MySQL Enterprise Audit The audit log file is written as XML, using UTF-8 (up to 4 bytes per character). The root element is <AUDIT> . The root element contains  <AUDIT_RECORD>  elements, each of which provides information about an audited event. When the audit log plugin begins writing a new log file, it writes the XML declaration and opening  <AUDIT>  root element tag. When the plugin closes a log file, it writes the closing </AUDIT>  root element tag. The closing tag is not present while the file is open. Attributes of  <AUDIT_RECORD>  elements have these characteristics: The following attributes are mandatory in every  <AUDIT_RECORD>  element: A string representing the type of instruction that generated the audit event, such as a command that the server received from a client. Example:  NAME="Query" Some common  NAME  values: The possible values are  Audit ,  Binlog Dump ,  Change user ,  Close stmt ,  Connect Out , Connect ,  Create DB ,  Daemon ,  Debug ,  Delayed insert ,  Drop DB ,  Execute ,  Fetch ,  Field List ,  Init DB ,  Kill ,  Long Data ,  NoAudit ,  Ping ,  Prepare ,  Processlist ,  Query ,  Quit , Refresh ,  Register Slave ,  Reset stmt ,  Set option ,  Shutdown ,  Sleep ,  Statistics ,  Table Dump ,  TableDelete ,  TableInsert ,  TableRead ,  TableUpdate ,  Time . 1477 Audit When auditing starts, which may be server startup time Connect When a client connects, also known as logging in Query An SQL statement (executed directly) Prepare Preparation of an SQL statement; usually followed by Execute Execute Execution of an SQL statement; usually follows Prepare Shutdown Server shutdown Quit When a client disconnects NoAudit Auditing has been turned off USER="root" OS_LOGIN="" HOST="localhost" IP="127.0.0.1" COMMAND_CLASS="connect" CONNECTION_TYPE="SSL/TLS"/> <AUDIT_RECORD TIMESTAMP="2019-10-03T14:25:32 UTC" RECORD_ID="12_2019-10-03T14:25:00" NAME="NoAudit" SERVER_ID="1"/> </AUDIT> •Some attributes appear in every  <AUDIT_RECORD>  element. Others are optional and may appear depending on the audit record type. •Order of attributes within an  <AUDIT_RECORD>  element is not guaranteed. •Attribute values are not fixed length. Long values may be truncated as indicated in the attribute descriptions given later. •The  < ,  > ,  " , and  &  characters are encoded as  &lt; ,  &gt; ,  &quot; , and  &amp; , respectively. NUL bytes (U+00) are encoded as the  ?  character. •Characters not valid as XML characters are encoded using numeric character references. Valid XML characters are: • NAME #x9 | #xA | #xD | [#x20-#xD7FF] | [#xE000-#xFFFD] | [#x10000-#x10FFFF]