Audit Log Filter format - XML (old style)

OLD XML wraps records in <AUDIT> … </AUDIT>. Each event is one <AUDIT_RECORD> (attribute-style XML).

Attribute order varies. Every record includes the required set below; everything else is optional by event type.

<?xml version="1.0" encoding="utf-8"?>
<AUDIT>
  <AUDIT_RECORD
    NAME="Audit"
    RECORD_ID="0_2023-03-29T11:15:52"
    TIMESTAMP="2023-03-29T11:15:52"
    SERVER_ID="1"/>
  <AUDIT_RECORD
    NAME="Command Start"
    RECORD_ID="1_2023-03-29T11:15:53"
    TIMESTAMP="2023-03-29T11:15:53"
    STATUS="0"
    CONNECTION_ID="1"
    COMMAND_CLASS="query"/>
  <AUDIT_RECORD
    NAME="Query"
    RECORD_ID="2_2023-03-29T11:15:53"
    TIMESTAMP="2023-03-29T11:15:53"
    COMMAND_CLASS="create_table"
    CONNECTION_ID="11"
    HOST="localhost"
    IP=""
    USER="root[root] @ localhost []"
    OS_LOGIN=""
    SQLTEXT="CREATE TABLE t1 (c1 INT)"
    STATUS="0"/>
  <AUDIT_RECORD
    NAME="Query Start"
    RECORD_ID="3_2023-03-29T11:15:53"
    TIMESTAMP="2023-03-29T11:15:53"
    STATUS="0"
    CONNECTION_ID="11"
    COMMAND_CLASS="create_table"
    SQLTEXT="CREATE TABLE t1 (c1 INT)"/>
  <AUDIT_RECORD
    NAME="Query Status End"
    RECORD_ID="4_2023-03-29T11:15:53"
    TIMESTAMP="2023-03-29T11:15:53"
    STATUS="0"
    CONNECTION_ID="11"
    COMMAND_CLASS="create_table"
    SQLTEXT="CREATE TABLE t1 (c1 INT)"/>
  <AUDIT_RECORD
    NAME="Query"
    RECORD_ID="5_2023-03-29T11:15:53"
    TIMESTAMP="2023-03-29T11:15:53"
    COMMAND_CLASS="create_table"
    CONNECTION_ID="11"
    HOST="localhost"
    IP=""
    USER="root[root] @ localhost []"
    OS_LOGIN=""
    SQLTEXT="CREATE TABLE t1 (c1 INT)"
    STATUS="0"/>
  <AUDIT_RECORD
    NAME="Command End"
    RECORD_ID="6_2023-03-29T11:15:53"
    TIMESTAMP="2023-03-29T11:15:53"
    STATUS="0"
    CONNECTION_ID="1"
    COMMAND_CLASS="query"/>
</AUDIT>

Required attributes

Attribute	Description
NAME	Action that produced the record
RECORD_ID	Sequence number and timestamp; sequence resets when the component opens the log file
TIMESTAMP	Event date and time

Optional attributes

Attribute	Description
COMMAND_CLASS	Action or command class
CONNECTION_ID	Client connection ID
CONNECTION_TYPE	Connection security / transport
DB	Database name
HOST	Client host name
IP	Client IP address
MYSQL_VERSION	Server version string
OS_LOGIN	External auth user (for example LDAP); empty for built-in auth
OS_VERSION	Server OS
PRIV_USER	Privilege check user (may differ from USER)
PROXY_USER	Proxy user if used; otherwise empty
SERVER_ID	Server ID
SQLTEXT	SQL text
STARTUP_OPTIONS	Startup arguments (CLI and options files)
STATUS	0 success, non-zero error
STATUS_CODE	High-level outcome: 0 success, non-zero error
TABLE	Table name
USER	Client user (may differ from PRIV_USER)
VERSION	Audit log format version

Additional reading

• Audit Log Filter file format overview
• Audit Log Filter format - XML (new style)
• Audit Log Filter format - JSON and JSONL
• Audit log filter functions, options, and variables
• Audit Log Filter overview