<div id="docs-body">
 <div class="section">
  <div class="titlepage">
   <div>
    <div>
     <h4 class="title">
      <a name="audit-log-file-reading">
      </a>
      8.4.5.6 Reading Audit Log Files
     </h4>
    </div>
   </div>
  </div>
  <p>
   The audit log plugin supports functions that provide an SQL
        interface for reading JSON-format audit log files. (This
        capability does not apply to log files written in other
        formats.)
  </p>
  <p>
   When the audit log plugin initializes and is configured for JSON
        logging, it uses the directory containing the current audit log
        file as the location to search for readable audit log files. The
        plugin determines the file location, base name, and suffix from
        the value of the
   <a class="link" href="audit-log-reference.html#sysvar_audit_log_file">
    <code class="literal">
     audit_log_file
    </code>
   </a>
   system variable, then looks for files with names that match the
        following pattern, where
   <code class="literal">
    [...]
   </code>
   indicates
        optional file name parts:
  </p>
  <a class="indexterm" name="idm46045237488976">
  </a>
  <a class="indexterm" name="idm46045237487888">
  </a>
  <div class="copytoclipboard-wrapper">
   <pre class="programlisting one-line language-none"><div class="docs-select-all right" id="sa96385302"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-none"><em class="replaceable">basename</em>[.<em class="replaceable">timestamp</em>].<em class="replaceable">suffix</em>[.gz][[.<em class="replaceable">pwd_id</em>].enc]</code></pre>
  </div>
  <p>
   If a file name ends with
   <code class="filename">
    .enc
   </code>
   , the file is
        encrypted and reading its unencrypted contents requires a
        decryption password obtained from the keyring. The audit log
        plugin determines the keyring ID of the decryption password as
        follows:
  </p>
  <div class="itemizedlist">
   <ul class="itemizedlist" style="list-style-type: disc; ">
    <li class="listitem">
     <p>
      If
      <code class="filename">
       .enc
      </code>
      is preceded by
      <em class="replaceable">
       <code>
        pwd_id
       </code>
      </em>
      , the keyring ID is
      <code class="literal">
       audit_log-
       <em class="replaceable">
        <code>
         pwd_id
        </code>
       </em>
      </code>
      .
     </p>
    </li>
    <li class="listitem">
     <p>
      If
      <code class="filename">
       .enc
      </code>
      is not preceded by
      <em class="replaceable">
       <code>
        pwd_id
       </code>
      </em>
      , the file has an old name
            from before audit log encryption password history was
            implemented. The keyring ID is
      <code class="literal">
       audit_log
      </code>
      .
     </p>
    </li>
   </ul>
  </div>
  <p>
   For more information about encrypted audit log files, see
   <a class="xref" href="audit-log-logging-configuration.html#audit-log-file-encryption" title="Encrypting Audit Log Files">
    Encrypting Audit Log Files
   </a>
   .
  </p>
  <p>
   The plugin ignores files that have been renamed manually and do
        not match the pattern, and files that were encrypted with a
        password no longer available in the keyring. The plugin opens
        each remaining candidate file, verifies that the file actually
        contains
   <a class="link" href="json.html" title="13.5 The JSON Data Type">
    <code class="literal">
     JSON
    </code>
   </a>
   audit events, and
        sorts the files using the timestamps from the first event of
        each file. The result is a sequence of files that are subject to
        access using the log-reading functions:
  </p>
  <a class="indexterm" name="idm46045237472912">
  </a>
  <a class="indexterm" name="idm46045237471808">
  </a>
  <a class="indexterm" name="idm46045237470304">
  </a>
  <a class="indexterm" name="idm46045237469200">
  </a>
  <div class="itemizedlist">
   <ul class="itemizedlist" style="list-style-type: disc; ">
    <li class="listitem">
     <p>
      <a class="link" href="audit-log-reference.html#function_audit-log-read">
       <code class="literal">
        audit_log_read()
       </code>
      </a>
      reads events
            from the audit log or closes the reading process.
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="link" href="audit-log-reference.html#function_audit-log-read-bookmark">
       <code class="literal">
        audit_log_read_bookmark()
       </code>
      </a>
      returns a bookmark for the most recently written audit log
            event. This bookmark is suitable for passing to
      <a class="link" href="audit-log-reference.html#function_audit-log-read">
       <code class="literal">
        audit_log_read()
       </code>
      </a>
      to indicate
            where to begin reading.
     </p>
    </li>
   </ul>
  </div>
  <p>
   <a class="link" href="audit-log-reference.html#function_audit-log-read">
    <code class="literal">
     audit_log_read()
    </code>
   </a>
   takes an
        optional
   <a class="link" href="json.html" title="13.5 The JSON Data Type">
    <code class="literal">
     JSON
    </code>
   </a>
   string argument,
        and the result returned from a successful call to either
        function is a
   <a class="link" href="json.html" title="13.5 The JSON Data Type">
    <code class="literal">
     JSON
    </code>
   </a>
   string.
  </p>
  <p>
   To use the functions to read the audit log, follow these
        principles:
  </p>
  <div class="itemizedlist">
   <ul class="itemizedlist" style="list-style-type: disc; ">
    <li class="listitem">
     <p>
      Call
      <a class="link" href="audit-log-reference.html#function_audit-log-read">
       <code class="literal">
        audit_log_read()
       </code>
      </a>
      to read
            events beginning from a given position or the current
            position, or to close reading:
     </p>
     <div class="itemizedlist">
      <ul class="itemizedlist" style="list-style-type: circle; ">
       <li class="listitem">
        <p>
         To initialize an audit log read sequence, pass an
                argument that indicates the position at which to begin.
                One way to do so is to pass the bookmark returned by
         <a class="link" href="audit-log-reference.html#function_audit-log-read-bookmark">
          <code class="literal">
           audit_log_read_bookmark()
          </code>
         </a>
         :
        </p>
        <div class="copytoclipboard-wrapper">
         <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa5892792"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">SELECT</span> audit_log_read<span class="token punctuation">(</span>audit_log_read_bookmark<span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">)</span><span class="token punctuation">;</span></code></pre>
        </div>
       </li>
       <li class="listitem">
        <p>
         To continue reading from the current position in the
                sequence, call
         <a class="link" href="audit-log-reference.html#function_audit-log-read">
          <code class="literal">
           audit_log_read()
          </code>
         </a>
         with no
                position specified:
        </p>
        <div class="copytoclipboard-wrapper">
         <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa96699573"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">SELECT</span> audit_log_read<span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">;</span></code></pre>
        </div>
       </li>
       <li class="listitem">
        <p>
         To explicitly close the read sequence, pass a
         <a class="link" href="json.html" title="13.5 The JSON Data Type">
          <code class="literal">
           JSON
          </code>
         </a>
         <code class="literal">
          null
         </code>
         argument:
        </p>
        <div class="copytoclipboard-wrapper">
         <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa68600731"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">SELECT</span> audit_log_read<span class="token punctuation">(</span><span class="token string">'null'</span><span class="token punctuation">)</span><span class="token punctuation">;</span></code></pre>
        </div>
        <p>
         It is unnecessary to close reading explicitly. Reading
                is closed implicitly when the session ends or a new read
                sequence is initialized by calling
         <a class="link" href="audit-log-reference.html#function_audit-log-read">
          <code class="literal">
           audit_log_read()
          </code>
         </a>
         with an
                argument that indicates the position at which to begin.
        </p>
       </li>
      </ul>
     </div>
    </li>
    <li class="listitem">
     <p>
      A successful call to
      <a class="link" href="audit-log-reference.html#function_audit-log-read">
       <code class="literal">
        audit_log_read()
       </code>
      </a>
      to read
            events returns a
      <a class="link" href="json.html" title="13.5 The JSON Data Type">
       <code class="literal">
        JSON
       </code>
      </a>
      string
            containing an array of audit events:
     </p>
     <div class="itemizedlist">
      <ul class="itemizedlist" style="list-style-type: circle; ">
       <li class="listitem">
        <p>
         If the final value of the returned array is not a
         <a class="link" href="json.html" title="13.5 The JSON Data Type">
          <code class="literal">
           JSON
          </code>
         </a>
         <code class="literal">
          null
         </code>
         value, there are more events
                following those just read and
         <a class="link" href="audit-log-reference.html#function_audit-log-read">
          <code class="literal">
           audit_log_read()
          </code>
         </a>
         can be
                called again to read more of them.
        </p>
       </li>
       <li class="listitem">
        <p>
         If the final value of the returned array is a
         <a class="link" href="json.html" title="13.5 The JSON Data Type">
          <code class="literal">
           JSON
          </code>
         </a>
         <code class="literal">
          null
         </code>
         value, there are no more events
                left to be read in the current read sequence.
        </p>
       </li>
      </ul>
     </div>
     <p>
      Each non-
      <code class="literal">
       null
      </code>
      array element is an event
            represented as a
      <a class="link" href="json.html" title="13.5 The JSON Data Type">
       <code class="literal">
        JSON
       </code>
      </a>
      hash.
            For example:
     </p>
     <div class="copytoclipboard-wrapper">
      <pre class="programlisting language-json"><div class="docs-select-all right" id="sa78882737"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-json"><span class="token punctuation">[</span>
  <span class="token punctuation">{</span>
    <span class="token property">"timestamp"</span><span class="token operator">:</span> <span class="token string">"2020-05-18 13:39:33"</span><span class="token punctuation">,</span> <span class="token property">"id"</span><span class="token operator">:</span> <span class="token number">0</span><span class="token punctuation">,</span>
    <span class="token property">"class"</span><span class="token operator">:</span> <span class="token string">"connection"</span><span class="token punctuation">,</span> <span class="token property">"event"</span><span class="token operator">:</span> <span class="token string">"connect"</span><span class="token punctuation">,</span>
    ...
  <span class="token punctuation">}</span><span class="token punctuation">,</span>
  <span class="token punctuation">{</span>
    <span class="token property">"timestamp"</span><span class="token operator">:</span> <span class="token string">"2020-05-18 13:39:33"</span><span class="token punctuation">,</span> <span class="token property">"id"</span><span class="token operator">:</span> <span class="token number">1</span><span class="token punctuation">,</span>
    <span class="token property">"class"</span><span class="token operator">:</span> <span class="token string">"general"</span><span class="token punctuation">,</span> <span class="token property">"event"</span><span class="token operator">:</span> <span class="token string">"status"</span><span class="token punctuation">,</span>
    ...
  <span class="token punctuation">}</span><span class="token punctuation">,</span>
  <span class="token punctuation">{</span>
    <span class="token property">"timestamp"</span><span class="token operator">:</span> <span class="token string">"2020-05-18 13:39:33"</span><span class="token punctuation">,</span> <span class="token property">"id"</span><span class="token operator">:</span> <span class="token number">2</span><span class="token punctuation">,</span>
    <span class="token property">"class"</span><span class="token operator">:</span> <span class="token string">"connection"</span><span class="token punctuation">,</span> <span class="token property">"event"</span><span class="token operator">:</span> <span class="token string">"disconnect"</span><span class="token punctuation">,</span>
    ...
  <span class="token punctuation">}</span><span class="token punctuation">,</span>
  <span class="token null">null</span>
<span class="token punctuation">]</span></code></pre>
     </div>
     <p>
      For more information about the content of JSON-format audit
            events, see
      <a class="xref" href="audit-log-file-formats.html#audit-log-file-json-format" title="JSON Audit Log File Format">
       JSON Audit Log File Format
      </a>
      .
     </p>
    </li>
    <li class="listitem">
     <p>
      An
      <a class="link" href="audit-log-reference.html#function_audit-log-read">
       <code class="literal">
        audit_log_read()
       </code>
      </a>
      call to
            read events that does not specify a position produces an
            error under any of these conditions:
     </p>
     <div class="itemizedlist">
      <ul class="itemizedlist" style="list-style-type: circle; ">
       <li class="listitem">
        <p>
         A read sequence has not yet been initialized by passing
                a position to
         <a class="link" href="audit-log-reference.html#function_audit-log-read">
          <code class="literal">
           audit_log_read()
          </code>
         </a>
         .
        </p>
       </li>
       <li class="listitem">
        <p>
         There are no more events left to be read in the current
                read sequence; that is,
         <a class="link" href="audit-log-reference.html#function_audit-log-read">
          <code class="literal">
           audit_log_read()
          </code>
         </a>
         previously returned an array ending with a
         <a class="link" href="json.html" title="13.5 The JSON Data Type">
          <code class="literal">
           JSON
          </code>
         </a>
         <code class="literal">
          null
         </code>
         value.
        </p>
       </li>
       <li class="listitem">
        <p>
         The most recent read sequence has been closed by passing
                a
         <a class="link" href="json.html" title="13.5 The JSON Data Type">
          <code class="literal">
           JSON
          </code>
         </a>
         <code class="literal">
          null
         </code>
         value to
         <a class="link" href="audit-log-reference.html#function_audit-log-read">
          <code class="literal">
           audit_log_read()
          </code>
         </a>
         .
        </p>
       </li>
      </ul>
     </div>
     <p>
      To read events under those conditions, it is necessary to
            first initialize a read sequence by calling
      <a class="link" href="audit-log-reference.html#function_audit-log-read">
       <code class="literal">
        audit_log_read()
       </code>
      </a>
      with an
            argument that specifies a position.
     </p>
    </li>
   </ul>
  </div>
  <p>
   To specify a position to
   <a class="link" href="audit-log-reference.html#function_audit-log-read">
    <code class="literal">
     audit_log_read()
    </code>
   </a>
   , include an
        argument that indicates where to begin reading. For example,
        pass a bookmark, which is a
   <a class="link" href="json.html" title="13.5 The JSON Data Type">
    <code class="literal">
     JSON
    </code>
   </a>
   hash containing
   <code class="literal">
    timestamp
   </code>
   and
   <code class="literal">
    id
   </code>
   elements that uniquely identify a
        particular event. Here is an example bookmark, obtained by
        calling the
   <a class="link" href="audit-log-reference.html#function_audit-log-read-bookmark">
    <code class="literal">
     audit_log_read_bookmark()
    </code>
   </a>
   function:
  </p>
  <div class="copytoclipboard-wrapper">
   <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa85144958"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token prompt">mysql&gt;</span> <span class="token keyword">SELECT</span> audit_log_read_bookmark<span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output"><span class="token punctuation">|</span> audit_log_read_bookmark()                       <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output"><span class="token punctuation">|</span> { "timestamp": "2020<span class="token punctuation">-</span>05<span class="token punctuation">-</span>18 21:03:44", "id": 0 } <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span></code></pre>
  </div>
  <p>
   Passing the current bookmark to
   <a class="link" href="audit-log-reference.html#function_audit-log-read">
    <code class="literal">
     audit_log_read()
    </code>
   </a>
   initializes
        event reading beginning at the bookmark position:
  </p>
  <div class="copytoclipboard-wrapper">
   <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa25164799"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token prompt">mysql&gt;</span> <span class="token keyword">SELECT</span> audit_log_read<span class="token punctuation">(</span>audit_log_read_bookmark<span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output"><span class="token punctuation">|</span> audit_log_read(audit_log_read_bookmark())                             <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output"><span class="token punctuation">|</span> [ {"timestamp":"2020<span class="token punctuation">-</span>05<span class="token punctuation">-</span>18 22:41:24","id":0,"class":"connection", ... <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span></code></pre>
  </div>
  <p>
   The argument to
   <a class="link" href="audit-log-reference.html#function_audit-log-read">
    <code class="literal">
     audit_log_read()
    </code>
   </a>
   is optional. If present, it can be a
   <a class="link" href="json.html" title="13.5 The JSON Data Type">
    <code class="literal">
     JSON
    </code>
   </a>
   <code class="literal">
    null
   </code>
   value to close the read sequence, or a
   <a class="link" href="json.html" title="13.5 The JSON Data Type">
    <code class="literal">
     JSON
    </code>
   </a>
   hash.
  </p>
  <p>
   Within a hash argument to
   <a class="link" href="audit-log-reference.html#function_audit-log-read">
    <code class="literal">
     audit_log_read()
    </code>
   </a>
   , items are
        optional and control aspects of the read operation such as the
        position at which to begin reading or how many events to read.
        The following items are significant (other items are ignored):
  </p>
  <div class="itemizedlist">
   <ul class="itemizedlist" style="list-style-type: disc; ">
    <li class="listitem">
     <p>
      <code class="literal">
       start
      </code>
      : The position within the audit log
            of the first event to read. The position is given as a
            timestamp and the read starts from the first event that
            occurs on or after the timestamp value. The
      <code class="literal">
       start
      </code>
      item has this format, where
      <em class="replaceable">
       <code>
        value
       </code>
      </em>
      is a literal timestamp
            value:
     </p>
     <div class="copytoclipboard-wrapper">
      <pre class="programlisting one-line language-json"><div class="docs-select-all right" id="sa24668904"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-json"><span class="token property">"start"</span><span class="token operator">:</span> <span class="token punctuation">{</span> <span class="token property">"timestamp"</span><span class="token operator">:</span> <span class="token string">"<em class="replaceable">value</em>"</span> <span class="token punctuation">}</span></code></pre>
     </div>
    </li>
    <li class="listitem">
     <p>
      <code class="literal">
       timestamp
      </code>
      ,
      <code class="literal">
       id
      </code>
      : The
            position within the audit log of the first event to read.
            The
      <code class="literal">
       timestamp
      </code>
      and
      <code class="literal">
       id
      </code>
      items together comprise a bookmark that uniquely identify a
            particular event. If an
      <a class="link" href="audit-log-reference.html#function_audit-log-read">
       <code class="literal">
        audit_log_read()
       </code>
      </a>
      argument
            includes either item, it must include both to completely
            specify a position or an error occurs.
     </p>
    </li>
    <li class="listitem">
     <p>
      <code class="literal">
       max_array_length
      </code>
      : The maximum number of
            events to read from the log. If this item is omitted, the
            default is to read to the end of the log or until the read
            buffer is full, whichever comes first.
     </p>
    </li>
   </ul>
  </div>
  <p>
   To specify a starting position to
   <a class="link" href="audit-log-reference.html#function_audit-log-read">
    <code class="literal">
     audit_log_read()
    </code>
   </a>
   , pass a hash
        argument that includes either a
   <code class="literal">
    start
   </code>
   item or
        a bookmark consisting of
   <code class="literal">
    timestamp
   </code>
   and
   <code class="literal">
    id
   </code>
   items. If a hash argument includes both a
   <code class="literal">
    start
   </code>
   item and a bookmark, an error occurs.
  </p>
  <p>
   If a hash argument specifies no starting position, reading
        continues from the current position.
  </p>
  <p>
   If a timestamp value includes no time part, a time part of
   <code class="literal">
    00:00:00
   </code>
   is assumed.
  </p>
  <p>
   Example arguments accepted by
   <a class="link" href="audit-log-reference.html#function_audit-log-read">
    <code class="literal">
     audit_log_read()
    </code>
   </a>
   :
  </p>
  <div class="itemizedlist">
   <ul class="itemizedlist" style="list-style-type: disc; ">
    <li class="listitem">
     <p>
      Read events starting with the first event that occurs on or
            after the given timestamp:
     </p>
     <div class="copytoclipboard-wrapper">
      <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa82908806"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql">audit_log_read<span class="token punctuation">(</span><span class="token string">'{ "start": { "timestamp": "2020-05-24 12:30:00" } }'</span><span class="token punctuation">)</span></code></pre>
     </div>
    </li>
    <li class="listitem">
     <p>
      Like the previous example, but read at most 3 events:
     </p>
     <div class="copytoclipboard-wrapper">
      <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa8352805"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql">audit_log_read<span class="token punctuation">(</span><span class="token string">'{ "start": { "timestamp": "2020-05-24 12:30:00" }, "max_array_length": 3 }'</span><span class="token punctuation">)</span></code></pre>
     </div>
    </li>
    <li class="listitem">
     <p>
      Read events starting with the first event that occurs on or
            after
      <code class="literal">
       2020-05-24 00:00:00
      </code>
      (the timestamp
            includes no time part, so
      <code class="literal">
       00:00:00
      </code>
      is
            assumed):
     </p>
     <div class="copytoclipboard-wrapper">
      <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa15585267"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql">audit_log_read<span class="token punctuation">(</span><span class="token string">'{ "start": { "timestamp": "2020-05-24" } }'</span><span class="token punctuation">)</span></code></pre>
     </div>
    </li>
    <li class="listitem">
     <p>
      Read events starting with the event that has the exact
            timestamp and event ID:
     </p>
     <div class="copytoclipboard-wrapper">
      <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa41723971"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql">audit_log_read<span class="token punctuation">(</span><span class="token string">'{ "timestamp": "2020-05-24 12:30:00", "id": 0 }'</span><span class="token punctuation">)</span></code></pre>
     </div>
    </li>
    <li class="listitem">
     <p>
      Like the previous example, but read at most 3 events:
     </p>
     <div class="copytoclipboard-wrapper">
      <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa53440569"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql">audit_log_read<span class="token punctuation">(</span><span class="token string">'{ "timestamp": "2020-05-24 12:30:00", "id": 0, "max_array_length": 3 }'</span><span class="token punctuation">)</span></code></pre>
     </div>
    </li>
    <li class="listitem">
     <p>
      Read events from the current position in the read sequence:
     </p>
     <div class="copytoclipboard-wrapper">
      <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa3992450"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql">audit_log_read<span class="token punctuation">(</span><span class="token punctuation">)</span></code></pre>
     </div>
    </li>
    <li class="listitem">
     <p>
      Read at most 5 events beginning at the current position in
            the read sequence:
     </p>
     <div class="copytoclipboard-wrapper">
      <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa37238954"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql">audit_log_read<span class="token punctuation">(</span><span class="token string">'{ "max_array_length": 5 }'</span><span class="token punctuation">)</span></code></pre>
     </div>
    </li>
    <li class="listitem">
     <p>
      Close the current read sequence:
     </p>
     <div class="copytoclipboard-wrapper">
      <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa45503142"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql">audit_log_read<span class="token punctuation">(</span><span class="token string">'null'</span><span class="token punctuation">)</span></code></pre>
     </div>
    </li>
   </ul>
  </div>
  <p>
   A
   <a class="link" href="json.html" title="13.5 The JSON Data Type">
    <code class="literal">
     JSON
    </code>
   </a>
   string returned from
        either log-reading function can be manipulated as necessary.
        Suppose that a call to obtain a bookmark produces this value:
  </p>
  <div class="copytoclipboard-wrapper">
   <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa6428293"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token prompt">mysql&gt;</span> <span class="token keyword">SET</span> <span class="token variable">@mark</span> <span class="token operator">:=</span> audit_log_read_bookmark<span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
<span class="token prompt">mysql&gt;</span> <span class="token keyword">SELECT</span> <span class="token variable">@mark</span><span class="token punctuation">;</span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output"><span class="token punctuation">|</span> @mark                                           <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output"><span class="token punctuation">|</span> { "timestamp": "2020<span class="token punctuation">-</span>05<span class="token punctuation">-</span>18 16:10:28", "id": 2 } <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span></code></pre>
  </div>
  <p>
   Calling
   <a class="link" href="audit-log-reference.html#function_audit-log-read">
    <code class="literal">
     audit_log_read()
    </code>
   </a>
   with
        that argument can return multiple events. To limit
   <a class="link" href="audit-log-reference.html#function_audit-log-read">
    <code class="literal">
     audit_log_read()
    </code>
   </a>
   to reading at
        most
   <em class="replaceable">
    <code>
     N
    </code>
   </em>
   events, add to the string a
   <code class="literal">
    max_array_length
   </code>
   item with that value. For
        example, to read a single event, modify the string as follows:
  </p>
  <div class="copytoclipboard-wrapper">
   <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa18444196"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token prompt">mysql&gt;</span> <span class="token keyword">SET</span> <span class="token variable">@mark</span> <span class="token operator">:=</span> <span class="token function">JSON_SET</span><span class="token punctuation">(</span><span class="token variable">@mark</span><span class="token punctuation">,</span> <span class="token string">'$.max_array_length'</span><span class="token punctuation">,</span> <span class="token number">1</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
<span class="token prompt">mysql&gt;</span> <span class="token keyword">SELECT</span> <span class="token variable">@mark</span><span class="token punctuation">;</span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output"><span class="token punctuation">|</span> @mark                                                                <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output"><span class="token punctuation">|</span> {"id": 2, "timestamp": "2020<span class="token punctuation">-</span>05<span class="token punctuation">-</span>18 16:10:28", "max_array_length": 1} <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span></code></pre>
  </div>
  <p>
   The modified string, when passed to
   <a class="link" href="audit-log-reference.html#function_audit-log-read">
    <code class="literal">
     audit_log_read()
    </code>
   </a>
   , produces a
        result containing at most one event, no matter how many are
        available.
  </p>
  <p>
   If an audit log function is invoked from within the
   <a class="link" href="mysql.html" title="6.5.1 mysql — The MySQL Command-Line Client">
    <span class="command">
     <strong>
      mysql
     </strong>
    </span>
   </a>
   client, binary string results display
        using hexadecimal notation, depending on the value of the
   <a class="link" href="mysql-command-options.html#option_mysql_binary-as-hex">
    <code class="option">
     --binary-as-hex
    </code>
   </a>
   . For more
        information about that option, see
   <a class="xref" href="mysql.html" title="6.5.1 mysql — The MySQL Command-Line Client">
    Section 6.5.1, “mysql — The MySQL Command-Line Client”
   </a>
   .
  </p>
  <p>
   To set a limit on the number of bytes that
   <a class="link" href="audit-log-reference.html#function_audit-log-read">
    <code class="literal">
     audit_log_read()
    </code>
   </a>
   reads, set the
   <a class="link" href="audit-log-reference.html#sysvar_audit_log_read_buffer_size">
    <code class="literal">
     audit_log_read_buffer_size
    </code>
   </a>
   system variable. This variable has a default of 32KB and can be
        set at runtime. Each client should set its session value of
   <a class="link" href="audit-log-reference.html#sysvar_audit_log_read_buffer_size">
    <code class="literal">
     audit_log_read_buffer_size
    </code>
   </a>
   appropriately for its use of
   <a class="link" href="audit-log-reference.html#function_audit-log-read">
    <code class="literal">
     audit_log_read()
    </code>
   </a>
   .
  </p>
  <a class="indexterm" name="idm46045237334768">
  </a>
  <a class="indexterm" name="idm46045237333664">
  </a>
  <p>
   Each call to
   <a class="link" href="audit-log-reference.html#function_audit-log-read">
    <code class="literal">
     audit_log_read()
    </code>
   </a>
   returns as many available events as fit within the buffer size.
        Events that do not fit within the buffer size are skipped and
        generate warnings. Given this behavior, consider these factors
        when assessing the proper buffer size for an application:
  </p>
  <div class="itemizedlist">
   <ul class="itemizedlist" style="list-style-type: disc; ">
    <li class="listitem">
     <p>
      There is a tradeoff between number of calls to
      <a class="link" href="audit-log-reference.html#function_audit-log-read">
       <code class="literal">
        audit_log_read()
       </code>
      </a>
      and events
            returned per call:
     </p>
     <div class="itemizedlist">
      <ul class="itemizedlist" style="list-style-type: circle; ">
       <li class="listitem">
        <p>
         With a smaller buffer size, calls return fewer events,
                so more calls are needed.
        </p>
       </li>
       <li class="listitem">
        <p>
         With a larger buffer size, calls return more events, so
                fewer calls are needed.
        </p>
       </li>
      </ul>
     </div>
    </li>
    <li class="listitem">
     <p>
      With a smaller buffer size, such as the default size of
            32KB, there is a greater chance for events to exceed the
            buffer size and thus to be skipped.
     </p>
    </li>
   </ul>
  </div>
  <p>
   For additional information about audit log-reading functions,
        see
   <a class="xref" href="audit-log-reference.html#audit-log-routines" title="Audit Log Functions">
    Audit Log Functions
   </a>
   .
  </p>
 </div>
 <br/>
</div>
