MySQL Enterprise Audit For more information about the content of JSON-format audit events, see JSON Audit Log File Format. To read events under those conditions, it is necessary to first initialize a read sequence by calling audit_log_read()  with an argument that specifies a position. To specify a position to  audit_log_read() , include an argument that indicates where to begin reading. For example, pass a bookmark, which is a  JSON  hash containing  timestamp  and  id elements that uniquely identify a particular event. Here is an example bookmark, obtained by calling the audit_log_read_bookmark()  function: Passing the current bookmark to  audit_log_read()  initializes event reading beginning at the bookmark position: The argument to  audit_log_read()  is optional. If present, it can be a  JSON null  value to close the read sequence, or a  JSON  hash. Within a hash argument to  audit_log_read() , items are optional and control aspects of the read operation such as the position at which to begin reading or how many events to read. The following items are significant (other items are ignored): The  start  item is permitted as of MySQL 8.0.22. • start : The position within the audit log of the first event to read. The position is given as a timestamp and the read starts from the first event that occurs on or after the timestamp value. The  start  item has this format, where  value  is a literal timestamp value: • timestamp ,  id : The position within the audit log of the first event to read. The  timestamp  and  id items together comprise a bookmark that uniquely identify a particular event. If an  audit_log_read() argument includes either item, it must include both to completely specify a position or an error occurs. •An  audit_log_read()  call to read events that does not specify a position produces an error under any of these conditions: •A read sequence has not yet been initialized by passing a position to  audit_log_read() . •There are no more events left to be read in the current read sequence; that is,  audit_log_read() previously returned an array ending with a  JSON null  value. •The most recent read sequence has been closed by passing a  JSON null  value to audit_log_read() . }, null ] mysql>  SELECT audit_log_read_bookmark(); +-------------------------------------------------+ | audit_log_read_bookmark() | +-------------------------------------------------+ | { "timestamp": "2020-05-18 21:03:44", "id": 0 } | +-------------------------------------------------+ mysql>  SELECT audit_log_read(audit_log_read_bookmark()); +-----------------------------------------------------------------------+ | audit_log_read(audit_log_read_bookmark()) | +-----------------------------------------------------------------------+ | [ {"timestamp":"2020-05-18 22:41:24","id":0,"class":"connection", ... | +-----------------------------------------------------------------------+ "start": { "timestamp": " value " } 1499