<div id="docs-body">
 <div class="section">
  <div class="titlepage">
   <div>
    <div>
     <h4 class="title">
      <a name="audit-log-file-formats">
      </a>
      8.4.5.4 Audit Log File Formats
     </h4>
    </div>
   </div>
  </div>
  <p>
   The MySQL server calls the audit log plugin to write an audit
        record to its log file whenever an auditable event occurs.
        Typically the first audit record written after plugin startup
        contains the server description and startup options. Elements
        following that one represent events such as client connect and
        disconnect events, executed SQL statements, and so forth. Only
        top-level statements are logged, not statements within stored
        programs such as triggers or stored procedures. Contents of
        files referenced by statements such as
   <a class="link" href="load-data.html" title="15.2.9 LOAD DATA Statement">
    <code class="literal">
     LOAD
        DATA
    </code>
   </a>
   are not logged.
  </p>
  <p>
   To select the log format that the audit log plugin uses to write
        its log file, set the
   <a class="link" href="audit-log-reference.html#sysvar_audit_log_format">
    <code class="literal">
     audit_log_format
    </code>
   </a>
   system
        variable at server startup. These formats are available:
  </p>
  <div class="itemizedlist">
   <ul class="itemizedlist" style="list-style-type: disc; ">
    <li class="listitem">
     <p>
      New-style XML format
            (
      <a class="link" href="audit-log-reference.html#sysvar_audit_log_format">
       <code class="literal">
        audit_log_format=NEW
       </code>
      </a>
      ): An
            XML format that has better compatibility with Oracle Audit
            Vault than old-style XML format. MySQL 8.4 uses
            new-style XML format by default.
     </p>
    </li>
    <li class="listitem">
     <p>
      Old-style XML format
            (
      <a class="link" href="audit-log-reference.html#sysvar_audit_log_format">
       <code class="literal">
        audit_log_format=OLD
       </code>
      </a>
      ): The
            original audit log format used by default in older MySQL
            series.
     </p>
    </li>
    <li class="listitem">
     <p>
      JSON format
            (
      <a class="link" href="audit-log-reference.html#sysvar_audit_log_format">
       <code class="literal">
        audit_log_format=JSON
       </code>
      </a>
      ):
            Writes the audit log as a JSON array. Only this format
            supports the optional query time and size statistics.
     </p>
    </li>
   </ul>
  </div>
  <p>
   By default, audit log file contents are written in new-style XML
        format, without compression or encryption.
  </p>
  <p>
   If you change
   <a class="link" href="audit-log-reference.html#sysvar_audit_log_format">
    <code class="literal">
     audit_log_format
    </code>
   </a>
   ,
        it is recommended that you also change
   <a class="link" href="audit-log-reference.html#sysvar_audit_log_file">
    <code class="literal">
     audit_log_file
    </code>
   </a>
   . For example, if
        you set
   <a class="link" href="audit-log-reference.html#sysvar_audit_log_format">
    <code class="literal">
     audit_log_format
    </code>
   </a>
   to
   <code class="literal">
    JSON
   </code>
   , set
   <a class="link" href="audit-log-reference.html#sysvar_audit_log_file">
    <code class="literal">
     audit_log_file
    </code>
   </a>
   to
   <code class="literal">
    audit.json
   </code>
   . Otherwise, newer log files will
        have a different format than older files, but they will all have
        the same base name with nothing to indicate when the format
        changed.
  </p>
  <div class="itemizedlist">
   <ul class="itemizedlist" style="list-style-type: disc; ">
    <li class="listitem">
     <p>
      <a class="xref" href="audit-log-file-formats.html#audit-log-file-new-style-xml-format" title="New-Style XML Audit Log File Format">
       New-Style XML Audit Log File Format
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="audit-log-file-formats.html#audit-log-file-old-style-xml-format" title="Old-Style XML Audit Log File Format">
       Old-Style XML Audit Log File Format
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="audit-log-file-formats.html#audit-log-file-json-format" title="JSON Audit Log File Format">
       JSON Audit Log File Format
      </a>
     </p>
    </li>
   </ul>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h5 class="title">
       <a name="audit-log-file-new-style-xml-format">
       </a>
       New-Style XML Audit Log File Format
      </h5>
     </div>
    </div>
   </div>
   <p>
    Here is a sample log file in new-style XML format
          (
    <a class="link" href="audit-log-reference.html#sysvar_audit_log_format">
     <code class="literal">
      audit_log_format=NEW
     </code>
    </a>
    ),
          reformatted slightly for readability:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-xml"><div class="docs-select-all right" id="sa70854550"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-xml"><span class="token prolog">&lt;?xml version="1.0" encoding="utf-8"?&gt;</span>
<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>AUDIT</span><span class="token punctuation">&gt;</span></span>
 <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>AUDIT_RECORD</span><span class="token punctuation">&gt;</span></span>
  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>TIMESTAMP</span><span class="token punctuation">&gt;</span></span>2019-10-03T14:06:33 UTC<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>TIMESTAMP</span><span class="token punctuation">&gt;</span></span>
  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>RECORD_ID</span><span class="token punctuation">&gt;</span></span>1_2019-10-03T14:06:33<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>RECORD_ID</span><span class="token punctuation">&gt;</span></span>
  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>NAME</span><span class="token punctuation">&gt;</span></span>Audit<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>NAME</span><span class="token punctuation">&gt;</span></span>
  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>SERVER_ID</span><span class="token punctuation">&gt;</span></span>1<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>SERVER_ID</span><span class="token punctuation">&gt;</span></span>
  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>VERSION</span><span class="token punctuation">&gt;</span></span>1<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>VERSION</span><span class="token punctuation">&gt;</span></span>
  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>STARTUP_OPTIONS</span><span class="token punctuation">&gt;</span></span>/usr/local/mysql/bin/mysqld
    --socket=/usr/local/mysql/mysql.sock
    --port=3306<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>STARTUP_OPTIONS</span><span class="token punctuation">&gt;</span></span>
  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>OS_VERSION</span><span class="token punctuation">&gt;</span></span>i686-Linux<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>OS_VERSION</span><span class="token punctuation">&gt;</span></span>
  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>MYSQL_VERSION</span><span class="token punctuation">&gt;</span></span>5.7.21-log<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>MYSQL_VERSION</span><span class="token punctuation">&gt;</span></span>
 <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>AUDIT_RECORD</span><span class="token punctuation">&gt;</span></span>
 <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>AUDIT_RECORD</span><span class="token punctuation">&gt;</span></span>
  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>TIMESTAMP</span><span class="token punctuation">&gt;</span></span>2019-10-03T14:09:38 UTC<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>TIMESTAMP</span><span class="token punctuation">&gt;</span></span>
  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>RECORD_ID</span><span class="token punctuation">&gt;</span></span>2_2019-10-03T14:06:33<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>RECORD_ID</span><span class="token punctuation">&gt;</span></span>
  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>NAME</span><span class="token punctuation">&gt;</span></span>Connect<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>NAME</span><span class="token punctuation">&gt;</span></span>
  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>CONNECTION_ID</span><span class="token punctuation">&gt;</span></span>5<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>CONNECTION_ID</span><span class="token punctuation">&gt;</span></span>
  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>STATUS</span><span class="token punctuation">&gt;</span></span>0<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>STATUS</span><span class="token punctuation">&gt;</span></span>
  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>STATUS_CODE</span><span class="token punctuation">&gt;</span></span>0<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>STATUS_CODE</span><span class="token punctuation">&gt;</span></span>
  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>USER</span><span class="token punctuation">&gt;</span></span>root<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>USER</span><span class="token punctuation">&gt;</span></span>
  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>OS_LOGIN</span><span class="token punctuation">/&gt;</span></span>
  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>HOST</span><span class="token punctuation">&gt;</span></span>localhost<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>HOST</span><span class="token punctuation">&gt;</span></span>
  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>IP</span><span class="token punctuation">&gt;</span></span>127.0.0.1<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>IP</span><span class="token punctuation">&gt;</span></span>
  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>COMMAND_CLASS</span><span class="token punctuation">&gt;</span></span>connect<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>COMMAND_CLASS</span><span class="token punctuation">&gt;</span></span>
  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>CONNECTION_TYPE</span><span class="token punctuation">&gt;</span></span>SSL/TLS<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>CONNECTION_TYPE</span><span class="token punctuation">&gt;</span></span>
  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>CONNECTION_ATTRIBUTES</span><span class="token punctuation">&gt;</span></span>
   <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>ATTRIBUTE</span><span class="token punctuation">&gt;</span></span>
    <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>NAME</span><span class="token punctuation">&gt;</span></span>_pid<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>NAME</span><span class="token punctuation">&gt;</span></span>
    <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>VALUE</span><span class="token punctuation">&gt;</span></span>42794<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>VALUE</span><span class="token punctuation">&gt;</span></span>
   <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>ATTRIBUTE</span><span class="token punctuation">&gt;</span></span>
   ...
   <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>ATTRIBUTE</span><span class="token punctuation">&gt;</span></span>
    <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>NAME</span><span class="token punctuation">&gt;</span></span>program_name<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>NAME</span><span class="token punctuation">&gt;</span></span>
    <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>VALUE</span><span class="token punctuation">&gt;</span></span>mysqladmin<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>VALUE</span><span class="token punctuation">&gt;</span></span>
   <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>ATTRIBUTE</span><span class="token punctuation">&gt;</span></span>
  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>CONNECTION_ATTRIBUTES</span><span class="token punctuation">&gt;</span></span>
  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>PRIV_USER</span><span class="token punctuation">&gt;</span></span>root<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>PRIV_USER</span><span class="token punctuation">&gt;</span></span>
  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>PROXY_USER</span><span class="token punctuation">/&gt;</span></span>
  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>DB</span><span class="token punctuation">&gt;</span></span>test<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>DB</span><span class="token punctuation">&gt;</span></span>
 <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>AUDIT_RECORD</span><span class="token punctuation">&gt;</span></span>

...

 <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>AUDIT_RECORD</span><span class="token punctuation">&gt;</span></span>
  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>TIMESTAMP</span><span class="token punctuation">&gt;</span></span>2019-10-03T14:09:38 UTC<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>TIMESTAMP</span><span class="token punctuation">&gt;</span></span>
  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>RECORD_ID</span><span class="token punctuation">&gt;</span></span>6_2019-10-03T14:06:33<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>RECORD_ID</span><span class="token punctuation">&gt;</span></span>
  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>NAME</span><span class="token punctuation">&gt;</span></span>Query<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>NAME</span><span class="token punctuation">&gt;</span></span>
  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>CONNECTION_ID</span><span class="token punctuation">&gt;</span></span>5<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>CONNECTION_ID</span><span class="token punctuation">&gt;</span></span>
  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>STATUS</span><span class="token punctuation">&gt;</span></span>0<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>STATUS</span><span class="token punctuation">&gt;</span></span>
  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>STATUS_CODE</span><span class="token punctuation">&gt;</span></span>0<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>STATUS_CODE</span><span class="token punctuation">&gt;</span></span>
  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>USER</span><span class="token punctuation">&gt;</span></span>root[root] @ localhost [127.0.0.1]<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>USER</span><span class="token punctuation">&gt;</span></span>
  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>OS_LOGIN</span><span class="token punctuation">/&gt;</span></span>
  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>HOST</span><span class="token punctuation">&gt;</span></span>localhost<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>HOST</span><span class="token punctuation">&gt;</span></span>
  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>IP</span><span class="token punctuation">&gt;</span></span>127.0.0.1<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>IP</span><span class="token punctuation">&gt;</span></span>
  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>COMMAND_CLASS</span><span class="token punctuation">&gt;</span></span>drop_table<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>COMMAND_CLASS</span><span class="token punctuation">&gt;</span></span>
  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>SQLTEXT</span><span class="token punctuation">&gt;</span></span>DROP TABLE IF EXISTS t<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>SQLTEXT</span><span class="token punctuation">&gt;</span></span>
 <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>AUDIT_RECORD</span><span class="token punctuation">&gt;</span></span>

...

 <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>AUDIT_RECORD</span><span class="token punctuation">&gt;</span></span>
  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>TIMESTAMP</span><span class="token punctuation">&gt;</span></span>2019-10-03T14:09:39 UTC<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>TIMESTAMP</span><span class="token punctuation">&gt;</span></span>
  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>RECORD_ID</span><span class="token punctuation">&gt;</span></span>8_2019-10-03T14:06:33<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>RECORD_ID</span><span class="token punctuation">&gt;</span></span>
  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>NAME</span><span class="token punctuation">&gt;</span></span>Quit<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>NAME</span><span class="token punctuation">&gt;</span></span>
  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>CONNECTION_ID</span><span class="token punctuation">&gt;</span></span>5<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>CONNECTION_ID</span><span class="token punctuation">&gt;</span></span>
  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>STATUS</span><span class="token punctuation">&gt;</span></span>0<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>STATUS</span><span class="token punctuation">&gt;</span></span>
  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>STATUS_CODE</span><span class="token punctuation">&gt;</span></span>0<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>STATUS_CODE</span><span class="token punctuation">&gt;</span></span>
  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>USER</span><span class="token punctuation">&gt;</span></span>root<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>USER</span><span class="token punctuation">&gt;</span></span>
  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>OS_LOGIN</span><span class="token punctuation">/&gt;</span></span>
  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>HOST</span><span class="token punctuation">&gt;</span></span>localhost<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>HOST</span><span class="token punctuation">&gt;</span></span>
  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>IP</span><span class="token punctuation">&gt;</span></span>127.0.0.1<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>IP</span><span class="token punctuation">&gt;</span></span>
  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>COMMAND_CLASS</span><span class="token punctuation">&gt;</span></span>connect<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>COMMAND_CLASS</span><span class="token punctuation">&gt;</span></span>
  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>CONNECTION_TYPE</span><span class="token punctuation">&gt;</span></span>SSL/TLS<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>CONNECTION_TYPE</span><span class="token punctuation">&gt;</span></span>
 <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>AUDIT_RECORD</span><span class="token punctuation">&gt;</span></span>

...

 <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>AUDIT_RECORD</span><span class="token punctuation">&gt;</span></span>
  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>TIMESTAMP</span><span class="token punctuation">&gt;</span></span>2019-10-03T14:09:43 UTC<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>TIMESTAMP</span><span class="token punctuation">&gt;</span></span>
  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>RECORD_ID</span><span class="token punctuation">&gt;</span></span>11_2019-10-03T14:06:33<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>RECORD_ID</span><span class="token punctuation">&gt;</span></span>
  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>NAME</span><span class="token punctuation">&gt;</span></span>Quit<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>NAME</span><span class="token punctuation">&gt;</span></span>
  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>CONNECTION_ID</span><span class="token punctuation">&gt;</span></span>6<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>CONNECTION_ID</span><span class="token punctuation">&gt;</span></span>
  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>STATUS</span><span class="token punctuation">&gt;</span></span>0<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>STATUS</span><span class="token punctuation">&gt;</span></span>
  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>STATUS_CODE</span><span class="token punctuation">&gt;</span></span>0<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>STATUS_CODE</span><span class="token punctuation">&gt;</span></span>
  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>USER</span><span class="token punctuation">&gt;</span></span>root<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>USER</span><span class="token punctuation">&gt;</span></span>
  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>OS_LOGIN</span><span class="token punctuation">/&gt;</span></span>
  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>HOST</span><span class="token punctuation">&gt;</span></span>localhost<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>HOST</span><span class="token punctuation">&gt;</span></span>
  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>IP</span><span class="token punctuation">&gt;</span></span>127.0.0.1<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>IP</span><span class="token punctuation">&gt;</span></span>
  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>COMMAND_CLASS</span><span class="token punctuation">&gt;</span></span>connect<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>COMMAND_CLASS</span><span class="token punctuation">&gt;</span></span>
  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>CONNECTION_TYPE</span><span class="token punctuation">&gt;</span></span>SSL/TLS<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>CONNECTION_TYPE</span><span class="token punctuation">&gt;</span></span>
 <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>AUDIT_RECORD</span><span class="token punctuation">&gt;</span></span>
 <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>AUDIT_RECORD</span><span class="token punctuation">&gt;</span></span>
  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>TIMESTAMP</span><span class="token punctuation">&gt;</span></span>2019-10-03T14:09:45 UTC<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>TIMESTAMP</span><span class="token punctuation">&gt;</span></span>
  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>RECORD_ID</span><span class="token punctuation">&gt;</span></span>12_2019-10-03T14:06:33<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>RECORD_ID</span><span class="token punctuation">&gt;</span></span>
  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>NAME</span><span class="token punctuation">&gt;</span></span>NoAudit<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>NAME</span><span class="token punctuation">&gt;</span></span>
  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>SERVER_ID</span><span class="token punctuation">&gt;</span></span>1<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>SERVER_ID</span><span class="token punctuation">&gt;</span></span>
 <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>AUDIT_RECORD</span><span class="token punctuation">&gt;</span></span>
<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>AUDIT</span><span class="token punctuation">&gt;</span></span></code></pre>
   </div>
   <p>
    The audit log file is written as XML, using UTF-8 (up to 4
          bytes per character). The root element is
    <code class="literal">
     &lt;AUDIT&gt;
    </code>
    . The root element contains
    <code class="literal">
     &lt;AUDIT_RECORD&gt;
    </code>
    elements, each of
          which provides information about an audited event. When the
          audit log plugin begins writing a new log file, it writes the
          XML declaration and opening
    <code class="literal">
     &lt;AUDIT&gt;
    </code>
    root element tag. When the plugin closes a log file, it writes
          the closing
    <code class="literal">
     &lt;/AUDIT&gt;
    </code>
    root element
          tag. The closing tag is not present while the file is open.
   </p>
   <p>
    Elements within
    <code class="literal">
     &lt;AUDIT_RECORD&gt;
    </code>
    elements have these characteristics:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       Some elements appear in every
       <code class="literal">
        &lt;AUDIT_RECORD&gt;
       </code>
       element. Others
              are optional and may appear depending on the audit record
              type.
      </p>
     </li>
     <li class="listitem">
      <p>
       Order of elements within an
       <code class="literal">
        &lt;AUDIT_RECORD&gt;
       </code>
       element is not
              guaranteed.
      </p>
     </li>
     <li class="listitem">
      <p>
       Element values are not fixed length. Long values may be
              truncated as indicated in the element descriptions given
              later.
      </p>
     </li>
     <li class="listitem">
      <p>
       The
       <code class="literal">
        &lt;
       </code>
       ,
       <code class="literal">
        &gt;
       </code>
       ,
       <code class="literal">
        "
       </code>
       , and
       <code class="literal">
        &amp;
       </code>
       characters are encoded as
       <code class="literal">
        &amp;lt;
       </code>
       ,
       <code class="literal">
        &amp;gt;
       </code>
       ,
       <code class="literal">
        &amp;quot;
       </code>
       , and
       <code class="literal">
        &amp;amp;
       </code>
       , respectively. NUL bytes
              (U+00) are encoded as the
       <code class="literal">
        ?
       </code>
       character.
      </p>
     </li>
     <li class="listitem">
      <p>
       Characters not valid as XML characters are encoded using
              numeric character references. Valid XML characters are:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-none"><div class="docs-select-all right" id="sa80399156"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-none">#x9 | #xA | #xD | [#x20-#xD7FF] | [#xE000-#xFFFD] | [#x10000-#x10FFFF]</code></pre>
      </div>
     </li>
    </ul>
   </div>
   <p>
    The following elements are mandatory in every
    <code class="literal">
     &lt;AUDIT_RECORD&gt;
    </code>
    element:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       <code class="literal">
        &lt;NAME&gt;
       </code>
      </p>
      <p>
       A string representing the type of instruction that
              generated the audit event, such as a command that the
              server received from a client.
      </p>
      <p>
       Example:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-xml"><div class="docs-select-all right" id="sa27319363"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-xml"><span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>NAME</span><span class="token punctuation">&gt;</span></span>Query<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>NAME</span><span class="token punctuation">&gt;</span></span></code></pre>
      </div>
      <p>
       Some common
       <code class="literal">
        &lt;NAME&gt;
       </code>
       values:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-none"><div class="docs-select-all right" id="sa8533939"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-none">Audit    When auditing starts, which may be server startup time
Connect  When a client connects, also known as logging in
Query    An SQL statement (executed directly)
Prepare  Preparation of an SQL statement; usually followed by Execute
Execute  Execution of an SQL statement; usually follows Prepare
Shutdown Server shutdown
Quit     When a client disconnects
NoAudit  Auditing has been turned off</code></pre>
      </div>
      <p>
       The possible values are
       <code class="literal">
        Audit
       </code>
       ,
       <code class="literal">
        Binlog Dump
       </code>
       ,
       <code class="literal">
        Change
              user
       </code>
       ,
       <code class="literal">
        Close stmt
       </code>
       ,
       <code class="literal">
        Connect Out
       </code>
       ,
       <code class="literal">
        Connect
       </code>
       ,
       <code class="literal">
        Create DB
       </code>
       ,
       <code class="literal">
        Daemon
       </code>
       ,
       <code class="literal">
        Debug
       </code>
       ,
       <code class="literal">
        Delayed insert
       </code>
       ,
       <code class="literal">
        Drop
              DB
       </code>
       ,
       <code class="literal">
        Execute
       </code>
       ,
       <code class="literal">
        Fetch
       </code>
       ,
       <code class="literal">
        Field List
       </code>
       ,
       <code class="literal">
        Init DB
       </code>
       ,
       <code class="literal">
        Kill
       </code>
       ,
       <code class="literal">
        Long Data
       </code>
       ,
       <code class="literal">
        NoAudit
       </code>
       ,
       <code class="literal">
        Ping
       </code>
       ,
       <code class="literal">
        Prepare
       </code>
       ,
       <code class="literal">
        Processlist
       </code>
       ,
       <code class="literal">
        Query
       </code>
       ,
       <code class="literal">
        Quit
       </code>
       ,
       <code class="literal">
        Refresh
       </code>
       ,
       <code class="literal">
        Register Slave
       </code>
       ,
       <code class="literal">
        Reset
              stmt
       </code>
       ,
       <code class="literal">
        Set option
       </code>
       ,
       <code class="literal">
        Shutdown
       </code>
       ,
       <code class="literal">
        Sleep
       </code>
       ,
       <code class="literal">
        Statistics
       </code>
       ,
       <code class="literal">
        Table
              Dump
       </code>
       ,
       <code class="literal">
        TableDelete
       </code>
       ,
       <code class="literal">
        TableInsert
       </code>
       ,
       <code class="literal">
        TableRead
       </code>
       ,
       <code class="literal">
        TableUpdate
       </code>
       ,
       <code class="literal">
        Time
       </code>
       .
      </p>
      <p>
       Many of these values correspond to the
       <code class="literal">
        COM_
        <em class="replaceable">
         <code>
          xxx
         </code>
        </em>
       </code>
       command values listed in the
       <code class="filename">
        my_command.h
       </code>
       header file. For
              example,
       <code class="literal">
        Create DB
       </code>
       and
       <code class="literal">
        Change
              user
       </code>
       correspond to
       <code class="literal">
        COM_CREATE_DB
       </code>
       and
       <code class="literal">
        COM_CHANGE_USER
       </code>
       , respectively.
      </p>
      <p>
       Events having
       <code class="literal">
        &lt;NAME&gt;
       </code>
       values of
       <code class="literal">
        Table
        <em class="replaceable">
         <code>
          XXX
         </code>
        </em>
       </code>
       accompany
       <code class="literal">
        Query
       </code>
       events. For example,
              the following statement generates one
       <code class="literal">
        Query
       </code>
       event, two
       <code class="literal">
        TableRead
       </code>
       events, and a
       <code class="literal">
        TableInsert
       </code>
       events:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-xml"><div class="docs-select-all right" id="sa82660133"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-xml">INSERT INTO t3 SELECT t1.* FROM t1 JOIN t2;</code></pre>
      </div>
      <p>
       Each
       <code class="literal">
        Table
        <em class="replaceable">
         <code>
          XXX
         </code>
        </em>
       </code>
       event contains
       <code class="literal">
        &lt;TABLE&gt;
       </code>
       and
       <code class="literal">
        &lt;DB&gt;
       </code>
       elements to identify the
              table to which the event refers and the database that
              contains the table.
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        &lt;RECORD_ID&gt;
       </code>
      </p>
      <p>
       A unique identifier for the audit record. The value is
              composed from a sequence number and timestamp, in the
              format
       <code class="literal">
        <em class="replaceable">
         <code>
          SEQ_TIMESTAMP
         </code>
        </em>
       </code>
       .
              When the audit log plugin opens the audit log file, it
              initializes the sequence number to the size of the audit
              log file, then increments the sequence by 1 for each
              record logged. The timestamp is a UTC value in
       <code class="literal">
        <em class="replaceable">
         <code>
          YYYY-MM-DD
         </code>
        </em>
        T
        <em class="replaceable">
         <code>
          hh:mm:ss
         </code>
        </em>
       </code>
       format indicating the date and time when the audit log
              plugin opened the file.
      </p>
      <p>
       Example:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-xml"><div class="docs-select-all right" id="sa20907879"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-xml"><span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>RECORD_ID</span><span class="token punctuation">&gt;</span></span>12_2019-10-03T14:06:33<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>RECORD_ID</span><span class="token punctuation">&gt;</span></span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        &lt;TIMESTAMP&gt;
       </code>
      </p>
      <p>
       A string representing a UTC value in
       <code class="literal">
        <em class="replaceable">
         <code>
          YYYY-MM-DD
         </code>
        </em>
        T
        <em class="replaceable">
         <code>
          hh:mm:ss
         </code>
        </em>
        UTC
       </code>
       format indicating the date and time when the
              audit event was generated. For example, the event
              corresponding to execution of an SQL statement received
              from a client has a
       <code class="literal">
        &lt;TIMESTAMP&gt;
       </code>
       value occurring after the statement finishes, not when it
              was received.
      </p>
      <p>
       Example:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-xml"><div class="docs-select-all right" id="sa70062856"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-xml"><span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>TIMESTAMP</span><span class="token punctuation">&gt;</span></span>2019-10-03T14:09:45 UTC<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>TIMESTAMP</span><span class="token punctuation">&gt;</span></span></code></pre>
      </div>
     </li>
    </ul>
   </div>
   <p>
    The following elements are optional in
    <code class="literal">
     &lt;AUDIT_RECORD&gt;
    </code>
    elements. Many of them
          occur only with specific
    <code class="literal">
     &lt;NAME&gt;
    </code>
    element values.
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       <code class="literal">
        &lt;COMMAND_CLASS&gt;
       </code>
      </p>
      <p>
       A string that indicates the type of action performed.
      </p>
      <p>
       Example:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-xml"><div class="docs-select-all right" id="sa57253255"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-xml"><span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>COMMAND_CLASS</span><span class="token punctuation">&gt;</span></span>drop_table<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>COMMAND_CLASS</span><span class="token punctuation">&gt;</span></span></code></pre>
      </div>
      <p>
       The values correspond to the
       <code class="literal">
        statement/sql/
        <em class="replaceable">
         <code>
          xxx
         </code>
        </em>
       </code>
       command counters. For example,
       <em class="replaceable">
        <code>
         xxx
        </code>
       </em>
       is
       <code class="literal">
        drop_table
       </code>
       and
       <code class="literal">
        select
       </code>
       for
       <a class="link" href="drop-table.html" title="15.1.32 DROP TABLE Statement">
        <code class="literal">
         DROP
              TABLE
        </code>
       </a>
       and
       <a class="link" href="select.html" title="15.2.13 SELECT Statement">
        <code class="literal">
         SELECT
        </code>
       </a>
       statements, respectively. The following statement displays
              the possible names:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa32452577"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">SELECT</span> <span class="token function">REPLACE</span><span class="token punctuation">(</span>EVENT_NAME<span class="token punctuation">,</span> <span class="token string">'statement/sql/'</span><span class="token punctuation">,</span> <span class="token string">''</span><span class="token punctuation">)</span> <span class="token keyword">AS</span> <span class="token keyword">name</span>
<span class="token keyword">FROM</span> performance_schema<span class="token punctuation">.</span>events_statements_summary_global_by_event_name
<span class="token keyword">WHERE</span> EVENT_NAME <span class="token operator">LIKE</span> <span class="token string">'statement/sql/%'</span>
<span class="token keyword">ORDER</span> <span class="token keyword">BY</span> <span class="token keyword">name</span><span class="token punctuation">;</span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        &lt;CONNECTION_ATTRIBUTES&gt;
       </code>
      </p>
      <p>
       Events with a
       <code class="literal">
        &lt;COMMAND_CLASS&gt;
       </code>
       value of
       <code class="literal">
        connect
       </code>
       may include a
       <code class="literal">
        &lt;CONNECTION_ATTRIBUTES&gt;
       </code>
       element
              to display the connection attributes passed by the client
              at connect time. (For information about these attributes,
              which are also exposed in Performance Schema tables, see
       <a class="xref" href="performance-schema-connection-attribute-tables.html" title="29.12.9 Performance Schema Connection Attribute Tables">
        Section 29.12.9, “Performance Schema Connection Attribute Tables”
       </a>
       .)
      </p>
      <p>
       The
       <code class="literal">
        &lt;CONNECTION_ATTRIBUTES&gt;
       </code>
       element contains one
       <code class="literal">
        &lt;ATTRIBUTE&gt;
       </code>
       element per attribute, each of which contains
       <code class="literal">
        &lt;NAME&gt;
       </code>
       and
       <code class="literal">
        &lt;VALUE&gt;
       </code>
       elements to indicate the
              attribute name and value, respectively.
      </p>
      <p>
       Example:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-xml"><div class="docs-select-all right" id="sa5745934"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-xml"><span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>CONNECTION_ATTRIBUTES</span><span class="token punctuation">&gt;</span></span>
 <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>ATTRIBUTE</span><span class="token punctuation">&gt;</span></span>
  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>NAME</span><span class="token punctuation">&gt;</span></span>_pid<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>NAME</span><span class="token punctuation">&gt;</span></span>
  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>VALUE</span><span class="token punctuation">&gt;</span></span>42794<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>VALUE</span><span class="token punctuation">&gt;</span></span>
 <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>ATTRIBUTE</span><span class="token punctuation">&gt;</span></span>
 <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>ATTRIBUTE</span><span class="token punctuation">&gt;</span></span>
  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>NAME</span><span class="token punctuation">&gt;</span></span>_os<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>NAME</span><span class="token punctuation">&gt;</span></span>
  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>VALUE</span><span class="token punctuation">&gt;</span></span>macos0.14<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>VALUE</span><span class="token punctuation">&gt;</span></span>
 <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>ATTRIBUTE</span><span class="token punctuation">&gt;</span></span>
 <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>ATTRIBUTE</span><span class="token punctuation">&gt;</span></span>
  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>NAME</span><span class="token punctuation">&gt;</span></span>_platform<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>NAME</span><span class="token punctuation">&gt;</span></span>
  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>VALUE</span><span class="token punctuation">&gt;</span></span>x86_64<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>VALUE</span><span class="token punctuation">&gt;</span></span>
 <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>ATTRIBUTE</span><span class="token punctuation">&gt;</span></span>
 <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>ATTRIBUTE</span><span class="token punctuation">&gt;</span></span>
  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>NAME</span><span class="token punctuation">&gt;</span></span>_client_version<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>NAME</span><span class="token punctuation">&gt;</span></span>
  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>VALUE</span><span class="token punctuation">&gt;</span></span>8.4.0<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>VALUE</span><span class="token punctuation">&gt;</span></span>
 <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>ATTRIBUTE</span><span class="token punctuation">&gt;</span></span>
 <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>ATTRIBUTE</span><span class="token punctuation">&gt;</span></span>
  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>NAME</span><span class="token punctuation">&gt;</span></span>_client_name<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>NAME</span><span class="token punctuation">&gt;</span></span>
  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>VALUE</span><span class="token punctuation">&gt;</span></span>libmysql<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>VALUE</span><span class="token punctuation">&gt;</span></span>
 <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>ATTRIBUTE</span><span class="token punctuation">&gt;</span></span>
 <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>ATTRIBUTE</span><span class="token punctuation">&gt;</span></span>
  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>NAME</span><span class="token punctuation">&gt;</span></span>program_name<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>NAME</span><span class="token punctuation">&gt;</span></span>
  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>VALUE</span><span class="token punctuation">&gt;</span></span>mysqladmin<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>VALUE</span><span class="token punctuation">&gt;</span></span>
 <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>ATTRIBUTE</span><span class="token punctuation">&gt;</span></span>
<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>CONNECTION_ATTRIBUTES</span><span class="token punctuation">&gt;</span></span></code></pre>
      </div>
      <p>
       If no connection attributes are present in the event, none
              are logged and no
       <code class="literal">
        &lt;CONNECTION_ATTRIBUTES&gt;
       </code>
       element
              appears. This can occur if the connection attempt is
              unsuccessful, the client passes no attributes, or the
              connection occurs internally such as during server startup
              or when initiated by a plugin.
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        &lt;CONNECTION_ID&gt;
       </code>
      </p>
      <p>
       An unsigned integer representing the client connection
              identifier. This is the same as the value returned by the
       <a class="link" href="information-functions.html#function_connection-id">
        <code class="literal">
         CONNECTION_ID()
        </code>
       </a>
       function
              within the session.
      </p>
      <p>
       Example:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-xml"><div class="docs-select-all right" id="sa46439710"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-xml"><span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>CONNECTION_ID</span><span class="token punctuation">&gt;</span></span>127<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>CONNECTION_ID</span><span class="token punctuation">&gt;</span></span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        &lt;CONNECTION_TYPE&gt;
       </code>
      </p>
      <p>
       The security state of the connection to the server.
              Permitted values are
       <code class="literal">
        TCP/IP
       </code>
       (TCP/IP
              connection established without encryption),
       <code class="literal">
        SSL/TLS
       </code>
       (TCP/IP connection established
              with encryption),
       <code class="literal">
        Socket
       </code>
       (Unix socket
              file connection),
       <code class="literal">
        Named Pipe
       </code>
       (Windows
              named pipe connection), and
       <code class="literal">
        Shared
              Memory
       </code>
       (Windows shared memory connection).
      </p>
      <p>
       Example:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-xml"><div class="docs-select-all right" id="sa77407477"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-xml"><span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>CONNECTION_TYPE</span><span class="token punctuation">&gt;</span></span>SSL/TLS<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>CONNECTION_TYPE</span><span class="token punctuation">&gt;</span></span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        &lt;DB&gt;
       </code>
      </p>
      <p>
       A string representing a database name.
      </p>
      <p>
       Example:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-xml"><div class="docs-select-all right" id="sa28953231"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-xml"><span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>DB</span><span class="token punctuation">&gt;</span></span>test<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>DB</span><span class="token punctuation">&gt;</span></span></code></pre>
      </div>
      <p>
       For connect events, this element indicates the default
              database; the element is empty if there is no default
              database. For table-access events, the element indicates
              the database to which the accessed table belongs.
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        &lt;HOST&gt;
       </code>
      </p>
      <p>
       A string representing the client host name.
      </p>
      <p>
       Example:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-xml"><div class="docs-select-all right" id="sa34898375"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-xml"><span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>HOST</span><span class="token punctuation">&gt;</span></span>localhost<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>HOST</span><span class="token punctuation">&gt;</span></span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        &lt;IP&gt;
       </code>
      </p>
      <p>
       A string representing the client IP address.
      </p>
      <p>
       Example:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-xml"><div class="docs-select-all right" id="sa42025000"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-xml"><span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>IP</span><span class="token punctuation">&gt;</span></span>127.0.0.1<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>IP</span><span class="token punctuation">&gt;</span></span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        &lt;MYSQL_VERSION&gt;
       </code>
      </p>
      <p>
       A string representing the MySQL server version. This is
              the same as the value of the
       <a class="link" href="information-functions.html#function_version">
        <code class="literal">
         VERSION()
        </code>
       </a>
       function or
       <a class="link" href="server-system-variables.html#sysvar_version">
        <code class="literal">
         version
        </code>
       </a>
       system variable.
      </p>
      <p>
       Example:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-xml"><div class="docs-select-all right" id="sa19952882"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-xml"><span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>MYSQL_VERSION</span><span class="token punctuation">&gt;</span></span>5.7.21-log<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>MYSQL_VERSION</span><span class="token punctuation">&gt;</span></span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        &lt;OS_LOGIN&gt;
       </code>
      </p>
      <p>
       A string representing the external user name used during
              the authentication process, as set by the plugin used to
              authenticate the client. With native (built-in) MySQL
              authentication, or if the plugin does not set the value,
              this element is empty. The value is the same as that of
              the
       <a class="link" href="server-system-variables.html#sysvar_external_user">
        <code class="literal">
         external_user
        </code>
       </a>
       system
              variable (see
       <a class="xref" href="proxy-users.html" title="8.2.19 Proxy Users">
        Section 8.2.19, “Proxy Users”
       </a>
       ).
      </p>
      <p>
       Example:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-xml"><div class="docs-select-all right" id="sa49139120"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-xml"><span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>OS_LOGIN</span><span class="token punctuation">&gt;</span></span>jeffrey<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>OS_LOGIN</span><span class="token punctuation">&gt;</span></span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        &lt;OS_VERSION&gt;
       </code>
      </p>
      <p>
       A string representing the operating system on which the
              server was built or is running.
      </p>
      <p>
       Example:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-xml"><div class="docs-select-all right" id="sa55636284"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-xml"><span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>OS_VERSION</span><span class="token punctuation">&gt;</span></span>x86_64-Linux<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>OS_VERSION</span><span class="token punctuation">&gt;</span></span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        &lt;PRIV_USER&gt;
       </code>
      </p>
      <p>
       A string representing the user that the server
              authenticated the client as. This is the user name that
              the server uses for privilege checking, and may differ
              from the
       <code class="literal">
        &lt;USER&gt;
       </code>
       value.
      </p>
      <p>
       Example:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-xml"><div class="docs-select-all right" id="sa10696923"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-xml"><span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>PRIV_USER</span><span class="token punctuation">&gt;</span></span>jeffrey<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>PRIV_USER</span><span class="token punctuation">&gt;</span></span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        &lt;PROXY_USER&gt;
       </code>
      </p>
      <p>
       A string representing the proxy user (see
       <a class="xref" href="proxy-users.html" title="8.2.19 Proxy Users">
        Section 8.2.19, “Proxy Users”
       </a>
       ). The value is empty if user
              proxying is not in effect.
      </p>
      <p>
       Example:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-xml"><div class="docs-select-all right" id="sa19591829"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-xml"><span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>PROXY_USER</span><span class="token punctuation">&gt;</span></span>developer<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>PROXY_USER</span><span class="token punctuation">&gt;</span></span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        &lt;SERVER_ID&gt;
       </code>
      </p>
      <p>
       An unsigned integer representing the server ID. This is
              the same as the value of the
       <a class="link" href="replication-options.html#sysvar_server_id">
        <code class="literal">
         server_id
        </code>
       </a>
       system
              variable.
      </p>
      <p>
       Example:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-xml"><div class="docs-select-all right" id="sa4224159"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-xml"><span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>SERVER_ID</span><span class="token punctuation">&gt;</span></span>1<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>SERVER_ID</span><span class="token punctuation">&gt;</span></span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        &lt;SQLTEXT&gt;
       </code>
      </p>
      <p>
       A string representing the text of an SQL statement. The
              value can be empty. Long values may be truncated. The
              string, like the audit log file itself, is written using
              UTF-8 (up to 4 bytes per character), so the value may be
              the result of conversion. For example, the original
              statement might have been received from the client as an
              SJIS string.
      </p>
      <p>
       Example:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-xml"><div class="docs-select-all right" id="sa59606447"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-xml"><span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>SQLTEXT</span><span class="token punctuation">&gt;</span></span>DELETE FROM t1<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>SQLTEXT</span><span class="token punctuation">&gt;</span></span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        &lt;STARTUP_OPTIONS&gt;
       </code>
      </p>
      <p>
       A string representing the options that were given on the
              command line or in option files when the MySQL server was
              started. The first option is the path to the server
              executable.
      </p>
      <p>
       Example:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-xml"><div class="docs-select-all right" id="sa61756035"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-xml"><span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>STARTUP_OPTIONS</span><span class="token punctuation">&gt;</span></span>/usr/local/mysql/bin/mysqld
  --port=3306 --log_output=FILE<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>STARTUP_OPTIONS</span><span class="token punctuation">&gt;</span></span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        &lt;STATUS&gt;
       </code>
      </p>
      <p>
       An unsigned integer representing the command status: 0 for
              success, nonzero if an error occurred. This is the same as
              the value of the
       <a class="ulink" href="/doc/c-api/8.4/en/mysql-errno.html" target="_top">
        <code class="literal">
         mysql_errno()
        </code>
       </a>
       C API
              function. See the description for
       <code class="literal">
        &lt;STATUS_CODE&gt;
       </code>
       for information
              about how it differs from
       <code class="literal">
        &lt;STATUS&gt;
       </code>
       .
      </p>
      <p>
       The audit log does not contain the SQLSTATE value or error
              message. To see the associations between error codes,
              SQLSTATE values, and messages, see
       <a class="ulink" href="/doc/mysql-errors/8.4/en/server-error-reference.html" target="_top">
        Server Error Message Reference
       </a>
       .
      </p>
      <p>
       Warnings are not logged.
      </p>
      <p>
       Example:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-xml"><div class="docs-select-all right" id="sa52964813"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-xml"><span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>STATUS</span><span class="token punctuation">&gt;</span></span>1051<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>STATUS</span><span class="token punctuation">&gt;</span></span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        &lt;STATUS_CODE&gt;
       </code>
      </p>
      <p>
       An unsigned integer representing the command status: 0 for
              success, 1 if an error occurred.
      </p>
      <p>
       The
       <code class="literal">
        STATUS_CODE
       </code>
       value differs from the
       <code class="literal">
        STATUS
       </code>
       value:
       <code class="literal">
        STATUS_CODE
       </code>
       is 0 for success and 1 for
              error, which is compatible with the EZ_collector consumer
              for Audit Vault.
       <code class="literal">
        STATUS
       </code>
       is the value of
              the
       <a class="ulink" href="/doc/c-api/8.4/en/mysql-errno.html" target="_top">
        <code class="literal">
         mysql_errno()
        </code>
       </a>
       C API
              function. This is 0 for success and nonzero for error, and
              thus is not necessarily 1 for error.
      </p>
      <p>
       Example:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-xml"><div class="docs-select-all right" id="sa87985754"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-xml"><span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>STATUS_CODE</span><span class="token punctuation">&gt;</span></span>0<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>STATUS_CODE</span><span class="token punctuation">&gt;</span></span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        &lt;TABLE&gt;
       </code>
      </p>
      <p>
       A string representing a table name.
      </p>
      <p>
       Example:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-xml"><div class="docs-select-all right" id="sa24388473"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-xml"><span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>TABLE</span><span class="token punctuation">&gt;</span></span>t3<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>TABLE</span><span class="token punctuation">&gt;</span></span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        &lt;USER&gt;
       </code>
      </p>
      <p>
       A string representing the user name sent by the client.
              This may differ from the
       <code class="literal">
        &lt;PRIV_USER&gt;
       </code>
       value.
      </p>
      <p>
       Example:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-xml"><div class="docs-select-all right" id="sa77811755"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-xml"><span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>USER</span><span class="token punctuation">&gt;</span></span>root[root] @ localhost [127.0.0.1]<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>USER</span><span class="token punctuation">&gt;</span></span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        &lt;VERSION&gt;
       </code>
      </p>
      <p>
       An unsigned integer representing the version of the audit
              log file format.
      </p>
      <p>
       Example:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-xml"><div class="docs-select-all right" id="sa64856045"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-xml"><span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>VERSION</span><span class="token punctuation">&gt;</span></span>1<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>VERSION</span><span class="token punctuation">&gt;</span></span></code></pre>
      </div>
     </li>
    </ul>
   </div>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h5 class="title">
       <a name="audit-log-file-old-style-xml-format">
       </a>
       Old-Style XML Audit Log File Format
      </h5>
     </div>
    </div>
   </div>
   <p>
    Here is a sample log file in old-style XML format
          (
    <a class="link" href="audit-log-reference.html#sysvar_audit_log_format">
     <code class="literal">
      audit_log_format=OLD
     </code>
    </a>
    ),
          reformatted slightly for readability:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-xml"><div class="docs-select-all right" id="sa97326358"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-xml"><span class="token prolog">&lt;?xml version="1.0" encoding="utf-8"?&gt;</span>
<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>AUDIT</span><span class="token punctuation">&gt;</span></span>
  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>AUDIT_RECORD</span>
    <span class="token attr-name">TIMESTAMP</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>2019-10-03T14:25:00 UTC<span class="token punctuation">"</span></span>
    <span class="token attr-name">RECORD_ID</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>1_2019-10-03T14:25:00<span class="token punctuation">"</span></span>
    <span class="token attr-name">NAME</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>Audit<span class="token punctuation">"</span></span>
    <span class="token attr-name">SERVER_ID</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>1<span class="token punctuation">"</span></span>
    <span class="token attr-name">VERSION</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>1<span class="token punctuation">"</span></span>
    <span class="token attr-name">STARTUP_OPTIONS</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>--port<span class="token punctuation">=</span>3306<span class="token punctuation">"</span></span>
    <span class="token attr-name">OS_VERSION</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>i686-Linux<span class="token punctuation">"</span></span>
    <span class="token attr-name">MYSQL_VERSION</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>5.7.21-log<span class="token punctuation">"</span></span><span class="token punctuation">/&gt;</span></span>
  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>AUDIT_RECORD</span>
    <span class="token attr-name">TIMESTAMP</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>2019-10-03T14:25:24 UTC<span class="token punctuation">"</span></span>
    <span class="token attr-name">RECORD_ID</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>2_2019-10-03T14:25:00<span class="token punctuation">"</span></span>
    <span class="token attr-name">NAME</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>Connect<span class="token punctuation">"</span></span>
    <span class="token attr-name">CONNECTION_ID</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>4<span class="token punctuation">"</span></span>
    <span class="token attr-name">STATUS</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>0<span class="token punctuation">"</span></span>
    <span class="token attr-name">STATUS_CODE</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>0<span class="token punctuation">"</span></span>
    <span class="token attr-name">USER</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>root<span class="token punctuation">"</span></span>
    <span class="token attr-name">OS_LOGIN</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span><span class="token punctuation">"</span></span>
    <span class="token attr-name">HOST</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>localhost<span class="token punctuation">"</span></span>
    <span class="token attr-name">IP</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>127.0.0.1<span class="token punctuation">"</span></span>
    <span class="token attr-name">COMMAND_CLASS</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>connect<span class="token punctuation">"</span></span>
    <span class="token attr-name">CONNECTION_TYPE</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>SSL/TLS<span class="token punctuation">"</span></span>
    <span class="token attr-name">PRIV_USER</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>root<span class="token punctuation">"</span></span>
    <span class="token attr-name">PROXY_USER</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span><span class="token punctuation">"</span></span>
    <span class="token attr-name">DB</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>test<span class="token punctuation">"</span></span><span class="token punctuation">/&gt;</span></span>

...

  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>AUDIT_RECORD</span>
    <span class="token attr-name">TIMESTAMP</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>2019-10-03T14:25:24 UTC<span class="token punctuation">"</span></span>
    <span class="token attr-name">RECORD_ID</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>6_2019-10-03T14:25:00<span class="token punctuation">"</span></span>
    <span class="token attr-name">NAME</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>Query<span class="token punctuation">"</span></span>
    <span class="token attr-name">CONNECTION_ID</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>4<span class="token punctuation">"</span></span>
    <span class="token attr-name">STATUS</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>0<span class="token punctuation">"</span></span>
    <span class="token attr-name">STATUS_CODE</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>0<span class="token punctuation">"</span></span>
    <span class="token attr-name">USER</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>root[root] @ localhost [127.0.0.1]<span class="token punctuation">"</span></span>
    <span class="token attr-name">OS_LOGIN</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span><span class="token punctuation">"</span></span>
    <span class="token attr-name">HOST</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>localhost<span class="token punctuation">"</span></span>
    <span class="token attr-name">IP</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>127.0.0.1<span class="token punctuation">"</span></span>
    <span class="token attr-name">COMMAND_CLASS</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>drop_table<span class="token punctuation">"</span></span>
    <span class="token attr-name">SQLTEXT</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>DROP TABLE IF EXISTS t<span class="token punctuation">"</span></span><span class="token punctuation">/&gt;</span></span>

...

  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>AUDIT_RECORD</span>
    <span class="token attr-name">TIMESTAMP</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>2019-10-03T14:25:24 UTC<span class="token punctuation">"</span></span>
    <span class="token attr-name">RECORD_ID</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>8_2019-10-03T14:25:00<span class="token punctuation">"</span></span>
    <span class="token attr-name">NAME</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>Quit<span class="token punctuation">"</span></span>
    <span class="token attr-name">CONNECTION_ID</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>4<span class="token punctuation">"</span></span>
    <span class="token attr-name">STATUS</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>0<span class="token punctuation">"</span></span>
    <span class="token attr-name">STATUS_CODE</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>0<span class="token punctuation">"</span></span>
    <span class="token attr-name">USER</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>root<span class="token punctuation">"</span></span>
    <span class="token attr-name">OS_LOGIN</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span><span class="token punctuation">"</span></span>
    <span class="token attr-name">HOST</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>localhost<span class="token punctuation">"</span></span>
    <span class="token attr-name">IP</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>127.0.0.1<span class="token punctuation">"</span></span>
    <span class="token attr-name">COMMAND_CLASS</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>connect<span class="token punctuation">"</span></span>
    <span class="token attr-name">CONNECTION_TYPE</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>SSL/TLS<span class="token punctuation">"</span></span><span class="token punctuation">/&gt;</span></span>
  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>AUDIT_RECORD</span>
    <span class="token attr-name">TIMESTAMP</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>2019-10-03T14:25:32 UTC<span class="token punctuation">"</span></span>
    <span class="token attr-name">RECORD_ID</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>12_2019-10-03T14:25:00<span class="token punctuation">"</span></span>
    <span class="token attr-name">NAME</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>NoAudit<span class="token punctuation">"</span></span>
    <span class="token attr-name">SERVER_ID</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>1<span class="token punctuation">"</span></span><span class="token punctuation">/&gt;</span></span>
<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>AUDIT</span><span class="token punctuation">&gt;</span></span></code></pre>
   </div>
   <p>
    The audit log file is written as XML, using UTF-8 (up to 4
          bytes per character). The root element is
    <code class="literal">
     &lt;AUDIT&gt;
    </code>
    . The root element contains
    <code class="literal">
     &lt;AUDIT_RECORD&gt;
    </code>
    elements, each of
          which provides information about an audited event. When the
          audit log plugin begins writing a new log file, it writes the
          XML declaration and opening
    <code class="literal">
     &lt;AUDIT&gt;
    </code>
    root element tag. When the plugin closes a log file, it writes
          the closing
    <code class="literal">
     &lt;/AUDIT&gt;
    </code>
    root element
          tag. The closing tag is not present while the file is open.
   </p>
   <p>
    Attributes of
    <code class="literal">
     &lt;AUDIT_RECORD&gt;
    </code>
    elements
          have these characteristics:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       Some attributes appear in every
       <code class="literal">
        &lt;AUDIT_RECORD&gt;
       </code>
       element. Others
              are optional and may appear depending on the audit record
              type.
      </p>
     </li>
     <li class="listitem">
      <p>
       Order of attributes within an
       <code class="literal">
        &lt;AUDIT_RECORD&gt;
       </code>
       element is not
              guaranteed.
      </p>
     </li>
     <li class="listitem">
      <p>
       Attribute values are not fixed length. Long values may be
              truncated as indicated in the attribute descriptions given
              later.
      </p>
     </li>
     <li class="listitem">
      <p>
       The
       <code class="literal">
        &lt;
       </code>
       ,
       <code class="literal">
        &gt;
       </code>
       ,
       <code class="literal">
        "
       </code>
       , and
       <code class="literal">
        &amp;
       </code>
       characters are encoded as
       <code class="literal">
        &amp;lt;
       </code>
       ,
       <code class="literal">
        &amp;gt;
       </code>
       ,
       <code class="literal">
        &amp;quot;
       </code>
       , and
       <code class="literal">
        &amp;amp;
       </code>
       , respectively. NUL bytes
              (U+00) are encoded as the
       <code class="literal">
        ?
       </code>
       character.
      </p>
     </li>
     <li class="listitem">
      <p>
       Characters not valid as XML characters are encoded using
              numeric character references. Valid XML characters are:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-none"><div class="docs-select-all right" id="sa68474817"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-none">#x9 | #xA | #xD | [#x20-#xD7FF] | [#xE000-#xFFFD] | [#x10000-#x10FFFF]</code></pre>
      </div>
     </li>
    </ul>
   </div>
   <p>
    The following attributes are mandatory in every
    <code class="literal">
     &lt;AUDIT_RECORD&gt;
    </code>
    element:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       <code class="literal">
        NAME
       </code>
      </p>
      <p>
       A string representing the type of instruction that
              generated the audit event, such as a command that the
              server received from a client.
      </p>
      <p>
       Example:
       <code class="literal">
        NAME="Query"
       </code>
      </p>
      <p>
       Some common
       <code class="literal">
        NAME
       </code>
       values:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-none"><div class="docs-select-all right" id="sa3261619"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-none">Audit    When auditing starts, which may be server startup time
Connect  When a client connects, also known as logging in
Query    An SQL statement (executed directly)
Prepare  Preparation of an SQL statement; usually followed by Execute
Execute  Execution of an SQL statement; usually follows Prepare
Shutdown Server shutdown
Quit     When a client disconnects
NoAudit  Auditing has been turned off</code></pre>
      </div>
      <p>
       The possible values are
       <code class="literal">
        Audit
       </code>
       ,
       <code class="literal">
        Binlog Dump
       </code>
       ,
       <code class="literal">
        Change
              user
       </code>
       ,
       <code class="literal">
        Close stmt
       </code>
       ,
       <code class="literal">
        Connect Out
       </code>
       ,
       <code class="literal">
        Connect
       </code>
       ,
       <code class="literal">
        Create DB
       </code>
       ,
       <code class="literal">
        Daemon
       </code>
       ,
       <code class="literal">
        Debug
       </code>
       ,
       <code class="literal">
        Delayed insert
       </code>
       ,
       <code class="literal">
        Drop
              DB
       </code>
       ,
       <code class="literal">
        Execute
       </code>
       ,
       <code class="literal">
        Fetch
       </code>
       ,
       <code class="literal">
        Field List
       </code>
       ,
       <code class="literal">
        Init DB
       </code>
       ,
       <code class="literal">
        Kill
       </code>
       ,
       <code class="literal">
        Long Data
       </code>
       ,
       <code class="literal">
        NoAudit
       </code>
       ,
       <code class="literal">
        Ping
       </code>
       ,
       <code class="literal">
        Prepare
       </code>
       ,
       <code class="literal">
        Processlist
       </code>
       ,
       <code class="literal">
        Query
       </code>
       ,
       <code class="literal">
        Quit
       </code>
       ,
       <code class="literal">
        Refresh
       </code>
       ,
       <code class="literal">
        Register Slave
       </code>
       ,
       <code class="literal">
        Reset
              stmt
       </code>
       ,
       <code class="literal">
        Set option
       </code>
       ,
       <code class="literal">
        Shutdown
       </code>
       ,
       <code class="literal">
        Sleep
       </code>
       ,
       <code class="literal">
        Statistics
       </code>
       ,
       <code class="literal">
        Table
              Dump
       </code>
       ,
       <code class="literal">
        TableDelete
       </code>
       ,
       <code class="literal">
        TableInsert
       </code>
       ,
       <code class="literal">
        TableRead
       </code>
       ,
       <code class="literal">
        TableUpdate
       </code>
       ,
       <code class="literal">
        Time
       </code>
       .
      </p>
      <p>
       Many of these values correspond to the
       <code class="literal">
        COM_
        <em class="replaceable">
         <code>
          xxx
         </code>
        </em>
       </code>
       command values listed in the
       <code class="filename">
        my_command.h
       </code>
       header file. For
              example,
       <code class="literal">
        "Create DB"
       </code>
       and
       <code class="literal">
        "Change user"
       </code>
       correspond to
       <code class="literal">
        COM_CREATE_DB
       </code>
       and
       <code class="literal">
        COM_CHANGE_USER
       </code>
       , respectively.
      </p>
      <p>
       Events having
       <code class="literal">
        NAME
       </code>
       values of
       <code class="literal">
        Table
        <em class="replaceable">
         <code>
          XXX
         </code>
        </em>
       </code>
       accompany
       <code class="literal">
        Query
       </code>
       events. For example,
              the following statement generates one
       <code class="literal">
        Query
       </code>
       event, two
       <code class="literal">
        TableRead
       </code>
       events, and a
       <code class="literal">
        TableInsert
       </code>
       events:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-xml"><div class="docs-select-all right" id="sa92660872"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-xml">INSERT INTO t3 SELECT t1.* FROM t1 JOIN t2;</code></pre>
      </div>
      <p>
       Each
       <code class="literal">
        Table
        <em class="replaceable">
         <code>
          XXX
         </code>
        </em>
       </code>
       event has
       <code class="literal">
        TABLE
       </code>
       and
       <code class="literal">
        DB
       </code>
       attributes to identify the table to
              which the event refers and the database that contains the
              table.
      </p>
      <p>
       <code class="literal">
        Connect
       </code>
       events for old-style XML audit
              log format do not include connection attributes.
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        RECORD_ID
       </code>
      </p>
      <p>
       A unique identifier for the audit record. The value is
              composed from a sequence number and timestamp, in the
              format
       <code class="literal">
        <em class="replaceable">
         <code>
          SEQ_TIMESTAMP
         </code>
        </em>
       </code>
       .
              When the audit log plugin opens the audit log file, it
              initializes the sequence number to the size of the audit
              log file, then increments the sequence by 1 for each
              record logged. The timestamp is a UTC value in
       <code class="literal">
        <em class="replaceable">
         <code>
          YYYY-MM-DD
         </code>
        </em>
        T
        <em class="replaceable">
         <code>
          hh:mm:ss
         </code>
        </em>
       </code>
       format indicating the date and time when the audit log
              plugin opened the file.
      </p>
      <p>
       Example:
       <code class="literal">
        RECORD_ID="12_2019-10-03T14:25:00"
       </code>
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        TIMESTAMP
       </code>
      </p>
      <p>
       A string representing a UTC value in
       <code class="literal">
        <em class="replaceable">
         <code>
          YYYY-MM-DD
         </code>
        </em>
        T
        <em class="replaceable">
         <code>
          hh:mm:ss
         </code>
        </em>
        UTC
       </code>
       format indicating the date and time when the
              audit event was generated. For example, the event
              corresponding to execution of an SQL statement received
              from a client has a
       <code class="literal">
        TIMESTAMP
       </code>
       value
              occurring after the statement finishes, not when it was
              received.
      </p>
      <p>
       Example:
       <code class="literal">
        TIMESTAMP="2019-10-03T14:25:32
              UTC"
       </code>
      </p>
     </li>
    </ul>
   </div>
   <p>
    The following attributes are optional in
    <code class="literal">
     &lt;AUDIT_RECORD&gt;
    </code>
    elements. Many of them
          occur only for elements with specific values of the
    <code class="literal">
     NAME
    </code>
    attribute.
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       <code class="literal">
        COMMAND_CLASS
       </code>
      </p>
      <p>
       A string that indicates the type of action performed.
      </p>
      <p>
       Example:
       <code class="literal">
        COMMAND_CLASS="drop_table"
       </code>
      </p>
      <p>
       The values correspond to the
       <code class="literal">
        statement/sql/
        <em class="replaceable">
         <code>
          xxx
         </code>
        </em>
       </code>
       command counters. For example,
       <em class="replaceable">
        <code>
         xxx
        </code>
       </em>
       is
       <code class="literal">
        drop_table
       </code>
       and
       <code class="literal">
        select
       </code>
       for
       <a class="link" href="drop-table.html" title="15.1.32 DROP TABLE Statement">
        <code class="literal">
         DROP
              TABLE
        </code>
       </a>
       and
       <a class="link" href="select.html" title="15.2.13 SELECT Statement">
        <code class="literal">
         SELECT
        </code>
       </a>
       statements, respectively. The following statement displays
              the possible names:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa8936131"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">SELECT</span> <span class="token function">REPLACE</span><span class="token punctuation">(</span>EVENT_NAME<span class="token punctuation">,</span> <span class="token string">'statement/sql/'</span><span class="token punctuation">,</span> <span class="token string">''</span><span class="token punctuation">)</span> <span class="token keyword">AS</span> <span class="token keyword">name</span>
<span class="token keyword">FROM</span> performance_schema<span class="token punctuation">.</span>events_statements_summary_global_by_event_name
<span class="token keyword">WHERE</span> EVENT_NAME <span class="token operator">LIKE</span> <span class="token string">'statement/sql/%'</span>
<span class="token keyword">ORDER</span> <span class="token keyword">BY</span> <span class="token keyword">name</span><span class="token punctuation">;</span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        CONNECTION_ID
       </code>
      </p>
      <p>
       An unsigned integer representing the client connection
              identifier. This is the same as the value returned by the
       <a class="link" href="information-functions.html#function_connection-id">
        <code class="literal">
         CONNECTION_ID()
        </code>
       </a>
       function
              within the session.
      </p>
      <p>
       Example:
       <code class="literal">
        CONNECTION_ID="127"
       </code>
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        CONNECTION_TYPE
       </code>
      </p>
      <p>
       The security state of the connection to the server.
              Permitted values are
       <code class="literal">
        TCP/IP
       </code>
       (TCP/IP
              connection established without encryption),
       <code class="literal">
        SSL/TLS
       </code>
       (TCP/IP connection established
              with encryption),
       <code class="literal">
        Socket
       </code>
       (Unix socket
              file connection),
       <code class="literal">
        Named Pipe
       </code>
       (Windows
              named pipe connection), and
       <code class="literal">
        Shared
              Memory
       </code>
       (Windows shared memory connection).
      </p>
      <p>
       Example:
       <code class="literal">
        CONNECTION_TYPE="SSL/TLS"
       </code>
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        DB
       </code>
      </p>
      <p>
       A string representing a database name.
      </p>
      <p>
       Example:
       <code class="literal">
        DB="test"
       </code>
      </p>
      <p>
       For connect events, this attribute indicates the default
              database; the attribute is empty if there is no default
              database. For table-access events, the attribute indicates
              the database to which the accessed table belongs.
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        HOST
       </code>
      </p>
      <p>
       A string representing the client host name.
      </p>
      <p>
       Example:
       <code class="literal">
        HOST="localhost"
       </code>
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        IP
       </code>
      </p>
      <p>
       A string representing the client IP address.
      </p>
      <p>
       Example:
       <code class="literal">
        IP="127.0.0.1"
       </code>
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        MYSQL_VERSION
       </code>
      </p>
      <p>
       A string representing the MySQL server version. This is
              the same as the value of the
       <a class="link" href="information-functions.html#function_version">
        <code class="literal">
         VERSION()
        </code>
       </a>
       function or
       <a class="link" href="server-system-variables.html#sysvar_version">
        <code class="literal">
         version
        </code>
       </a>
       system variable.
      </p>
      <p>
       Example:
       <code class="literal">
        MYSQL_VERSION="5.7.21-log"
       </code>
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        OS_LOGIN
       </code>
      </p>
      <p>
       A string representing the external user name used during
              the authentication process, as set by the plugin used to
              authenticate the client. With native (built-in) MySQL
              authentication, or if the plugin does not set the value,
              this attribute is empty. The value is the same as that of
              the
       <a class="link" href="server-system-variables.html#sysvar_external_user">
        <code class="literal">
         external_user
        </code>
       </a>
       system
              variable (see
       <a class="xref" href="proxy-users.html" title="8.2.19 Proxy Users">
        Section 8.2.19, “Proxy Users”
       </a>
       ).
      </p>
      <p>
       Example:
       <code class="literal">
        OS_LOGIN="jeffrey"
       </code>
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        OS_VERSION
       </code>
      </p>
      <p>
       A string representing the operating system on which the
              server was built or is running.
      </p>
      <p>
       Example:
       <code class="literal">
        OS_VERSION="x86_64-Linux"
       </code>
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        PRIV_USER
       </code>
      </p>
      <p>
       A string representing the user that the server
              authenticated the client as. This is the user name that
              the server uses for privilege checking, and it may differ
              from the
       <code class="literal">
        USER
       </code>
       value.
      </p>
      <p>
       Example:
       <code class="literal">
        PRIV_USER="jeffrey"
       </code>
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        PROXY_USER
       </code>
      </p>
      <p>
       A string representing the proxy user (see
       <a class="xref" href="proxy-users.html" title="8.2.19 Proxy Users">
        Section 8.2.19, “Proxy Users”
       </a>
       ). The value is empty if user
              proxying is not in effect.
      </p>
      <p>
       Example:
       <code class="literal">
        PROXY_USER="developer"
       </code>
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        SERVER_ID
       </code>
      </p>
      <p>
       An unsigned integer representing the server ID. This is
              the same as the value of the
       <a class="link" href="replication-options.html#sysvar_server_id">
        <code class="literal">
         server_id
        </code>
       </a>
       system
              variable.
      </p>
      <p>
       Example:
       <code class="literal">
        SERVER_ID="1"
       </code>
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        SQLTEXT
       </code>
      </p>
      <p>
       A string representing the text of an SQL statement. The
              value can be empty. Long values may be truncated. The
              string, like the audit log file itself, is written using
              UTF-8 (up to 4 bytes per character), so the value may be
              the result of conversion. For example, the original
              statement might have been received from the client as an
              SJIS string.
      </p>
      <p>
       Example:
       <code class="literal">
        SQLTEXT="DELETE FROM t1"
       </code>
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        STARTUP_OPTIONS
       </code>
      </p>
      <p>
       A string representing the options that were given on the
              command line or in option files when the MySQL server was
              started.
      </p>
      <p>
       Example:
       <code class="literal">
        STARTUP_OPTIONS="--port=3306
              --log_output=FILE"
       </code>
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        STATUS
       </code>
      </p>
      <p>
       An unsigned integer representing the command status: 0 for
              success, nonzero if an error occurred. This is the same as
              the value of the
       <a class="ulink" href="/doc/c-api/8.4/en/mysql-errno.html" target="_top">
        <code class="literal">
         mysql_errno()
        </code>
       </a>
       C API
              function. See the description for
       <code class="literal">
        STATUS_CODE
       </code>
       for information about how
              it differs from
       <code class="literal">
        STATUS
       </code>
       .
      </p>
      <p>
       The audit log does not contain the SQLSTATE value or error
              message. To see the associations between error codes,
              SQLSTATE values, and messages, see
       <a class="ulink" href="/doc/mysql-errors/8.4/en/server-error-reference.html" target="_top">
        Server Error Message Reference
       </a>
       .
      </p>
      <p>
       Warnings are not logged.
      </p>
      <p>
       Example:
       <code class="literal">
        STATUS="1051"
       </code>
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        STATUS_CODE
       </code>
      </p>
      <p>
       An unsigned integer representing the command status: 0 for
              success, 1 if an error occurred.
      </p>
      <p>
       The
       <code class="literal">
        STATUS_CODE
       </code>
       value differs from the
       <code class="literal">
        STATUS
       </code>
       value:
       <code class="literal">
        STATUS_CODE
       </code>
       is 0 for success and 1 for
              error, which is compatible with the EZ_collector consumer
              for Audit Vault.
       <code class="literal">
        STATUS
       </code>
       is the value of
              the
       <a class="ulink" href="/doc/c-api/8.4/en/mysql-errno.html" target="_top">
        <code class="literal">
         mysql_errno()
        </code>
       </a>
       C API
              function. This is 0 for success and nonzero for error, and
              thus is not necessarily 1 for error.
      </p>
      <p>
       Example:
       <code class="literal">
        STATUS_CODE="0"
       </code>
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        TABLE
       </code>
      </p>
      <p>
       A string representing a table name.
      </p>
      <p>
       Example:
       <code class="literal">
        TABLE="t3"
       </code>
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        USER
       </code>
      </p>
      <p>
       A string representing the user name sent by the client.
              This may differ from the
       <code class="literal">
        PRIV_USER
       </code>
       value.
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        VERSION
       </code>
      </p>
      <p>
       An unsigned integer representing the version of the audit
              log file format.
      </p>
      <p>
       Example:
       <code class="literal">
        VERSION="1"
       </code>
      </p>
     </li>
    </ul>
   </div>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h5 class="title">
       <a name="audit-log-file-json-format">
       </a>
       JSON Audit Log File Format
      </h5>
     </div>
    </div>
   </div>
   <p>
    For JSON-format audit logging
          (
    <a class="link" href="audit-log-reference.html#sysvar_audit_log_format">
     <code class="literal">
      audit_log_format=JSON
     </code>
    </a>
    ), the
          log file contents form a
    <a class="link" href="json.html" title="13.5 The JSON Data Type">
     <code class="literal">
      JSON
     </code>
    </a>
    array with each array element representing an audited event as
          a
    <a class="link" href="json.html" title="13.5 The JSON Data Type">
     <code class="literal">
      JSON
     </code>
    </a>
    hash of key-value pairs.
          Examples of complete event records appear later in this
          section. The following is an excerpt of partial events:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-json"><div class="docs-select-all right" id="sa58159893"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-json"><span class="token punctuation">[</span>
  <span class="token punctuation">{</span>
    <span class="token property">"timestamp"</span><span class="token operator">:</span> <span class="token string">"2019-10-03 13:50:01"</span><span class="token punctuation">,</span>
    <span class="token property">"id"</span><span class="token operator">:</span> <span class="token number">0</span><span class="token punctuation">,</span>
    <span class="token property">"class"</span><span class="token operator">:</span> <span class="token string">"audit"</span><span class="token punctuation">,</span>
    <span class="token property">"event"</span><span class="token operator">:</span> <span class="token string">"startup"</span><span class="token punctuation">,</span>
    ...
  <span class="token punctuation">}</span><span class="token punctuation">,</span>
  <span class="token punctuation">{</span>
    <span class="token property">"timestamp"</span><span class="token operator">:</span> <span class="token string">"2019-10-03 15:02:32"</span><span class="token punctuation">,</span>
    <span class="token property">"id"</span><span class="token operator">:</span> <span class="token number">0</span><span class="token punctuation">,</span>
    <span class="token property">"class"</span><span class="token operator">:</span> <span class="token string">"connection"</span><span class="token punctuation">,</span>
    <span class="token property">"event"</span><span class="token operator">:</span> <span class="token string">"connect"</span><span class="token punctuation">,</span>
    ...
  <span class="token punctuation">}</span><span class="token punctuation">,</span>
  ...
  <span class="token punctuation">{</span>
    <span class="token property">"timestamp"</span><span class="token operator">:</span> <span class="token string">"2019-10-03 17:37:26"</span><span class="token punctuation">,</span>
    <span class="token property">"id"</span><span class="token operator">:</span> <span class="token number">0</span><span class="token punctuation">,</span>
    <span class="token property">"class"</span><span class="token operator">:</span> <span class="token string">"table_access"</span><span class="token punctuation">,</span>
    <span class="token property">"event"</span><span class="token operator">:</span> <span class="token string">"insert"</span><span class="token punctuation">,</span>
      ...
  <span class="token punctuation">}</span>
  ...
<span class="token punctuation">]</span></code></pre>
   </div>
   <p>
    The audit log file is written using UTF-8 (up to 4 bytes per
          character). When the audit log plugin begins writing a new log
          file, it writes the opening
    <code class="literal">
     [
    </code>
    array marker.
          When the plugin closes a log file, it writes the closing
    <code class="literal">
     ]
    </code>
    array marker. The closing marker is not
          present while the file is open.
   </p>
   <p>
    Items within audit records have these characteristics:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       Some items appear in every audit record. Others are
              optional and may appear depending on the audit record
              type.
      </p>
     </li>
     <li class="listitem">
      <p>
       Order of items within an audit record is not guaranteed.
      </p>
     </li>
     <li class="listitem">
      <p>
       Item values are not fixed length. Long values may be
              truncated as indicated in the item descriptions given
              later.
      </p>
     </li>
     <li class="listitem">
      <p>
       The
       <code class="literal">
        "
       </code>
       and
       <code class="literal">
        \
       </code>
       characters are encoded as
       <code class="literal">
        \"
       </code>
       and
       <code class="literal">
        \\
       </code>
       , respectively.
      </p>
     </li>
    </ul>
   </div>
   <p>
    JSON format is the only audit log file format that supports
          the optional query time and size statistics. This data is
          available in the slow query log for qualifying queries, and in
          the context of the audit log it similarly helps to detect
          outliers for activity analysis.
   </p>
   <p>
    To add the query statistics to the log file, you must set them
          up as a filter using the
    <a class="link" href="audit-log-reference.html#function_audit-log-filter-set-filter">
     <code class="literal">
      audit_log_filter_set_filter()
     </code>
    </a>
    audit log function as the service element of the JSON
          filtering syntax. For instructions to do this, see
    <a class="xref" href="audit-log-logging-configuration.html#audit-log-query-statistics" title="Adding Query Statistics for Outlier Detection">
     Adding Query Statistics for Outlier Detection
    </a>
    . For the
    <code class="literal">
     bytes_sent
    </code>
    and
    <code class="literal">
     bytes_received
    </code>
    fields to be populated, the
          system variable
    <a class="link" href="server-system-variables.html#sysvar_log_slow_extra">
     <code class="literal">
      log_slow_extra
     </code>
    </a>
    must be set to
          ON.
   </p>
   <p>
    The following examples show the JSON object formats for
          different event types (as indicated by the
    <code class="literal">
     class
    </code>
    and
    <code class="literal">
     event
    </code>
    items),
          reformatted slightly for readability:
   </p>
   <p>
    Auditing startup event:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-json"><div class="docs-select-all right" id="sa6282170"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-json"><span class="token punctuation">{</span> <span class="token property">"timestamp"</span><span class="token operator">:</span> <span class="token string">"2019-10-03 14:21:56"</span><span class="token punctuation">,</span>
  <span class="token property">"id"</span><span class="token operator">:</span> <span class="token number">0</span><span class="token punctuation">,</span>
  <span class="token property">"class"</span><span class="token operator">:</span> <span class="token string">"audit"</span><span class="token punctuation">,</span>
  <span class="token property">"event"</span><span class="token operator">:</span> <span class="token string">"startup"</span><span class="token punctuation">,</span>
  <span class="token property">"connection_id"</span><span class="token operator">:</span> <span class="token number">0</span><span class="token punctuation">,</span>
  <span class="token property">"startup_data"</span><span class="token operator">:</span> <span class="token punctuation">{</span> <span class="token property">"server_id"</span><span class="token operator">:</span> <span class="token number">1</span><span class="token punctuation">,</span>
                    <span class="token property">"os_version"</span><span class="token operator">:</span> <span class="token string">"i686-Linux"</span><span class="token punctuation">,</span>
                    <span class="token property">"mysql_version"</span><span class="token operator">:</span> <span class="token string">"5.7.21-log"</span><span class="token punctuation">,</span>
                    <span class="token property">"args"</span><span class="token operator">:</span> <span class="token punctuation">[</span><span class="token string">"/usr/local/mysql/bin/mysqld"</span><span class="token punctuation">,</span>
                             <span class="token string">"--loose-audit-log-format=JSON"</span><span class="token punctuation">,</span>
                             <span class="token string">"--log-error=log.err"</span><span class="token punctuation">,</span>
                             <span class="token string">"--pid-file=mysqld.pid"</span><span class="token punctuation">,</span>
                             <span class="token string">"--port=3306"</span> <span class="token punctuation">]</span> <span class="token punctuation">}</span> <span class="token punctuation">}</span></code></pre>
   </div>
   <p>
    When the audit log plugin starts as a result of server startup
          (as opposed to being enabled at runtime),
    <code class="literal">
     connection_id
    </code>
    is set to 0, and
    <code class="literal">
     account
    </code>
    and
    <code class="literal">
     login
    </code>
    are
          not present.
   </p>
   <p>
    Auditing shutdown event:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-json"><div class="docs-select-all right" id="sa5675394"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-json"><span class="token punctuation">{</span> <span class="token property">"timestamp"</span><span class="token operator">:</span> <span class="token string">"2019-10-03 14:28:20"</span><span class="token punctuation">,</span>
  <span class="token property">"id"</span><span class="token operator">:</span> <span class="token number">3</span><span class="token punctuation">,</span>
  <span class="token property">"class"</span><span class="token operator">:</span> <span class="token string">"audit"</span><span class="token punctuation">,</span>
  <span class="token property">"event"</span><span class="token operator">:</span> <span class="token string">"shutdown"</span><span class="token punctuation">,</span>
  <span class="token property">"connection_id"</span><span class="token operator">:</span> <span class="token number">0</span><span class="token punctuation">,</span>
  <span class="token property">"shutdown_data"</span><span class="token operator">:</span> <span class="token punctuation">{</span> <span class="token property">"server_id"</span><span class="token operator">:</span> <span class="token number">1</span> <span class="token punctuation">}</span> <span class="token punctuation">}</span></code></pre>
   </div>
   <p>
    When the audit log plugin is uninstalled as a result of server
          shutdown (as opposed to being disabled at runtime),
    <code class="literal">
     connection_id
    </code>
    is set to 0, and
    <code class="literal">
     account
    </code>
    and
    <code class="literal">
     login
    </code>
    are
          not present.
   </p>
   <p>
    Connect or change-user event:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-json"><div class="docs-select-all right" id="sa92291713"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-json"><span class="token punctuation">{</span> <span class="token property">"timestamp"</span><span class="token operator">:</span> <span class="token string">"2019-10-03 14:23:18"</span><span class="token punctuation">,</span>
  <span class="token property">"id"</span><span class="token operator">:</span> <span class="token number">1</span><span class="token punctuation">,</span>
  <span class="token property">"class"</span><span class="token operator">:</span> <span class="token string">"connection"</span><span class="token punctuation">,</span>
  <span class="token property">"event"</span><span class="token operator">:</span> <span class="token string">"connect"</span><span class="token punctuation">,</span>
  <span class="token property">"connection_id"</span><span class="token operator">:</span> <span class="token number">5</span><span class="token punctuation">,</span>
  <span class="token property">"account"</span><span class="token operator">:</span> <span class="token punctuation">{</span> <span class="token property">"user"</span><span class="token operator">:</span> <span class="token string">"root"</span><span class="token punctuation">,</span> <span class="token property">"host"</span><span class="token operator">:</span> <span class="token string">"localhost"</span> <span class="token punctuation">}</span><span class="token punctuation">,</span>
  <span class="token property">"login"</span><span class="token operator">:</span> <span class="token punctuation">{</span> <span class="token property">"user"</span><span class="token operator">:</span> <span class="token string">"root"</span><span class="token punctuation">,</span> <span class="token property">"os"</span><span class="token operator">:</span> <span class="token string">""</span><span class="token punctuation">,</span> <span class="token property">"ip"</span><span class="token operator">:</span> "<span class="token operator">:</span><span class="token operator">:</span><span class="token number">1</span>"<span class="token punctuation">,</span> <span class="token property">"proxy"</span><span class="token operator">:</span> <span class="token string">""</span> <span class="token punctuation">}</span><span class="token punctuation">,</span>
  <span class="token property">"connection_data"</span><span class="token operator">:</span> <span class="token punctuation">{</span> <span class="token property">"connection_type"</span><span class="token operator">:</span> <span class="token string">"ssl"</span><span class="token punctuation">,</span>
                       <span class="token property">"status"</span><span class="token operator">:</span> <span class="token number">0</span><span class="token punctuation">,</span>
                       <span class="token property">"db"</span><span class="token operator">:</span> <span class="token string">"test"</span><span class="token punctuation">,</span>
                       <span class="token property">"connection_attributes"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
                         <span class="token property">"_pid"</span><span class="token operator">:</span> <span class="token string">"43236"</span><span class="token punctuation">,</span>
                         ...
                         <span class="token property">"program_name"</span><span class="token operator">:</span> <span class="token string">"mysqladmin"</span>
                       <span class="token punctuation">}</span> <span class="token punctuation">}</span>
<span class="token punctuation">}</span></code></pre>
   </div>
   <p>
    Disconnect event:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-json"><div class="docs-select-all right" id="sa94048835"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-json"><span class="token punctuation">{</span> <span class="token property">"timestamp"</span><span class="token operator">:</span> <span class="token string">"2019-10-03 14:24:45"</span><span class="token punctuation">,</span>
  <span class="token property">"id"</span><span class="token operator">:</span> <span class="token number">3</span><span class="token punctuation">,</span>
  <span class="token property">"class"</span><span class="token operator">:</span> <span class="token string">"connection"</span><span class="token punctuation">,</span>
  <span class="token property">"event"</span><span class="token operator">:</span> <span class="token string">"disconnect"</span><span class="token punctuation">,</span>
  <span class="token property">"connection_id"</span><span class="token operator">:</span> <span class="token number">5</span><span class="token punctuation">,</span>
  <span class="token property">"account"</span><span class="token operator">:</span> <span class="token punctuation">{</span> <span class="token property">"user"</span><span class="token operator">:</span> <span class="token string">"root"</span><span class="token punctuation">,</span> <span class="token property">"host"</span><span class="token operator">:</span> <span class="token string">"localhost"</span> <span class="token punctuation">}</span><span class="token punctuation">,</span>
  <span class="token property">"login"</span><span class="token operator">:</span> <span class="token punctuation">{</span> <span class="token property">"user"</span><span class="token operator">:</span> <span class="token string">"root"</span><span class="token punctuation">,</span> <span class="token property">"os"</span><span class="token operator">:</span> <span class="token string">""</span><span class="token punctuation">,</span> <span class="token property">"ip"</span><span class="token operator">:</span> "<span class="token operator">:</span><span class="token operator">:</span><span class="token number">1</span>"<span class="token punctuation">,</span> <span class="token property">"proxy"</span><span class="token operator">:</span> <span class="token string">""</span> <span class="token punctuation">}</span><span class="token punctuation">,</span>
  <span class="token property">"connection_data"</span><span class="token operator">:</span> <span class="token punctuation">{</span> <span class="token property">"connection_type"</span><span class="token operator">:</span> <span class="token string">"ssl"</span> <span class="token punctuation">}</span> <span class="token punctuation">}</span></code></pre>
   </div>
   <p>
    Query event:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-json"><div class="docs-select-all right" id="sa1369824"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-json"><span class="token punctuation">{</span> <span class="token property">"timestamp"</span><span class="token operator">:</span> <span class="token string">"2019-10-03 14:23:35"</span><span class="token punctuation">,</span>
  <span class="token property">"id"</span><span class="token operator">:</span> <span class="token number">2</span><span class="token punctuation">,</span>
  <span class="token property">"class"</span><span class="token operator">:</span> <span class="token string">"general"</span><span class="token punctuation">,</span>
  <span class="token property">"event"</span><span class="token operator">:</span> <span class="token string">"status"</span><span class="token punctuation">,</span>
  <span class="token property">"connection_id"</span><span class="token operator">:</span> <span class="token number">5</span><span class="token punctuation">,</span>
  <span class="token property">"account"</span><span class="token operator">:</span> <span class="token punctuation">{</span> <span class="token property">"user"</span><span class="token operator">:</span> <span class="token string">"root"</span><span class="token punctuation">,</span> <span class="token property">"host"</span><span class="token operator">:</span> <span class="token string">"localhost"</span> <span class="token punctuation">}</span><span class="token punctuation">,</span>
  <span class="token property">"login"</span><span class="token operator">:</span> <span class="token punctuation">{</span> <span class="token property">"user"</span><span class="token operator">:</span> <span class="token string">"root"</span><span class="token punctuation">,</span> <span class="token property">"os"</span><span class="token operator">:</span> <span class="token string">""</span><span class="token punctuation">,</span> <span class="token property">"ip"</span><span class="token operator">:</span> "<span class="token operator">:</span><span class="token operator">:</span><span class="token number">1</span>"<span class="token punctuation">,</span> <span class="token property">"proxy"</span><span class="token operator">:</span> <span class="token string">""</span> <span class="token punctuation">}</span><span class="token punctuation">,</span>
  <span class="token property">"general_data"</span><span class="token operator">:</span> <span class="token punctuation">{</span> <span class="token property">"command"</span><span class="token operator">:</span> <span class="token string">"Query"</span><span class="token punctuation">,</span>
                    <span class="token property">"sql_command"</span><span class="token operator">:</span> <span class="token string">"show_variables"</span><span class="token punctuation">,</span>
                    <span class="token property">"query"</span><span class="token operator">:</span> <span class="token string">"SHOW VARIABLES"</span><span class="token punctuation">,</span>
                    <span class="token property">"status"</span><span class="token operator">:</span> <span class="token number">0</span> <span class="token punctuation">}</span> <span class="token punctuation">}</span></code></pre>
   </div>
   <p>
    Query event with optional query statistics for outlier
          detection:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-json"><div class="docs-select-all right" id="sa96330512"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-json"><span class="token punctuation">{</span> <span class="token property">"timestamp"</span><span class="token operator">:</span> <span class="token string">"2022-01-28 13:09:30"</span><span class="token punctuation">,</span> 
  <span class="token property">"id"</span><span class="token operator">:</span> <span class="token number">0</span><span class="token punctuation">,</span> 
  <span class="token property">"class"</span><span class="token operator">:</span> <span class="token string">"general"</span><span class="token punctuation">,</span> 
  <span class="token property">"event"</span><span class="token operator">:</span> <span class="token string">"status"</span><span class="token punctuation">,</span> 
  <span class="token property">"connection_id"</span><span class="token operator">:</span> <span class="token number">46</span><span class="token punctuation">,</span> 
  <span class="token property">"account"</span><span class="token operator">:</span> <span class="token punctuation">{</span> <span class="token property">"user"</span><span class="token operator">:</span> <span class="token string">"user"</span><span class="token punctuation">,</span> <span class="token property">"host"</span><span class="token operator">:</span> <span class="token string">"localhost"</span> <span class="token punctuation">}</span><span class="token punctuation">,</span> 
  <span class="token property">"login"</span><span class="token operator">:</span> <span class="token punctuation">{</span> <span class="token property">"user"</span><span class="token operator">:</span> "user<span class="token property">", “os"</span><span class="token operator">:</span> "<span class="token property">", “ip"</span><span class="token operator">:</span> "<span class="token number">127.0</span>.<span class="token number">0.1</span><span class="token property">", “proxy"</span><span class="token operator">:</span> <span class="token string">""</span> <span class="token punctuation">}</span><span class="token punctuation">,</span> 
  <span class="token property">"general_data"</span><span class="token operator">:</span> <span class="token punctuation">{</span> <span class="token property">"command"</span><span class="token operator">:</span> <span class="token string">"Query"</span><span class="token punctuation">,</span> 
                    <span class="token property">"sql_command"</span><span class="token operator">:</span> <span class="token string">"insert"</span><span class="token punctuation">,</span>
	            <span class="token property">"query"</span><span class="token operator">:</span> <span class="token string">"INSERT INTO audit_table VALUES(4)"</span><span class="token punctuation">,</span>
	            <span class="token property">"status"</span><span class="token operator">:</span> <span class="token number">1146</span> <span class="token punctuation">}</span>
  <span class="token property">"query_statistics"</span><span class="token operator">:</span> <span class="token punctuation">{</span> <span class="token property">"query_time"</span><span class="token operator">:</span> <span class="token number">0.116250</span><span class="token punctuation">,</span>
                        <span class="token property">"bytes_sent"</span><span class="token operator">:</span> <span class="token number">18384</span><span class="token punctuation">,</span>
                        <span class="token property">"bytes_received"</span><span class="token operator">:</span> <span class="token number">78858</span><span class="token punctuation">,</span>
                        <span class="token property">"rows_sent"</span><span class="token operator">:</span> <span class="token number">3</span><span class="token punctuation">,</span>
                        <span class="token property">"rows_examined"</span><span class="token operator">:</span> <span class="token number">20878</span> <span class="token punctuation">}</span> <span class="token punctuation">}</span></code></pre>
   </div>
   <p>
    Table access event (read, delete, insert, update):
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-json"><div class="docs-select-all right" id="sa63533740"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-json"><span class="token punctuation">{</span> <span class="token property">"timestamp"</span><span class="token operator">:</span> <span class="token string">"2019-10-03 14:23:41"</span><span class="token punctuation">,</span>
  <span class="token property">"id"</span><span class="token operator">:</span> <span class="token number">0</span><span class="token punctuation">,</span>
  <span class="token property">"class"</span><span class="token operator">:</span> <span class="token string">"table_access"</span><span class="token punctuation">,</span>
  <span class="token property">"event"</span><span class="token operator">:</span> <span class="token string">"insert"</span><span class="token punctuation">,</span>
  <span class="token property">"connection_id"</span><span class="token operator">:</span> <span class="token number">5</span><span class="token punctuation">,</span>
  <span class="token property">"account"</span><span class="token operator">:</span> <span class="token punctuation">{</span> <span class="token property">"user"</span><span class="token operator">:</span> <span class="token string">"root"</span><span class="token punctuation">,</span> <span class="token property">"host"</span><span class="token operator">:</span> <span class="token string">"localhost"</span> <span class="token punctuation">}</span><span class="token punctuation">,</span>
  <span class="token property">"login"</span><span class="token operator">:</span> <span class="token punctuation">{</span> <span class="token property">"user"</span><span class="token operator">:</span> <span class="token string">"root"</span><span class="token punctuation">,</span> <span class="token property">"os"</span><span class="token operator">:</span> <span class="token string">""</span><span class="token punctuation">,</span> <span class="token property">"ip"</span><span class="token operator">:</span> <span class="token string">"127.0.0.1"</span><span class="token punctuation">,</span> <span class="token property">"proxy"</span><span class="token operator">:</span> <span class="token string">""</span> <span class="token punctuation">}</span><span class="token punctuation">,</span>
  <span class="token property">"table_access_data"</span><span class="token operator">:</span> <span class="token punctuation">{</span> <span class="token property">"db"</span><span class="token operator">:</span> <span class="token string">"test"</span><span class="token punctuation">,</span>
                         <span class="token property">"table"</span><span class="token operator">:</span> <span class="token string">"t1"</span><span class="token punctuation">,</span>
                         <span class="token property">"query"</span><span class="token operator">:</span> <span class="token string">"INSERT INTO t1 (i) VALUES(1),(2),(3)"</span><span class="token punctuation">,</span>
                         <span class="token property">"sql_command"</span><span class="token operator">:</span> <span class="token string">"insert"</span> <span class="token punctuation">}</span> <span class="token punctuation">}</span></code></pre>
   </div>
   <p>
    The items in the following list appear at the top level of
          JSON-format audit records: Each item value is either a scalar
          or a
    <a class="link" href="json.html" title="13.5 The JSON Data Type">
     <code class="literal">
      JSON
     </code>
    </a>
    hash. For items that
          have a hash value, the description lists only the item names
          within that hash. For more complete descriptions of
          second-level hash items, see later in this section.
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       <code class="literal">
        account
       </code>
      </p>
      <p>
       The MySQL account associated with the event. The value is
              a hash containing these items equivalent to the value of
              the
       <a class="link" href="information-functions.html#function_current-user">
        <code class="literal">
         CURRENT_USER()
        </code>
       </a>
       function
              within the section:
       <code class="literal">
        user
       </code>
       ,
       <code class="literal">
        host
       </code>
       .
      </p>
      <p>
       Example:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-json"><div class="docs-select-all right" id="sa19262033"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-json"><span class="token property">"account"</span><span class="token operator">:</span> <span class="token punctuation">{</span> <span class="token property">"user"</span><span class="token operator">:</span> <span class="token string">"root"</span><span class="token punctuation">,</span> <span class="token property">"host"</span><span class="token operator">:</span> <span class="token string">"localhost"</span> <span class="token punctuation">}</span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        class
       </code>
      </p>
      <p>
       A string representing the event class. The class defines
              the type of event, when taken together with the
       <code class="literal">
        event
       </code>
       item that specifies the event
              subclass.
      </p>
      <p>
       Example:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-json"><div class="docs-select-all right" id="sa98101895"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-json"><span class="token property">"class"</span><span class="token operator">:</span> <span class="token string">"connection"</span></code></pre>
      </div>
      <p>
       The following table shows the permitted combinations of
       <code class="literal">
        class
       </code>
       and
       <code class="literal">
        event
       </code>
       values.
      </p>
      <div class="table">
       <a name="audit-log-class-event-combinations">
       </a>
       <p class="title">
        <b>
         Table 8.33 Audit Log Class and Event Combinations
        </b>
       </p>
       <div class="table-contents">
        <table summary="Permitted combinations of audit log class and event values.">
         <colgroup>
          <col style="width: 30%"/>
          <col style="width: 40%"/>
         </colgroup>
         <thead>
          <tr>
           <th>
            Class Value
           </th>
           <th>
            Permitted Event Values
           </th>
          </tr>
         </thead>
         <tbody>
          <tr>
           <td>
            <code class="literal">
             audit
            </code>
           </td>
           <td>
            <code class="literal">
             startup
            </code>
            ,
            <code class="literal">
             shutdown
            </code>
           </td>
          </tr>
          <tr>
           <td>
            <code class="literal">
             connection
            </code>
           </td>
           <td>
            <code class="literal">
             connect
            </code>
            ,
            <code class="literal">
             change_user
            </code>
            ,
            <code class="literal">
             disconnect
            </code>
           </td>
          </tr>
          <tr>
           <td>
            <code class="literal">
             general
            </code>
           </td>
           <td>
            <code class="literal">
             status
            </code>
           </td>
          </tr>
          <tr>
           <td>
            <code class="literal">
             table_access_data
            </code>
           </td>
           <td>
            <code class="literal">
             read
            </code>
            ,
            <code class="literal">
             delete
            </code>
            ,
            <code class="literal">
             insert
            </code>
            ,
            <code class="literal">
             update
            </code>
           </td>
          </tr>
         </tbody>
        </table>
       </div>
      </div>
      <br class="table-break"/>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        connection_data
       </code>
      </p>
      <p>
       Information about a client connection. The value is a hash
              containing these items:
       <code class="literal">
        connection_type
       </code>
       ,
       <code class="literal">
        status
       </code>
       ,
       <code class="literal">
        db
       </code>
       , and
              possibly
       <code class="literal">
        connection_attributes
       </code>
       . This
              item occurs only for audit records with a
       <code class="literal">
        class
       </code>
       value of
       <code class="literal">
        connection
       </code>
       .
      </p>
      <p>
       Example:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-json"><div class="docs-select-all right" id="sa17302286"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-json"><span class="token property">"connection_data"</span><span class="token operator">:</span> <span class="token punctuation">{</span> <span class="token property">"connection_type"</span><span class="token operator">:</span> <span class="token string">"ssl"</span><span class="token punctuation">,</span>
                     <span class="token property">"status"</span><span class="token operator">:</span> <span class="token number">0</span><span class="token punctuation">,</span>
                     <span class="token property">"db"</span><span class="token operator">:</span> <span class="token string">"test"</span> <span class="token punctuation">}</span></code></pre>
      </div>
      <p>
       Events with a
       <code class="literal">
        class
       </code>
       value of
       <code class="literal">
        connection
       </code>
       and
       <code class="literal">
        event
       </code>
       value of
       <code class="literal">
        connect
       </code>
       may include a
       <code class="literal">
        connection_attributes
       </code>
       item to display
              the connection attributes passed by the client at connect
              time. (For information about these attributes, which are
              also exposed in Performance Schema tables, see
       <a class="xref" href="performance-schema-connection-attribute-tables.html" title="29.12.9 Performance Schema Connection Attribute Tables">
        Section 29.12.9, “Performance Schema Connection Attribute Tables”
       </a>
       .)
      </p>
      <p>
       The
       <code class="literal">
        connection_attributes
       </code>
       value is a
              hash that represents each attribute by its name and value.
      </p>
      <p>
       Example:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-json"><div class="docs-select-all right" id="sa99840536"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-json"><span class="token property">"connection_attributes"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
  <span class="token property">"_pid"</span><span class="token operator">:</span> <span class="token string">"43236"</span><span class="token punctuation">,</span>
  <span class="token property">"_os"</span><span class="token operator">:</span> <span class="token string">"macos0.14"</span><span class="token punctuation">,</span>
  <span class="token property">"_platform"</span><span class="token operator">:</span> <span class="token string">"x86_64"</span><span class="token punctuation">,</span>
  <span class="token property">"_client_version"</span><span class="token operator">:</span> <span class="token string">"8.4.0"</span><span class="token punctuation">,</span>
  <span class="token property">"_client_name"</span><span class="token operator">:</span> <span class="token string">"libmysql"</span><span class="token punctuation">,</span>
  <span class="token property">"program_name"</span><span class="token operator">:</span> <span class="token string">"mysqladmin"</span>
<span class="token punctuation">}</span></code></pre>
      </div>
      <p>
       If no connection attributes are present in the event, none
              are logged and no
       <code class="literal">
        connection_attributes
       </code>
       item appears. This can occur if the connection attempt is
              unsuccessful, the client passes no attributes, or the
              connection occurs internally such as during server startup
              or when initiated by a plugin.
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        connection_id
       </code>
      </p>
      <p>
       An unsigned integer representing the client connection
              identifier. This is the same as the value returned by the
       <a class="link" href="information-functions.html#function_connection-id">
        <code class="literal">
         CONNECTION_ID()
        </code>
       </a>
       function
              within the session.
      </p>
      <p>
       Example:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-json"><div class="docs-select-all right" id="sa55774610"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-json"><span class="token property">"connection_id"</span><span class="token operator">:</span> <span class="token number">5</span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        event
       </code>
      </p>
      <p>
       A string representing the subclass of the event class. The
              subclass defines the type of event, when taken together
              with the
       <code class="literal">
        class
       </code>
       item that specifies the
              event class. For more information, see the
       <code class="literal">
        class
       </code>
       item description.
      </p>
      <p>
       Example:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-json"><div class="docs-select-all right" id="sa57962596"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-json"><span class="token property">"event"</span><span class="token operator">:</span> <span class="token string">"connect"</span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        general_data
       </code>
      </p>
      <p>
       Information about an executed statement or command. The
              value is a hash containing these items:
       <code class="literal">
        command
       </code>
       ,
       <code class="literal">
        sql_command
       </code>
       ,
       <code class="literal">
        query
       </code>
       ,
       <code class="literal">
        status
       </code>
       . This item occurs only for audit
              records with a
       <code class="literal">
        class
       </code>
       value of
       <code class="literal">
        general
       </code>
       .
      </p>
      <p>
       Example:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-json"><div class="docs-select-all right" id="sa37767202"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-json"><span class="token property">"general_data"</span><span class="token operator">:</span> <span class="token punctuation">{</span> <span class="token property">"command"</span><span class="token operator">:</span> <span class="token string">"Query"</span><span class="token punctuation">,</span>
                  <span class="token property">"sql_command"</span><span class="token operator">:</span> <span class="token string">"show_variables"</span><span class="token punctuation">,</span>
                  <span class="token property">"query"</span><span class="token operator">:</span> <span class="token string">"SHOW VARIABLES"</span><span class="token punctuation">,</span>
                  <span class="token property">"status"</span><span class="token operator">:</span> <span class="token number">0</span> <span class="token punctuation">}</span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        id
       </code>
      </p>
      <p>
       An unsigned integer representing an event ID.
      </p>
      <p>
       Example:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-json"><div class="docs-select-all right" id="sa18692206"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-json"><span class="token property">"id"</span><span class="token operator">:</span> <span class="token number">2</span></code></pre>
      </div>
      <p>
       For audit records that have the same
       <code class="literal">
        timestamp
       </code>
       value, their
       <code class="literal">
        id
       </code>
       values distinguish them and form a
              sequence. Within the audit log,
       <code class="literal">
        timestamp
       </code>
       /
       <code class="literal">
        id
       </code>
       pairs
              are unique. These pairs are bookmarks that identify event
              locations within the log.
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        login
       </code>
      </p>
      <p>
       Information indicating how a client connected to the
              server. The value is a hash containing these items:
       <code class="literal">
        user
       </code>
       ,
       <code class="literal">
        os
       </code>
       ,
       <code class="literal">
        ip
       </code>
       ,
       <code class="literal">
        proxy
       </code>
       .
      </p>
      <p>
       Example:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-json"><div class="docs-select-all right" id="sa64432156"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-json"><span class="token property">"login"</span><span class="token operator">:</span> <span class="token punctuation">{</span> <span class="token property">"user"</span><span class="token operator">:</span> <span class="token string">"root"</span><span class="token punctuation">,</span> <span class="token property">"os"</span><span class="token operator">:</span> <span class="token string">""</span><span class="token punctuation">,</span> <span class="token property">"ip"</span><span class="token operator">:</span> "<span class="token operator">:</span><span class="token operator">:</span><span class="token number">1</span>"<span class="token punctuation">,</span> <span class="token property">"proxy"</span><span class="token operator">:</span> <span class="token string">""</span> <span class="token punctuation">}</span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        query_statistics
       </code>
      </p>
      <p>
       Optional query statistics for outlier detection. The value
              is a hash containing these items:
       <code class="literal">
        query_time
       </code>
       ,
       <code class="literal">
        rows_sent
       </code>
       ,
       <code class="literal">
        rows_examined
       </code>
       ,
       <code class="literal">
        bytes_received
       </code>
       ,
       <code class="literal">
        bytes_sent
       </code>
       . For instructions to set up
              the query statistics, see
       <a class="xref" href="audit-log-logging-configuration.html#audit-log-query-statistics" title="Adding Query Statistics for Outlier Detection">
        Adding Query Statistics for Outlier Detection
       </a>
       .
      </p>
      <p>
       Example:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-json"><div class="docs-select-all right" id="sa7514794"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-json"><span class="token property">"query_statistics"</span><span class="token operator">:</span> <span class="token punctuation">{</span> <span class="token property">"query_time"</span><span class="token operator">:</span> <span class="token number">0.116250</span><span class="token punctuation">,</span>
                      <span class="token property">"bytes_sent"</span><span class="token operator">:</span> <span class="token number">18384</span><span class="token punctuation">,</span>
                      <span class="token property">"bytes_received"</span><span class="token operator">:</span> <span class="token number">78858</span><span class="token punctuation">,</span>
                      <span class="token property">"rows_sent"</span><span class="token operator">:</span> <span class="token number">3</span><span class="token punctuation">,</span>
                      <span class="token property">"rows_examined"</span><span class="token operator">:</span> <span class="token number">20878</span> <span class="token punctuation">}</span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        shutdown_data
       </code>
      </p>
      <p>
       Information pertaining to audit log plugin termination.
              The value is a hash containing these items:
       <code class="literal">
        server_id
       </code>
       This item occurs only for
              audit records with
       <code class="literal">
        class
       </code>
       and
       <code class="literal">
        event
       </code>
       values of
       <code class="literal">
        audit
       </code>
       and
       <code class="literal">
        shutdown
       </code>
       ,
              respectively.
      </p>
      <p>
       Example:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-json"><div class="docs-select-all right" id="sa6367835"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-json"><span class="token property">"shutdown_data"</span><span class="token operator">:</span> <span class="token punctuation">{</span> <span class="token property">"server_id"</span><span class="token operator">:</span> <span class="token number">1</span> <span class="token punctuation">}</span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        startup_data
       </code>
      </p>
      <p>
       Information pertaining to audit log plugin initialization.
              The value is a hash containing these items:
       <code class="literal">
        server_id
       </code>
       ,
       <code class="literal">
        os_version
       </code>
       ,
       <code class="literal">
        mysql_version
       </code>
       ,
       <code class="literal">
        args
       </code>
       .
              This item occurs only for audit records with
       <code class="literal">
        class
       </code>
       and
       <code class="literal">
        event
       </code>
       values of
       <code class="literal">
        audit
       </code>
       and
       <code class="literal">
        startup
       </code>
       , respectively.
      </p>
      <p>
       Example:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-json"><div class="docs-select-all right" id="sa37414091"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-json"><span class="token property">"startup_data"</span><span class="token operator">:</span> <span class="token punctuation">{</span> <span class="token property">"server_id"</span><span class="token operator">:</span> <span class="token number">1</span><span class="token punctuation">,</span>
                  <span class="token property">"os_version"</span><span class="token operator">:</span> <span class="token string">"i686-Linux"</span><span class="token punctuation">,</span>
                  <span class="token property">"mysql_version"</span><span class="token operator">:</span> <span class="token string">"5.7.21-log"</span><span class="token punctuation">,</span>
                  <span class="token property">"args"</span><span class="token operator">:</span> <span class="token punctuation">[</span><span class="token string">"/usr/local/mysql/bin/mysqld"</span><span class="token punctuation">,</span>
                           <span class="token string">"--loose-audit-log-format=JSON"</span><span class="token punctuation">,</span>
                           <span class="token string">"--log-error=log.err"</span><span class="token punctuation">,</span>
                           <span class="token string">"--pid-file=mysqld.pid"</span><span class="token punctuation">,</span>
                           <span class="token string">"--port=3306"</span> <span class="token punctuation">]</span> <span class="token punctuation">}</span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        table_access_data
       </code>
      </p>
      <p>
       Information about an access to a table. The value is a
              hash containing these items:
       <code class="literal">
        db
       </code>
       ,
       <code class="literal">
        table
       </code>
       ,
       <code class="literal">
        query
       </code>
       ,
       <code class="literal">
        sql_command
       </code>
       , This item occurs only for
              audit records with a
       <code class="literal">
        class
       </code>
       value of
       <code class="literal">
        table_access
       </code>
       .
      </p>
      <p>
       Example:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-json"><div class="docs-select-all right" id="sa46667829"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-json"><span class="token property">"table_access_data"</span><span class="token operator">:</span> <span class="token punctuation">{</span> <span class="token property">"db"</span><span class="token operator">:</span> <span class="token string">"test"</span><span class="token punctuation">,</span>
                       <span class="token property">"table"</span><span class="token operator">:</span> <span class="token string">"t1"</span><span class="token punctuation">,</span>
                       <span class="token property">"query"</span><span class="token operator">:</span> <span class="token string">"INSERT INTO t1 (i) VALUES(1),(2),(3)"</span><span class="token punctuation">,</span>
                       <span class="token property">"sql_command"</span><span class="token operator">:</span> <span class="token string">"insert"</span> <span class="token punctuation">}</span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        time
       </code>
      </p>
      <p>
       This field is similar to that in the
       <code class="literal">
        timestamp
       </code>
       field, but the value is an
              integer and represents the UNIX timestamp value indicating
              the date and time when the audit event was generated.
      </p>
      <p>
       Example:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-json"><div class="docs-select-all right" id="sa5495074"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-json"><span class="token property">"time"</span> <span class="token operator">:</span> <span class="token number">1618498687</span></code></pre>
      </div>
      <p>
       The
       <code class="literal">
        time
       </code>
       field occurs in JSON-format
              log files only if the
       <a class="link" href="audit-log-reference.html#sysvar_audit_log_format_unix_timestamp">
        <code class="literal">
         audit_log_format_unix_timestamp
        </code>
       </a>
       system variable is enabled.
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        timestamp
       </code>
      </p>
      <p>
       A string representing a UTC value in
       <em class="replaceable">
        <code>
         YYYY-MM-DD hh:mm:ss
        </code>
       </em>
       format
              indicating the date and time when the audit event was
              generated. For example, the event corresponding to
              execution of an SQL statement received from a client has a
       <code class="literal">
        timestamp
       </code>
       value occurring after the
              statement finishes, not when it was received.
      </p>
      <p>
       Example:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-json"><div class="docs-select-all right" id="sa1155895"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-json"><span class="token property">"timestamp"</span><span class="token operator">:</span> <span class="token string">"2019-10-03 13:50:01"</span></code></pre>
      </div>
      <p>
       For audit records that have the same
       <code class="literal">
        timestamp
       </code>
       value, their
       <code class="literal">
        id
       </code>
       values distinguish them and form a
              sequence. Within the audit log,
       <code class="literal">
        timestamp
       </code>
       /
       <code class="literal">
        id
       </code>
       pairs
              are unique. These pairs are bookmarks that identify event
              locations within the log.
      </p>
     </li>
    </ul>
   </div>
   <p>
    These items appear within hash values associated with
          top-level items of JSON-format audit records:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       <code class="literal">
        args
       </code>
      </p>
      <p>
       An array of options that were given on the command line or
              in option files when the MySQL server was started. The
              first option is the path to the server executable.
      </p>
      <p>
       Example:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-json"><div class="docs-select-all right" id="sa30220596"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-json"><span class="token property">"args"</span><span class="token operator">:</span> <span class="token punctuation">[</span><span class="token string">"/usr/local/mysql/bin/mysqld"</span><span class="token punctuation">,</span>
         <span class="token string">"--loose-audit-log-format=JSON"</span><span class="token punctuation">,</span>
         <span class="token string">"--log-error=log.err"</span><span class="token punctuation">,</span>
         <span class="token string">"--pid-file=mysqld.pid"</span><span class="token punctuation">,</span>
         <span class="token string">"--port=3306"</span> <span class="token punctuation">]</span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        bytes_received
       </code>
      </p>
      <p>
       The number of bytes received from the client. This item is
              part of the optional query statistics. For this field to
              be populated, the system variable
       <a class="link" href="server-system-variables.html#sysvar_log_slow_extra">
        <code class="literal">
         log_slow_extra
        </code>
       </a>
       must be
              set to
       <code class="literal">
        ON
       </code>
       .
      </p>
      <p>
       Example:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-json"><div class="docs-select-all right" id="sa3855363"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-json"><span class="token property">"bytes_received"</span><span class="token operator">:</span> <span class="token number">78858</span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        bytes_sent
       </code>
      </p>
      <p>
       The number of bytes sent to the client. This item is part
              of the optional query statistics. For this field to be
              populated, the system variable
       <a class="link" href="server-system-variables.html#sysvar_log_slow_extra">
        <code class="literal">
         log_slow_extra
        </code>
       </a>
       must be
              set to
       <code class="literal">
        ON
       </code>
       .
      </p>
      <p>
       Example:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-json"><div class="docs-select-all right" id="sa19064110"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-json"><span class="token property">"bytes_sent"</span><span class="token operator">:</span> <span class="token number">18384</span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        command
       </code>
      </p>
      <p>
       A string representing the type of instruction that
              generated the audit event, such as a command that the
              server received from a client.
      </p>
      <p>
       Example:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-json"><div class="docs-select-all right" id="sa8053937"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-json"><span class="token property">"command"</span><span class="token operator">:</span> <span class="token string">"Query"</span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        connection_type
       </code>
      </p>
      <p>
       The security state of the connection to the server.
              Permitted values are
       <code class="literal">
        tcp/ip
       </code>
       (TCP/IP
              connection established without encryption),
       <code class="literal">
        ssl
       </code>
       (TCP/IP connection established with
              encryption),
       <code class="literal">
        socket
       </code>
       (Unix socket file
              connection),
       <code class="literal">
        named_pipe
       </code>
       (Windows named
              pipe connection), and
       <code class="literal">
        shared_memory
       </code>
       (Windows shared memory connection).
      </p>
      <p>
       Example:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-json"><div class="docs-select-all right" id="sa16590549"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-json"><span class="token property">"connection_type"</span><span class="token operator">:</span> <span class="token string">"tcp/tcp"</span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        db
       </code>
      </p>
      <p>
       A string representing a database name. For
       <code class="literal">
        connection_data
       </code>
       , it is the default
              database. For
       <code class="literal">
        table_access_data
       </code>
       , it is
              the table database.
      </p>
      <p>
       Example:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-json"><div class="docs-select-all right" id="sa90648817"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-json"><span class="token property">"db"</span><span class="token operator">:</span> <span class="token string">"test"</span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        host
       </code>
      </p>
      <p>
       A string representing the client host name.
      </p>
      <p>
       Example:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-json"><div class="docs-select-all right" id="sa16939747"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-json"><span class="token property">"host"</span><span class="token operator">:</span> <span class="token string">"localhost"</span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        ip
       </code>
      </p>
      <p>
       A string representing the client IP address.
      </p>
      <p>
       Example:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-json"><div class="docs-select-all right" id="sa27928144"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-json"><span class="token property">"ip"</span><span class="token operator">:</span> "<span class="token operator">:</span><span class="token operator">:</span><span class="token number">1</span>"</code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        mysql_version
       </code>
      </p>
      <p>
       A string representing the MySQL server version. This is
              the same as the value of the
       <a class="link" href="information-functions.html#function_version">
        <code class="literal">
         VERSION()
        </code>
       </a>
       function or
       <a class="link" href="server-system-variables.html#sysvar_version">
        <code class="literal">
         version
        </code>
       </a>
       system variable.
      </p>
      <p>
       Example:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-json"><div class="docs-select-all right" id="sa27522602"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-json"><span class="token property">"mysql_version"</span><span class="token operator">:</span> <span class="token string">"5.7.21-log"</span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        os
       </code>
      </p>
      <p>
       A string representing the external user name used during
              the authentication process, as set by the plugin used to
              authenticate the client. With native (built-in) MySQL
              authentication, or if the plugin does not set the value,
              this attribute is empty. The value is the same as that of
              the
       <a class="link" href="server-system-variables.html#sysvar_external_user">
        <code class="literal">
         external_user
        </code>
       </a>
       system
              variable. See
       <a class="xref" href="proxy-users.html" title="8.2.19 Proxy Users">
        Section 8.2.19, “Proxy Users”
       </a>
       .
      </p>
      <p>
       Example:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-json"><div class="docs-select-all right" id="sa73771891"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-json"><span class="token property">"os"</span><span class="token operator">:</span> <span class="token string">"jeffrey"</span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        os_version
       </code>
      </p>
      <p>
       A string representing the operating system on which the
              server was built or is running.
      </p>
      <p>
       Example:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-json"><div class="docs-select-all right" id="sa47634394"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-json"><span class="token property">"os_version"</span><span class="token operator">:</span> <span class="token string">"i686-Linux"</span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        proxy
       </code>
      </p>
      <p>
       A string representing the proxy user (see
       <a class="xref" href="proxy-users.html" title="8.2.19 Proxy Users">
        Section 8.2.19, “Proxy Users”
       </a>
       ). The value is empty if user
              proxying is not in effect.
      </p>
      <p>
       Example:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-json"><div class="docs-select-all right" id="sa36688323"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-json"><span class="token property">"proxy"</span><span class="token operator">:</span> <span class="token string">"developer"</span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        query
       </code>
      </p>
      <p>
       A string representing the text of an SQL statement. The
              value can be empty. Long values may be truncated. The
              string, like the audit log file itself, is written using
              UTF-8 (up to 4 bytes per character), so the value may be
              the result of conversion. For example, the original
              statement might have been received from the client as an
              SJIS string.
      </p>
      <p>
       Example:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-json"><div class="docs-select-all right" id="sa34939748"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-json"><span class="token property">"query"</span><span class="token operator">:</span> <span class="token string">"DELETE FROM t1"</span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        query_time
       </code>
      </p>
      <p>
       The query execution time in microseconds (if the
       <code class="literal">
        longlong
       </code>
       data type is selected) or
              seconds (if the
       <code class="literal">
        double
       </code>
       data type is
              selected). This item is part of the optional query
              statistics.
      </p>
      <p>
       Example:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-json"><div class="docs-select-all right" id="sa79299162"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-json"><span class="token property">"query_time"</span><span class="token operator">:</span> <span class="token number">0.116250</span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        rows_examined
       </code>
      </p>
      <p>
       The number of rows accessed during the query. This item is
              part of the optional query statistics.
      </p>
      <p>
       Example:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-json"><div class="docs-select-all right" id="sa90228444"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-json"><span class="token property">"rows_examined"</span><span class="token operator">:</span> <span class="token number">20878</span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        rows_sent
       </code>
      </p>
      <p>
       The number of rows sent to the client as a result. This
              item is part of the optional query statistics.
      </p>
      <p>
       Example:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-json"><div class="docs-select-all right" id="sa35196704"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-json"><span class="token property">"rows_sent"</span><span class="token operator">:</span> <span class="token number">3</span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        server_id
       </code>
      </p>
      <p>
       An unsigned integer representing the server ID. This is
              the same as the value of the
       <a class="link" href="replication-options.html#sysvar_server_id">
        <code class="literal">
         server_id
        </code>
       </a>
       system
              variable.
      </p>
      <p>
       Example:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-json"><div class="docs-select-all right" id="sa16314371"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-json"><span class="token property">"server_id"</span><span class="token operator">:</span> <span class="token number">1</span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        sql_command
       </code>
      </p>
      <p>
       A string that indicates the SQL statement type.
      </p>
      <p>
       Example:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-json"><div class="docs-select-all right" id="sa57257067"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-json"><span class="token property">"sql_command"</span><span class="token operator">:</span> <span class="token string">"insert"</span></code></pre>
      </div>
      <p>
       The values correspond to the
       <code class="literal">
        statement/sql/
        <em class="replaceable">
         <code>
          xxx
         </code>
        </em>
       </code>
       command counters. For example,
       <em class="replaceable">
        <code>
         xxx
        </code>
       </em>
       is
       <code class="literal">
        drop_table
       </code>
       and
       <code class="literal">
        select
       </code>
       for
       <a class="link" href="drop-table.html" title="15.1.32 DROP TABLE Statement">
        <code class="literal">
         DROP
              TABLE
        </code>
       </a>
       and
       <a class="link" href="select.html" title="15.2.13 SELECT Statement">
        <code class="literal">
         SELECT
        </code>
       </a>
       statements, respectively. The following statement displays
              the possible names:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa3473720"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">SELECT</span> <span class="token function">REPLACE</span><span class="token punctuation">(</span>EVENT_NAME<span class="token punctuation">,</span> <span class="token string">'statement/sql/'</span><span class="token punctuation">,</span> <span class="token string">''</span><span class="token punctuation">)</span> <span class="token keyword">AS</span> <span class="token keyword">name</span>
<span class="token keyword">FROM</span> performance_schema<span class="token punctuation">.</span>events_statements_summary_global_by_event_name
<span class="token keyword">WHERE</span> EVENT_NAME <span class="token operator">LIKE</span> <span class="token string">'statement/sql/%'</span>
<span class="token keyword">ORDER</span> <span class="token keyword">BY</span> <span class="token keyword">name</span><span class="token punctuation">;</span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        status
       </code>
      </p>
      <p>
       An unsigned integer representing the command status: 0 for
              success, nonzero if an error occurred. This is the same as
              the value of the
       <a class="ulink" href="/doc/c-api/8.4/en/mysql-errno.html" target="_top">
        <code class="literal">
         mysql_errno()
        </code>
       </a>
       C API
              function.
      </p>
      <p>
       The audit log does not contain the SQLSTATE value or error
              message. To see the associations between error codes,
              SQLSTATE values, and messages, see
       <a class="ulink" href="/doc/mysql-errors/8.4/en/server-error-reference.html" target="_top">
        Server Error Message Reference
       </a>
       .
      </p>
      <p>
       Warnings are not logged.
      </p>
      <p>
       Example:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-json"><div class="docs-select-all right" id="sa72052958"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-json"><span class="token property">"status"</span><span class="token operator">:</span> <span class="token number">1051</span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        table
       </code>
      </p>
      <p>
       A string representing a table name.
      </p>
      <p>
       Example:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-json"><div class="docs-select-all right" id="sa32285773"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-json"><span class="token property">"table"</span><span class="token operator">:</span> <span class="token string">"t1"</span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        user
       </code>
      </p>
      <p>
       A string representing a user name. The meaning differs
              depending on the item within which
       <code class="literal">
        user
       </code>
       occurs:
      </p>
      <div class="itemizedlist">
       <ul class="itemizedlist" style="list-style-type: circle; ">
        <li class="listitem">
         <p>
          Within
          <code class="literal">
           account
          </code>
          items,
          <code class="literal">
           user
          </code>
          is a string representing the
                  user that the server authenticated the client as. This
                  is the user name that the server uses for privilege
                  checking.
         </p>
        </li>
        <li class="listitem">
         <p>
          Within
          <code class="literal">
           login
          </code>
          items,
          <code class="literal">
           user
          </code>
          is a string representing the
                  user name sent by the client.
         </p>
        </li>
       </ul>
      </div>
      <p>
       Example:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-json"><div class="docs-select-all right" id="sa36425564"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-json"><span class="token property">"user"</span><span class="token operator">:</span> <span class="token string">"root"</span></code></pre>
      </div>
     </li>
    </ul>
   </div>
  </div>
 </div>
 <br/>
</div>
