MySQL Enterprise Audit Table 6.29, “Event Class and Subclass Combinations”  describes the permitted subclass values for each event class. Table 6.29 Event Class and Subclass Combinations Event Class Event Subclass Description connection connect Connection initiation (successful or unsuccessful) connection change_user User re-authentication with different user/password during session connection disconnect Connection termination general status General operation information message internal Internally generated message message user Message generated by audit_api_message_emit_udf() table_access read Table read statements, such as SELECT  or  INSERT INTO ... SELECT table_access delete Table delete statements, such as DELETE  or  TRUNCATE TABLE table_access insert Table insert statements, such as INSERT  or  REPLACE table_access update Table update statements, such as UPDATE Event Class Event Subclass Can be Logged Can be Aborted connection connect Yes No connection change_user Yes No connection disconnect Yes No general status Yes No message internal Yes Yes message user Yes Yes table_access read Yes Yes table_access delete Yes Yes table_access insert Yes Yes table_access update Yes Yes Table 6.30 Log and Abort Characteristics Per Event Class and Subclass Combination Table 6.30, “Log and Abort Characteristics Per Event Class and Subclass Combination”  describes for each event subclass whether it can be logged or aborted. A filter can be defined in inclusive or exclusive mode: Inclusive and Exclusive Logging 1508