MySQL Enterprise Audit •Inclusive mode logs only explicitly specified items. •Exclusive mode logs everything but explicitly specified items. To perform inclusive logging, disable logging globally and enable logging for specific classes. This filter logs  connect  and  disconnect  events in the  connection  class, and events in the  general  class: To perform exclusive logging, enable logging globally and disable logging for specific classes. This filter logs everything except events in the  general  class: This filter logs  change_user  events in the  connection  class,  message  events, and  table_access events, by virtue of  not  logging everything else: To enable logging based on specific event field values, specify a  field  item within the  log  item that indicates the field name and its expected value: Testing Event Field Values 1509 { "filter": { "class": { "name": "general", "event": { { "filter": { "log": true, "class": [ { "name": "connection", "event": [ { "name": "connect", "log": false }, { "name": "disconnect", "log": false } ] }, { "name": "general", "log": false } ] } } { "filter": { "log": true, "class": { "name": "general", "log": false } } } { "filter": { "log": false, "class": [ { "name": "connection", "event": [ { "name": "connect", "log": true }, { "name": "disconnect", "log": true } ] }, { "name": "general", "log": true } ] } }