MySQL Enterprise Audit from disabled to enabled. Log file renaming must be done externally to the server. Suppose that the log file name is  audit.log  and you want to maintain the three most recent log files, cycling through the names audit.log.1  through  audit.log.3 . On Unix, perform rotation manually like this: 1. From the command line, rename the current log files: 2. At this point, the plugin is still writing to the current log file, which has been renamed to  audit.log.1 . Connect to the server and flush the log file so the plugin closes it and reopens a new  audit.log  file: •During plugin initialization, if a file with the audit log file name already exists (see Naming Conventions for Audit Log Files). •During plugin termination. •When the  audit_log_encryption_password_set()  function is called to set the encryption password, if encryption is enabled. (Rotation does not occur if encryption is disabled.) The plugin renames the original file by inserting a timestamp just after its base name. For example, if the file name is  audit.log , the plugin renames it to a value such as  audit.20210115T140633.log . The timestamp is a UTC value in  YYYYMMDD T hhmmss  format. For XML logging, the timestamp indicates rotation time. For JSON logging, the timestamp is that of the last event written to the file. 1495 Automatic size-based rotation also occurs under these conditions: If  audit_log_rotate_on_size  is greater than 0, setting  audit_log_flush  has no effect. Instead, whenever a write to the current log file causes its size to exceed the  audit_log_rotate_on_size value, the audit log plugin automatically renames the current log file and opens a new current log file using the original name. Automatic Audit Log File Rotation Note Note For JSON-format logging, renaming audit log files manually makes them unavailable to the log-reading functions because the audit log plugin can no longer determine that they are part of the log file sequence (see Section 6.4.5.6, “Reading Audit Log Files” ). Consider setting  audit_log_rotate_on_size  greater than 0 to use size-based rotation instead. If compression or encryption are enabled, log file names include suffixes that signify the enabled features, as well as a password ID if encryption is enabled. If file names include a password ID, be sure to retain the ID in the name of any files you rename manually so that the password to use for decryption operations can be determined. audit_log_flush  is special in that its value remains  OFF  so that you need not disable it explicitly before enabling it again to perform another flush. This strategy overwrites the current  audit.log.3  contents, placing a bound on the number of archived log files and the space they use. mv audit.log.2 audit.log.3 mv audit.log.1 audit.log.2 mv audit.log audit.log.1 SET GLOBAL audit_log_flush = ON;