MySQL Enterprise Audit 1483 "status": 0 } } Table access event (read, delete, insert, update): The items in the following list appear at the top level of JSON-format audit records: Each item value is either a scalar or a  JSON  hash. For items that have a hash value, the description lists only the item names within that hash. For more complete descriptions of second-level hash items, see later in this section. The MySQL account associated with the event. The value is a hash containing these items equivalent to the value of the  CURRENT_USER()  function within the section:  user ,  host . Example: "account": { "user": "root", "host": "localhost" } A string representing the event class. The class defines the type of event, when taken together with the event  item that specifies the event subclass. Example: "class": "connection" The following table shows the permitted combinations of  class  and  event  values. Information about a client connection. The value is a hash containing these items:  connection_type , status ,  db , and possibly  connection_attributes . This item occurs only for audit records with a class  value of  connection . Example: "connection_data": { "connection_type": "ssl", "status": 0, "db": "test" } { "timestamp": "2019-10-03 14:23:41", "id": 0, "class": "table_access", "event": "insert", "connection_id": 5, "account": { "user": "root", "host": "localhost" }, "login": { "user": "root", "os": "", "ip": "127.0.0.1", "proxy": "" }, "table_access_data": { "db": "test", "table": "t1", "query": "INSERT INTO t1 (i) VALUES(1),(2),(3)", "sql_command": "insert" } } • account • class • connection_data Table 6.28 Audit Log Class and Event Combinations Class Value Permitted Event Values audit startup ,  shutdown connection connect ,  change_user ,  disconnect general status table_access_data read ,  delete ,  insert ,  update