent: IF myfield == 2 THEN unset myfield. IF myfield == 2 THEN unset. shell>  perror 10927 10914 1131 MySQL error code MY-010927 (ER_ACCESS_DENIED_FOR_USER_ACCOUNT_LOCKED): Access denied for user ’%-.48s’@’%-.64s’. Account is locked. MySQL error code MY-010914 (ER_ABORTING_USER_CONNECTION): Aborted connection %u to db: ’%-.192s’ user: ’%-.48s’ host: ’%-.64s’ (%-.64s). MySQL error code MY-001131 (ER_PASSWORD_ANONYMOUS_USER): You are using MySQL as an anonymous user and anonymous users are not allowed to change passwords IF err_code == ER_ACCESS_DENIED_FOR_USER_ACCOUNT_LOCKED OR err_code == ER_ABORTING_USER_CONNECTION THEN drop. IF err_code == ER_PASSWORD_ANONYMOUS_USER THEN drop. log_filter_dragnet  supports these actions in filter rules: Actions for log_filter_dragnet Rules • drop : Drop the current log event (do not log it). • throttle : Apply rate limiting to reduce log verbosity for events matching particular conditions. The argument indicates a rate, in the form  count  or  count / window_size . The  count  value indicates the permitted number of event occurrences to log per time window. The  window_size  value is the time window in seconds; if omitted, the default window is 60 seconds. Both values must be integer literals. • set : Assign a value to a field (and cause the field to exist if it did not already). In subsequent rules, EXISTS  tests against the field name are true, and the new value can be tested by comparison conditions. • unset : Discard a field. In subsequent rules,  EXISTS  tests against the field name are false, and comparisons of the field against any value are false. 1038