"class": "table_access", "command": ["DROP", "ALTER", "TRUNCATE"], "log": true
"class": "connection", "event": "connect", "status": 1, "log": true , percona audit plugin
(if using syslog or custom paths):
SET GLOBAL audit_log_logging_events = 'connect,query,table_access'; : "log": true "class": "connection"
-- Apply simple filter: log only failed logins + DROP/ALTER SET GLOBAL audit_log_filter = ' "filter": "class": "general", "event": "status", "log": false , "rule": [ "audit_record": "timestamp": "2025-02-18T10:23:45.123 UTC"
SET GLOBAL audit_log_filter = ' ... json ... '; "audit_record": "timestamp": "2025-02-18T10:23:45.123 UTC", "id": 202502, "class": "general", "event": "status", "connection_id": 54321, "user": "webapp@10.0.1.55", "host": "10.0.1.55", "database": "ecommerce", "command": "Query", "sqltext": "UPDATE orders SET status='shipped' WHERE order_id=12345", "status": 0, "rows_examined": 1, "rows_sent": 0
[mysqld] audit_log_rotate_on_size = 104857600 audit_log_rotations = 9 Old files: audit.log.1 , audit.log.2 , ...
"class": "table_access", "command": ["DROP", "ALTER", "TRUNCATE"], "log": true
"class": "connection", "event": "connect", "status": 1, "log": true ,
(if using syslog or custom paths):
SET GLOBAL audit_log_logging_events = 'connect,query,table_access'; :
-- Apply simple filter: log only failed logins + DROP/ALTER SET GLOBAL audit_log_filter = ' "filter": "class": "general", "event": "status", "log": false , "rule": [
SET GLOBAL audit_log_filter = ' ... json ... '; "audit_record": "timestamp": "2025-02-18T10:23:45.123 UTC", "id": 202502, "class": "general", "event": "status", "connection_id": 54321, "user": "webapp@10.0.1.55", "host": "10.0.1.55", "database": "ecommerce", "command": "Query", "sqltext": "UPDATE orders SET status='shipped' WHERE order_id=12345", "status": 0, "rows_examined": 1, "rows_sent": 0
[mysqld] audit_log_rotate_on_size = 104857600 audit_log_rotations = 9 Old files: audit.log.1 , audit.log.2 , ...
