MySQL Enterprise Audit •Properties of Audit Log Filtering •Constraints on Audit Log Filtering Functions •Using Audit Log Filtering Functions •Audited events can be filtered using these characteristics: •User account •Audit event class •Audit event subclass •Value of event fields such as those that indicate operation status or SQL statement executed •Audit filtering is rule based: •A filter definition creates a set of auditing rules. Definitions can be configured to include or exclude events for logging based on the characteristics just described. •Filter rules have the capability of blocking (aborting) execution of qualifying events, in addition to existing capabilities for event logging. •Multiple filters can be defined, and any given filter can be assigned to any number of user accounts. •It is possible to define a default filter to use with any user account that has no explicitly assigned filter. •Audit filters can be defined, displayed, and modified using an SQL function-based interface. •Audit filter definitions are stored in the tables in the  mysql  system database. •Within a given session, the value of the read-only  audit_log_filter_id  system variable indicates whether a filter has been assigned to the session. By default, rule-based audit log filtering logs no auditable events for any users. To log all auditable events for all users, use the following statements, which create a simple filter to enable logging and assign it to the default account: The filter assigned to  %  is used for connections from any account that has no explicitly assigned filter (which initially is true for all accounts). As previously mentioned, the SQL interface for audit filtering control is function based. The following list briefly summarizes these functions: SELECT audit_log_filter_set_filter(’log_all’, ’{ "filter": { "log": true } }’); SELECT audit_log_filter_set_user(’%’, ’log_all’); Note 1502 For information about writing filtering rules, see Section 6.4.5.8, “Writing Audit Log Filter Definitions” . The audit log plugin has the capability of controlling logging of audited events by filtering them: Legacy mode is filtering behavior as it was prior to MySQL 5.7.13; that is, before the introduction of rule-based filtering. Properties of Audit Log Filtering