6.3.11.3. The Audit Log File

Audit log file contents are not encrypted. See Section 6.3.11.2, "Audit Log Plugin Security Considerations".

The audit log file is written as XML, using UTF-8 (up to 4 bytes per character). The root element is <AUDIT>. The closing </AUDIT> tag of the root element is written when the audit log plugin terminates, so the tag is not present in the file while the plugin is active.

The root element contains <AUDIT_RECORD> elements. Each <AUDIT_RECORD> element has an empty body; all audit record fields are represented by element attributes.

Here is a sample log file, reformatted slightly for readability:

<?xml version="1.0" encoding="UTF-8"?><AUDIT>  <AUDIT_RECORD    TIMESTAMP="2012-08-02T14:52:12"    NAME="Audit"    SERVER_ID="1"    VERSION="1"    STARTUP_OPTIONS="--port=3306"    OS_VERSION="i686-Linux"    MYSQL_VERSION="5.6.10-log"/>  <AUDIT_RECORD    TIMESTAMP="2012-08-02T14:52:41"    NAME="Connect"    CONNECTION_ID="1"    STATUS="0"    USER="root"    PRIV_USER="root"    OS_LOGIN=""    PROXY_USER=""    HOST="localhost"    IP="127.0.0.1"    DB=""/>  <AUDIT_RECORD    TIMESTAMP="2012-08-02T14:53:45"    NAME="Query"    CONNECTION_ID="1"    STATUS="0"    SQLTEXT="INSERT INTO t1 () VALUES()"/>  <AUDIT_RECORD    TIMESTAMP="2012-08-02T14:53:51"    NAME="Quit"    CONNECTION_ID="1"    STATUS="0"/>  <AUDIT_RECORD    TIMESTAMP="2012-08-06T14:21:03"    NAME="NoAudit"    SERVER_ID="1"/></AUDIT>

Attributes of <AUDIT_RECORD> elements have these characteristics:

Some attributes appear in every element, but most are optional and do not necessarily appear in every element.
Order of attributes within an element is not guaranteed.
Attribute values are not fixed length. Long values may be truncated as indicated in the attribute descriptions given later.
The <, >, ", and & characters are encoded as <, >, ", and &, respectively. NUL bytes (U+00) are encoded as the ? character.
Characters not valid as XML characters are encoded using numeric character references. Valid XML characters are:
```
#x9 | #xA | #xD | [#x20-#xD7FF] | [#xE000-#xFFFD] | [#x10000-#x10FFFF]
```

Every <AUDIT_RECORD> element contains a set of mandatory attributes. Other optional attributes may appear depending on the audit record type.

The following attributes are mandatory in every <AUDIT_RECORD> element:

NAME

A string representing the type of instruction that generated the audit event, such as a command that the server received from a client.

Example: NAME="Query"

Some common NAME values:
```
"Audit"    When auditing starts, which may be server startup time"Connect"  When a client connects, also known as logging in"Query"    An SQL statement (executed directly)"Prepare"  Preparation of an SQL statement; usually followed by Execute"Execute"  Execution of an SQL statement; usually follows Prepare"Shutdown" Server shutdown"Quit"     When a client disconnects"NoAudit"  Auditing has been turned off
```
The possible values are "Audit", "Binlog Dump", "Change user", "Close stmt", "Connect Out", "Connect", "Create DB", "Daemon", "Debug", "Delayed insert", "Drop DB", "Execute", "Fetch", "Field List", "Init DB", "Kill", "Long Data", "NoAudit", "Ping", "Prepare", "Processlist", "Query", "Quit", "Refresh", "Register Slave", "Reset stmt", "Set option", "Shutdown", "Sleep", "Statistics", "Table Dump", "Time".

With the exception of "Audit" and "NoAudit", these values correspond to the COM_xxx command values listed in the mysql_com.h header file. For example, "Create DB" and "Shutdown" correspond to COM_CREATE_DB and COM_SHUTDOWN, respectively.
TIMESTAMP

The date and time that the audit event was generated. For example, the event corresponding to execution of an SQL statement received from a client has a TIMESTAMP value occurring after the statement finishes, not when it is received. The value is UTC, in the format yyyy-mm-ddThh:mm:ss (with T, no decimals).

Example: TIMESTAMP="2012-08-09T12:55:16"

The following attributes are optional in <AUDIT_RECORD> elements. Many of them occur only for elements with specific values of the NAME attribute.

CONNECTION_ID

An unsigned integer representing the client connection identifier. This is the same as the CONNECTION_ID() function value within the session.

Example: CONNECTION_ID="127"
DB

A string representing the default database name. This attribute appears only if the NAME value is "Connect" or "Change user".
HOST

A string representing the client host name. This attribute appears only if the NAME value is "Connect" or "Change user".

Example: HOST="localhost"
IP

A string representing the client IP address. This attribute appears only if the NAME value is "Connect" or "Change user".

Example: IP="127.0.0.1"
MYSQL_VERSION

A string representing the MySQL server version. This is the same as the value of the VERSION() function or version system variable. This attribute appears only if the NAME value is "Audit".

Example: MYSQL_VERSION="5.6.11-log"
OS_LOGIN

A string representing the external user (empty if none). The value may differ from USER, for example, if the server authenticates the client using an external authentication method. This attribute appears only if the NAME value is "Connect" or "Change user".
OS_VERSION

A string representing the operating system on which the server was built or is running. This attribute appears only if the NAME value is "Audit".

Example: OS_VERSION="x86_64-Linux"
PRIV_USER

A string representing the user that the server authenticated the client as. This is the user name that the server uses for privilege checking, and may be different from the USER value. This attribute appears only if the NAME value is "Connect" or "Change user".
PROXY_USER

A string representing the proxy user. The value is empty if user proxying is not in effect. This attribute appears only if the NAME value is "Connect" or "Change user".
SERVER_ID

An unsigned integer representing the server ID. This is the same as the value of the server_id system variable. This attribute appears only if the NAME value is "Audit" or "NoAudit".

Example: SERVER_ID="1"
SQLTEXT

A string representing the text of an SQL statement. The value can be empty. Long values may be truncated. This attribute appears only if the NAME value is "Query" or "Execute".

The string, like the audit log file itself, is written using UTF-8 (up to 4 bytes per character), so the value may be the result of conversion. For example, the original statement might have been received from the client as an SJIS string.

Example: SQLTEXT="DELETE FROM t1"
STARTUP_OPTIONS

A string representing the options that were given on the command line or in option files when the MySQL server was started. This attribute appears only if the NAME value is "Audit".

Example: STARTUP_OPTIONS="--port=3306 --log-output=FILE"
STATUS

An unsigned integer representing the command status: 0 for success, nonzero if an error occurred. This is the same as the value of the mysql_errno() C API function.

The audit log does not contain the SQLSTATE value or error message. To see the associations between error codes, SQLSTATE values, and messages, see Section C.3, "Server Error Codes and Messages".

Warnings are not logged.

Example: STATUS="1051"
USER

A string representing the user name sent by the client. This may be different from the PRIV_USER value. This attribute appears only if the NAME value is "Connect" or "Change user".
VERSION

An unsigned integer representing the version of the audit log file format. This attribute appears only if the NAME value is "Audit".

Example: VERSION="1"