MySQL Enterprise Audit "filter": { "class": { "name": "general", "event" : { "name": "status", "filter": { "ref": "main" } } }, "activate": { "or": [ { "field": { "name": "table_name.str", "value": "temp_1" } }, { "field": { "name": "table_name.str", "value": "temp_2" } } ] } } } } } } A new filter is activated when the  activate  element within a subfilter evaluates to  true . Using activate  in a top-level  filter  is not permitted. A new filter can be replaced with the original one by using a  ref  item inside the subfilter to refer to the original filter  id . The filter shown operates like this: •The  main  filter waits for  table_access  events, either  update  or  delete . •If the  update  or  delete table_access  event occurs on the  temp_1  or  temp_2  table, the filter is replaced with the internal one (without an  id , since there is no need to refer to it explicitly). •If the end of the command is signalled ( general  /  status  event), an entry is written to the audit log file and the filter is replaced with the  main  filter. The filter is useful to log statements that update or delete anything from the  temp_1  or  temp_2  tables, such as this one: UPDATE temp_1, temp_3 SET temp_1.a=21, temp_3.a=23; Note The statement generates multiple  table_access  events, but the audit log file contains only  general  / status  entries. Any  id  values used in the definition are evaluated with respect only to that definition. They have nothing to do with the value of the  audit_log_filter_id system variable. 6.4.5.9 Legacy Mode Audit Log Filtering Note This section describes legacy audit log filtering, which applies if the  audit_log plugin is installed but not the accompanying audit tables and functions needed for rule-based filtering. The audit log plugin can filter audited events. This enables you to control whether audited events are written to the audit log file based on the account from which events originate or event status. Status filtering occurs separately for connection events and statement events. 1518