MySQL Enterprise Audit audit_log_read()  argument includes either item, it must include both to completely specify a position or an error occurs. To specify a starting position to  audit_log_read() , pass a hash argument that includes either a start  item or a bookmark consisting of  timestamp  and  id  items. If a hash argument includes both a start  item and a bookmark, an error occurs. If a hash argument specifies no starting position, reading continues from the current position. If a timestamp value includes no time part, a time part of  00:00:00  is assumed. Return value: If the call succeeds, the return value is a  JSON  string containing an array of audit events, or a  JSON null  value if that was passed as the argument to close the read sequence. If the call fails, the return value is  NULL  and an error occurs. Prior to MySQL 8.0.19, string return values are binary  JSON  strings. For information about converting such values to nonbinary strings, see Section 6.4.5.6, “Reading Audit Log Files” . Notes: Example: mysql>  SELECT audit_log_read(audit_log_read_bookmark()); +-----------------------------------------------------------------------+ | audit_log_read(audit_log_read_bookmark()) | +-----------------------------------------------------------------------+ | [ {"timestamp":"2020-05-18 22:41:24","id":0,"class":"connection", ... | +-----------------------------------------------------------------------+ mysql>  SELECT audit_log_read(’null’); +------------------------+ | audit_log_read(’null’) | +------------------------+ | null | +------------------------+ 1527 • max_array_length : The maximum number of events to read from the log. If this item is omitted, the default is to read to the end of the log or until the read buffer is full, whichever comes first.