MySQL Enterprise Firewall Messages written to the error log in  DETECTING  mode or because mysql_firewall_trace  is enabled are written as Notes, which are information messages. To ensure that such messages appear in the error log and are not discarded, make sure that error-logging verbosity is sufficient to include information messages. For example, if you are using priority-based log filtering, as described in Section 5.4.2.5, “Priority-Based Error Log Filtering (log_filter_internal)” , set the log_error_verbosity  system variable to a value of 3. Note Firewall Statement Handling When Multiple Profiles Apply For simplicity, later sections that describe how to set up profiles take the perspective that the firewall matches incoming statements from a client against only a single profile, either a group profile or account profile. But firewall operation can be more complex: The following description covers the general case of how the firewall operates, when potentially multiple profiles apply to incoming statements. As previously mentioned, MySQL associates each client session with a specific user name and host name combination known as the  session account . The firewall matches the session account against registered profiles to determine which profiles apply to handling incoming statements from the session: In other words, the session account can match 0 or more active group profiles, and 0 or 1 active account profiles. This means that 0, 1, or multiple firewall profiles are applicable to a given session, for which the firewall handles each incoming statement as follows: With that description in mind, the next sections revert to the simplicity of the situations when a single group profile or a single account profile apply, and cover how to set up each type of profile. •A group profile can include multiple accounts as members. •An account can be a member of multiple group profiles. •Multiple profiles can match a given client. •The firewall ignores inactive profiles (profiles with a mode of  OFF ). •The session account matches every active group profile that includes a member having the same user and host. There can be more than one such group profile. •The session account matches an active account profile having the same user and host, if there is one. There is at most one such account profile. •If there is no applicable profile, the firewall imposes no restrictions and accepts the statement. •If there are applicable profiles, their modes determine statement handling: •The firewall records the statement in the allowlist of each applicable profile that is in  RECORDING mode. •The firewall writes the statement to the error log for each applicable profile in  DETECTING  mode for which the statement is suspicious (does not match the profile allowlist). •The firewall accepts the statement if at least one applicable profile is in  RECORDING  or  DETECTING mode (those modes accept all statements), or if the statement matches the allowlist of at least one applicable profile in  PROTECTING  mode. Otherwise, the firewall rejects the statement (and writes it to the error log if the  mysql_firewall_trace  system variable is enabled). 1554