MySQL Enterprise Audit A string representing a UTC value in  YYYY-MM-DD T hh:mm:ss  UTC  format indicating the date and time when the audit event was generated. For example, the event corresponding to execution of an SQL statement received from a client has a  <TIMESTAMP>  value occurring after the statement finishes, not when it was received. Example: The following elements are optional in  <AUDIT_RECORD>  elements. Many of them occur only with specific <NAME>  element values. A string that indicates the type of action performed. Example: The values correspond to the  statement/sql/ xxx  command counters. For example,  xxx  is drop_table  and  select  for  DROP TABLE  and  SELECT  statements, respectively. The following statement displays the possible names: As of MySQL 8.0.19, events with a  <COMMAND_CLASS>  value of  connect  may include a <CONNECTION_ATTRIBUTES>  element to display the connection attributes passed by the client at connect time. (For information about these attributes, which are also exposed in Performance Schema tables, see Section 27.12.9, “Performance Schema Connection Attribute Tables” .) The  <CONNECTION_ATTRIBUTES>  element contains one  <ATTRIBUTE>  element per attribute, each of which contains  <NAME>  and  <VALUE>  elements to indicate the attribute name and value, respectively. Example: <CONNECTION_ATTRIBUTES>  <ATTRIBUTE> <NAME>_pid</NAME> <VALUE>42794</VALUE>  </ATTRIBUTE>  <ATTRIBUTE> <NAME>_os</NAME> <VALUE>macos0.14</VALUE>  </ATTRIBUTE>  <ATTRIBUTE> <NAME>_platform</NAME> <VALUE>x86_64</VALUE>  </ATTRIBUTE>  <ATTRIBUTE> <NAME>_client_version</NAME> <VALUE>8.0.19</VALUE>  </ATTRIBUTE>  <ATTRIBUTE> <NAME>_client_name</NAME> <VALUE>libmysql</VALUE> 1472 SELECT REPLACE(EVENT_NAME, ’statement/sql/’, ’’) AS name FROM performance_schema.events_statements_summary_global_by_event_name WHERE EVENT_NAME LIKE ’statement/sql/%’ ORDER BY name; <COMMAND_CLASS>drop_table</COMMAND_CLASS> • <CONNECTION_ATTRIBUTES> • <COMMAND_CLASS> <TIMESTAMP>2019-10-03T14:09:45 UTC</TIMESTAMP>