MySQL Enterprise Audit candidate file, verifies that the file actually contains  JSON  audit events, and sorts the files using the timestamps from the first event of each file. The result is a sequence of files that are subject to access using the log-reading functions: audit_log_read()  takes an optional  JSON  string argument, and the result returned from a successful call to either function is a  JSON  string. To use the functions to read the audit log, follow these principles: • audit_log_read()  reads events from the audit log or closes the reading process. • audit_log_read_bookmark()  returns a bookmark for the most recently written audit log event. This bookmark is suitable for passing to  audit_log_read()  to indicate where to begin reading. •Call  audit_log_read()  to read events beginning from a given position or the current position, or to close reading: •To initialize an audit log read sequence, pass an argument that indicates the position at which to begin. One way to do so is to pass the bookmark returned by  audit_log_read_bookmark() : •To continue reading from the current position in the sequence, call  audit_log_read()  with no position specified: •To explicitly close the read sequence, pass a  JSON null  argument: SELECT audit_log_read(audit_log_read_bookmark()); SELECT audit_log_read(); SELECT audit_log_read(’null’); It is unnecessary to close reading explicitly. Reading is closed implicitly when the session ends or a new read sequence is initialized by calling  audit_log_read()  with an argument that indicates the position at which to begin. Each non- null  array element is an event represented as a  JSON  hash. For example: •A successful call to  audit_log_read()  to read events returns a  JSON  string containing an array of audit events: •If the final value of the returned array is not a  JSON null  value, there are more events following those just read and  audit_log_read()  can be called again to read more of them. •If the final value of the returned array is a  JSON null  value, there are no more events left to be read in the current read sequence. [ { "timestamp": "2020-05-18 13:39:33", "id": 0, "class": "connection", "event": "connect", ... }, { "timestamp": "2020-05-18 13:39:33", "id": 1, "class": "general", "event": "status", ... }, { "timestamp": "2020-05-18 13:39:33", "id": 2, "class": "connection", "event": "disconnect", ... 1498