MySQL Enterprise Audit •If a filter is assigned to the user, the audit log uses that filter. •Otherwise, if no user-specific filter assignment exists, but there is a filter assigned to the default account ( % ), the audit log uses the default filter. •Otherwise, the audit log selects no audit events from the session for processing. •To unassign the filter from the user account: •To assign a different filter to the user account: 1504 To remove a filter, do this: For audit log filtering, user name and host name comparisons are case-sensitive. This differs from comparisons for privilege checking, for which host name comparisons are not case-sensitive. Filtering of current sessions for the account remains unaffected. Subsequent connections from the account are filtered using the new filter. For the filter shown here, that means no logging for new connections from  user1@localhost . Filtering of current sessions for the account remains unaffected. Subsequent connections from the account are filtered using the default account filter if there is one, and are not logged otherwise. To disassociate a user account from its current filter, either unassign the filter or assign a different filter: To assign a filter explicitly to a particular user account or accounts, define the filter, then assign it to the relevant accounts: Now the audit log uses this default account filter for connections from any account that has no explicitly defined filter. Suppose that instead you want the default to be to log only connection-related activity (for example, to see connect, change-user, and disconnect events, but not the SQL statements users execute while connected). To achieve this, define a filter (shown here named  log_conn_events ) that enables logging only of events in the  connection  class, and assign that filter to the default account, represented by the  % account name: By default, no accounts have a filter assigned, so no processing of auditable events occurs for any account. If a change-user operation occurs during a session (see mysql_change_user()), filter assignment for the session is updated using the same rules but for the new user. SELECT audit_log_filter_set_filter(’log_nothing’, ’{ "filter": { "log": false } }’); SELECT audit_log_filter_set_user(’user1@localhost’, ’log_nothing’); SELECT audit_log_filter_remove_user(’user1@localhost’); SELECT audit_log_filter_set_filter(’log_all’, ’{ "filter": { "log": true } }’); SELECT audit_log_filter_set_user(’user1@localhost’, ’log_all’); SELECT audit_log_filter_set_user(’user2@localhost’, ’log_all’); SET @f = ’{ "filter": { "class": { "name": "connection" } } }’; SELECT audit_log_filter_set_filter(’log_conn_events’, @f); SELECT audit_log_filter_set_user(’%’, ’log_conn_events’); Now full logging is enabled for  user1@localhost  and  user2@localhost . Connections from other accounts continue to be filtered using the default account filter.