MySQL Enterprise Audit Many of these values correspond to the  COM_ xxx  command values listed in the  my_command.h header file. For example,  "Create DB"  and  "Change user"  correspond to  COM_CREATE_DB  and COM_CHANGE_USER , respectively. Events having  NAME  values of  Table XXX  accompany  Query  events. For example, the following statement generates one  Query  event, two  TableRead  events, and a  TableInsert  events: INSERT INTO t3 SELECT t1.* FROM t1 JOIN t2; Each  Table XXX  event has  DB  and  TABLE  attributes to identify the table to which the event refers. Connect  events for old-style XML audit log format do not include connection attributes. A unique identifier for the audit record. The value is composed from a sequence number and timestamp, in the format  SEQ_TIMESTAMP . When the audit log plugin opens the audit log file, it initializes the sequence number to the size of the audit log file, then increments the sequence by 1 for each record logged. The timestamp is a UTC value in  YYYY-MM-DD T hh:mm:ss  format indicating the date and time when the audit log plugin opened the file. Example:  RECORD_ID="12_2019-10-03T14:25:00" A string representing a UTC value in  YYYY-MM-DD T hh:mm:ss  UTC  format indicating the date and time when the audit event was generated. For example, the event corresponding to execution of an SQL statement received from a client has a  TIMESTAMP  value occurring after the statement finishes, not when it was received. Example:  TIMESTAMP="2019-10-03T14:25:32 UTC" The following attributes are optional in  <AUDIT_RECORD>  elements. Many of them occur only for elements with specific values of the  NAME  attribute. A string that indicates the type of action performed. Example:  COMMAND_CLASS="drop_table" The values correspond to the  statement/sql/ xxx  command counters. For example,  xxx  is drop_table  and  select  for  DROP TABLE  and  SELECT  statements, respectively. The following statement displays the possible names: SELECT REPLACE(EVENT_NAME, ’statement/sql/’, ’’) AS name FROM performance_schema.events_statements_summary_global_by_event_name WHERE EVENT_NAME LIKE ’statement/sql/%’ ORDER BY name; An unsigned integer representing the client connection identifier. This is the same as the value returned by the  CONNECTION_ID()  function within the session. Example:  CONNECTION_ID="127" • RECORD_ID • TIMESTAMP • COMMAND_CLASS • CONNECTION_ID • CONNECTION_TYPE 1478