MySQL Enterprise Audit •Event Filtering by Account •Event Filtering by Status • audit_log_include_accounts : The accounts to include in audit logging. If this variable is set, only these accounts are audited. • audit_log_exclude_accounts : The accounts to exclude from audit logging. If this variable is set, all but these accounts are audited. •If you attempt to set  audit_log_exclude_accounts , an error occurs unless audit_log_include_accounts  is  NULL . In this case, you must first clear audit_log_include_accounts  by setting it to  NULL . •If you set  audit_log_include_accounts , the server sets  audit_log_exclude_accounts  to NULL . 1519 mysql>  SHOW VARIABLES LIKE ’audit_log_include_accounts’; +----------------------------+-------+ | Variable_name | Value | +----------------------------+-------+ | audit_log_include_accounts | | +----------------------------+-------+ mysql>  SELECT @@audit_log_include_accounts; +------------------------------+ | @@audit_log_include_accounts | -- This sets audit_log_exclude_accounts to NULL SET GLOBAL audit_log_include_accounts =  value ; -- This fails because audit_log_include_accounts is not NULL SET GLOBAL audit_log_exclude_accounts =  value ; -- To set audit_log_exclude_accounts, first set -- audit_log_include_accounts to NULL SET GLOBAL audit_log_include_accounts = NULL; SET GLOBAL audit_log_exclude_accounts =  value ; To filter audited events based on the originating account, set one of these system variables at server startup or runtime: The value for either variable can be  NULL  or a string containing one or more comma-separated account names, each in  user_name @ host_name  format. By default, both variables are  NULL , in which case, no account filtering is done and auditing occurs for all accounts. Modifications to  audit_log_include_accounts  or  audit_log_exclude_accounts  affect only connections created subsequent to the modification, not existing connections. Example: To enable audit logging only for the  user1  and  user2  local host account accounts, set the audit_log_include_accounts  system variable like this: Only one of  audit_log_include_accounts  or  audit_log_exclude_accounts  can be non- NULL  at a time: SET GLOBAL audit_log_include_accounts = ’user1@localhost,user2@localhost’; Event Filtering by Account If you inspect the value of either variable, be aware that  SHOW VARIABLES  displays  NULL  as an empty string. To avoid this, use  SELECT  instead: