MySQL Enterprise Audit An unsigned integer representing an event ID. For audit records that have the same  timestamp  value, their  id  values distinguish them and form a sequence. Within the audit log,  timestamp / id  pairs are unique. These pairs are bookmarks that identify event locations within the log. Information indicating how a client connected to the server. The value is a hash containing these items: user ,  os ,  ip ,  proxy . Information pertaining to audit log plugin termination. The value is a hash containing these items: server_id  This item occurs only for audit records with  class  and  event  values of  audit  and shutdown , respectively. Information pertaining to audit log plugin initialization. The value is a hash containing these items: server_id ,  os_version ,  mysql_version ,  args . This item occurs only for audit records with  class and  event  values of  audit  and  startup , respectively. Information about an access to a table. The value is a hash containing these items:  db ,  table ,  query , sql_command , This item occurs only for audit records with a  class  value of  table_access . 1485 • timestamp • table_access_data • startup_data • shutdown_data • login • id Example: Example: "id": 2 "login": { "user": "root", "os": "", "ip": "::1", "proxy": "" } "shutdown_data": { "server_id": 1 } "startup_data": { "server_id": 1, "os_version": "i686-Linux", "mysql_version": "5.7.21-log", "args": ["/usr/local/mysql/bin/mysqld", "--loose-audit-log-format=JSON", "--log-error=log.err", "--pid-file=mysqld.pid", "--port=3306" ] } "table_access_data": { "db": "test", "table": "t1", "query": "INSERT INTO t1 (i) VALUES(1),(2),(3)", "sql_command": "insert" } Example: Example: Example: