MySQL Enterprise Audit Minimum Value 0 Maximum Value 4294967295 The audit log plugin implements log file encryption using encryption passwords stored in the MySQL keyring (see Encrypting Audit Log Files). The plugin also implements password history, which includes password archiving and expiration (removal). When the audit log plugin creates a new encryption password, it archives the previous password, if one exists, for later use. The  audit_log_password_history_keep_days  variable controls automatic removal of expired archived passwords. Its value indicates the number of days after which archived audit log encryption passwords are removed. The default of 0 disables password expiration: the password retention period is forever. New audit log encryption passwords are created under these circumstances: •During plugin initialization, if the plugin finds that log file encryption is enabled, it checks whether the keyring contains an audit log encryption password. If not, the plugin automatically generates a random initial encryption password. •When the  audit_log_encryption_password_set()  function is called to set a specific password. In each case, the plugin stores the new password in the key ring and uses it to encrypt new log files. Removal of expired audit log encryption passwords occurs under these circumstances: •During plugin initialization. •When the  audit_log_encryption_password_set()  function is called. •When the runtime value of  audit_log_password_history_keep_days  is changed from its current value to a value greater than 0. Runtime value changes occur for  SET  statements that use the  GLOBAL  or  PERSIST  keyword, but not the  PERSIST_ONLY  keyword.  PERSIST_ONLY  writes the variable setting to  mysqld-auto.cnf , but has no effect on the runtime value. When password removal occurs, the current value of  audit_log_password_history_keep_days determines which passwords to remove: •If the value is 0, the plugin removes no passwords. •If the value is  N  > 0, the plugin removes passwords more than  N  days old. Note Take care not to expire old passwords that are still needed to read archived encrypted log files. If you normally leave password expiration disabled (that is, audit_log_password_history_keep_days  has a value of 0), it is possible to perform an on- demand cleanup operation by temporarily assigning the variable a value greater than zero. For example, to expire passwords older than 365 days, do this: SET GLOBAL audit_log_password_history_keep_days = 365; 1536