Audit Log Filter quickstart

Use the steps below when the Audit Log Filter component and tables are already installed (install the audit log filter). You need AUDIT_ADMIN. Changing audit_log_filter.disable at runtime also requires SYSTEM_VARIABLES_ADMIN.

Quickstart

1. Optional: run SHOW GLOBAL STATUS LIKE 'audit_log_filter_events_written'; and note the counter.
2. Run these five statements in order:

SET GLOBAL audit_log_filter.disable = false;
SELECT audit_log_filter_set_filter('log_all', '{ "filter": { "log": true } }');
SELECT audit_log_filter_set_user('%', 'log_all');
SELECT audit_log_filter_flush();
SELECT 1;

1. Run SHOW GLOBAL STATUS LIKE 'audit_log_filter_events_written'; again. The counter should increase. If it does not, verify the component loaded, tables exist, and audit_log_filter.disable is false.

For JSON or JSONL audit_log_filter.format, read events with audit_log_read() (Reading Audit Log Filter files). With the default NEW format, inspect the file named by audit_log_filter.file on the server.

Next steps

After the catch-all log_all rule works, replace it with a tighter JSON filter (by user, database, table, or event class). Call audit_log_filter_set_filter(), audit_log_filter_set_user(), and audit_log_filter_flush() so sessions pick up changes. Author rules in Write audit_log_filter definitions, compare assignment to JSON rules in Filter the Audit Log Filter logs, and validate names in Audit Log Filter definition fields.

If you switch to JSON or JSONL, read Audit Log Filter file format overview and Reading Audit Log Filter files. For production, plan path, rotation, and retention with audit_log_filter.file, audit_log_rotate(), and Manage the Audit Log Filter files.

Also see: Audit Log Filter overview · Install the audit log filter · Disable Audit Log Filter logging · Audit log filter functions, options, and variables (full UDF and variable reference)