MySQL Enterprise Audit •Characters not valid as XML characters are encoded using numeric character references. Valid XML characters are: • <NAME> • <RECORD_ID> • <TIMESTAMP> A string representing the type of instruction that generated the audit event, such as a command that the server received from a client. The following elements are mandatory in every  <AUDIT_RECORD>  element: The possible values are  Audit ,  Binlog Dump ,  Change user ,  Close stmt ,  Connect Out , Connect ,  Create DB ,  Daemon ,  Debug ,  Delayed insert ,  Drop DB ,  Execute ,  Fetch ,  Field List ,  Init DB ,  Kill ,  Long Data ,  NoAudit ,  Ping ,  Prepare ,  Processlist ,  Query ,  Quit , Refresh ,  Register Slave ,  Reset stmt ,  Set option ,  Shutdown ,  Sleep ,  Statistics ,  Table Dump ,  TableDelete ,  TableInsert ,  TableRead ,  TableUpdate ,  Time . Many of these values correspond to the  COM_ xxx  command values listed in the  my_command.h header file. For example,  Create DB  and  Change user  correspond to  COM_CREATE_DB  and COM_CHANGE_USER , respectively. Events having  <NAME>  values of  Table XXX  accompany  Query  events. For example, the following statement generates one  Query  event, two  TableRead  events, and a  TableInsert  events: Each  Table XXX  event contains  <DB>  and  <TABLE>  elements to identify the table to which the event refers. A unique identifier for the audit record. The value is composed from a sequence number and timestamp, in the format  SEQ_TIMESTAMP . When the audit log plugin opens the audit log file, it initializes the sequence number to the size of the audit log file, then increments the sequence by 1 for each record logged. The timestamp is a UTC value in  YYYY-MM-DD T hh:mm:ss  format indicating the date and time when the audit log plugin opened the file. 1471 #x9 | #xA | #xD | [#x20-#xD7FF] | [#xE000-#xFFFD] | [#x10000-#x10FFFF] <NAME>Query</NAME> INSERT INTO t3 SELECT t1.* FROM t1 JOIN t2; <RECORD_ID>12_2019-10-03T14:06:33</RECORD_ID> Audit When auditing starts, which may be server startup time Connect When a client connects, also known as logging in Query An SQL statement (executed directly) Prepare Preparation of an SQL statement; usually followed by Execute Execute Execution of an SQL statement; usually follows Prepare Shutdown Server shutdown Quit When a client disconnects NoAudit Auditing has been turned off Some common  <NAME>  values: Example: Example: