<div id="docs-body">
 <div class="section">
  <div class="titlepage">
   <div>
    <div>
     <h4 class="title">
      <a name="audit-log-logging-configuration">
      </a>
      8.4.5.5 Configuring Audit Logging Characteristics
     </h4>
    </div>
   </div>
  </div>
  <p>
   This section describes how to configure audit logging
        characteristics, such as the file to which the audit log plugin
        writes events, the format of written events, whether to enable
        log file compression and encryption, and space management.
  </p>
  <div class="itemizedlist">
   <ul class="itemizedlist" style="list-style-type: disc; ">
    <li class="listitem">
     <p>
      <a class="xref" href="audit-log-logging-configuration.html#audit-log-file-name" title="Naming Conventions for Audit Log Files">
       Naming Conventions for Audit Log Files
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="audit-log-logging-configuration.html#audit-log-file-format" title="Selecting Audit Log File Format">
       Selecting Audit Log File Format
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="audit-log-logging-configuration.html#audit-log-flush-task" title="Enabling the Audit Log Flush Task">
       Enabling the Audit Log Flush Task
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="audit-log-logging-configuration.html#audit-log-query-statistics" title="Adding Query Statistics for Outlier Detection">
       Adding Query Statistics for Outlier Detection
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="audit-log-logging-configuration.html#audit-log-file-compression" title="Compressing Audit Log Files">
       Compressing Audit Log Files
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="audit-log-logging-configuration.html#audit-log-file-encryption" title="Encrypting Audit Log Files">
       Encrypting Audit Log Files
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="audit-log-logging-configuration.html#audit-log-file-uncompression-decryption" title="Manually Uncompressing and Decrypting Audit Log Files">
       Manually Uncompressing and Decrypting Audit Log Files
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="audit-log-logging-configuration.html#audit-log-space-management" title="Space Management of Audit Log Files">
       Space Management of Audit Log Files
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="audit-log-logging-configuration.html#audit-log-strategy" title="Write Strategies for Audit Logging">
       Write Strategies for Audit Logging
      </a>
     </p>
    </li>
   </ul>
  </div>
  <p>
   For additional information about the functions and system
        variables that affect audit logging, see
   <a class="xref" href="audit-log-reference.html#audit-log-routines" title="Audit Log Functions">
    Audit Log Functions
   </a>
   , and
   <a class="xref" href="audit-log-reference.html#audit-log-options-variables" title="Audit Log Options and Variables">
    Audit Log Options and Variables
   </a>
   .
  </p>
  <p>
   The audit log plugin can also control which audited events are
        written to the audit log file, based on event content or the
        account from which events originate. See
   <a class="xref" href="audit-log-filtering.html" title="8.4.5.7 Audit Log Filtering">
    Section 8.4.5.7, “Audit Log Filtering”
   </a>
   .
  </p>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h5 class="title">
       <a name="audit-log-file-name">
       </a>
       Naming Conventions for Audit Log Files
      </h5>
     </div>
    </div>
   </div>
   <p>
    To configure the audit log file name, set the
    <a class="link" href="audit-log-reference.html#sysvar_audit_log_file">
     <code class="literal">
      audit_log_file
     </code>
    </a>
    system
          variable at server startup. The default name is
    <code class="filename">
     audit.log
    </code>
    in the server data directory.
          For best security, write the audit log to a directory
          accessible only to the MySQL server and to users with a
          legitimate reason to view the log.
   </p>
   <p>
    The plugin interprets the
    <a class="link" href="audit-log-reference.html#sysvar_audit_log_file">
     <code class="literal">
      audit_log_file
     </code>
    </a>
    value as
          composed of an optional leading directory name, a base name,
          and an optional suffix. If compression or encryption are
          enabled, the effective file name (the name actually used to
          create the log file) differs from the configured file name
          because it has additional suffixes:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       If compression is enabled, the plugin adds a suffix of
       <code class="filename">
        .gz
       </code>
       .
      </p>
     </li>
     <li class="listitem">
      <p>
       If encryption is enabled, the plugin adds a suffix of
       <code class="filename">
        .
        <em class="replaceable">
         <code>
          pwd_id
         </code>
        </em>
        .enc
       </code>
       ,
              where
       <em class="replaceable">
        <code>
         pwd_id
        </code>
       </em>
       indicates which
              encryption password to use for log file operations. The
              audit log plugin stores encryption passwords in the
              keyring; see
       <a class="xref" href="audit-log-logging-configuration.html#audit-log-file-encryption" title="Encrypting Audit Log Files">
        Encrypting Audit Log Files
       </a>
       .
      </p>
     </li>
    </ul>
   </div>
   <p>
    The effective audit log file name is the name resulting from
          the addition of applicable compression and encryption suffixes
          to the configured file name. For example, if the configured
    <a class="link" href="audit-log-reference.html#sysvar_audit_log_file">
     <code class="literal">
      audit_log_file
     </code>
    </a>
    value is
    <code class="filename">
     audit.log
    </code>
    , the effective file name is one
          of the values shown in the following table.
   </p>
   <div class="informaltable">
    <table summary="audit_log effective file names for various combinations of the compression and encryption features.">
     <colgroup>
      <col style="width: 50%"/>
      <col style="width: 50%"/>
     </colgroup>
     <thead>
      <tr>
       <th>
        Enabled Features
       </th>
       <th>
        Effective File Name
       </th>
      </tr>
     </thead>
     <tbody>
      <tr>
       <td>
        No compression or encryption
       </td>
       <td>
        <code class="filename">
         audit.log
        </code>
       </td>
      </tr>
      <tr>
       <td>
        Compression
       </td>
       <td>
        <code class="filename">
         audit.log.gz
        </code>
       </td>
      </tr>
      <tr>
       <td>
        Encryption
       </td>
       <td>
        <code class="filename">
         audit.log.
         <em class="replaceable">
          <code>
           pwd_id
          </code>
         </em>
         .enc
        </code>
       </td>
      </tr>
      <tr>
       <td>
        Compression, encryption
       </td>
       <td>
        <code class="filename">
         audit.log.gz.
         <em class="replaceable">
          <code>
           pwd_id
          </code>
         </em>
         .enc
        </code>
       </td>
      </tr>
     </tbody>
    </table>
   </div>
   <p>
    <em class="replaceable">
     <code>
      pwd_id
     </code>
    </em>
    indicates the ID of the
          password used to encrypt or decrypt a file.
    <em class="replaceable">
     <code>
      pwd_id
     </code>
    </em>
    format is
    <em class="replaceable">
     <code>
      pwd_timestamp-seq
     </code>
    </em>
    , where:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       <em class="replaceable">
        <code>
         pwd_timestamp
        </code>
       </em>
       is a UTC value in
       <code class="literal">
        <em class="replaceable">
         <code>
          YYYYMMDD
         </code>
        </em>
        T
        <em class="replaceable">
         <code>
          hhmmss
         </code>
        </em>
       </code>
       format indicating when the password was created.
      </p>
     </li>
     <li class="listitem">
      <p>
       <em class="replaceable">
        <code>
         seq
        </code>
       </em>
       is a sequence number.
              Sequence numbers start at 1 and increase for passwords
              that have the same
       <em class="replaceable">
        <code>
         pwd_timestamp
        </code>
       </em>
       value.
      </p>
     </li>
    </ul>
   </div>
   <p>
    Here are some example
    <em class="replaceable">
     <code>
      pwd_id
     </code>
    </em>
    password ID values:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-none"><div class="docs-select-all right" id="sa6151261"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-none">20190403T142359-1
20190403T142400-1
20190403T142400-2</code></pre>
   </div>
   <p>
    To construct the corresponding keyring IDs for storing
          passwords in the keyring, the audit log plugin adds a prefix
          of
    <code class="literal">
     audit_log-
    </code>
    to the
    <em class="replaceable">
     <code>
      pwd_id
     </code>
    </em>
    values. For the example
          password IDs just shown, the corresponding keyring IDs are:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-none"><div class="docs-select-all right" id="sa55873161"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-none">audit_log-20190403T142359-1
audit_log-20190403T142400-1
audit_log-20190403T142400-2</code></pre>
   </div>
   <p>
    The ID of the password currently used for encryption by the
          audit log plugin is the one having the largest
    <em class="replaceable">
     <code>
      pwd_timestamp
     </code>
    </em>
    value. If multiple
          passwords have that
    <em class="replaceable">
     <code>
      pwd_timestamp
     </code>
    </em>
    value, the current password ID is the one with the largest
          sequence number. For example, in the preceding set of password
          IDs, two of them have the largest timestamp,
    <code class="literal">
     20190403T142400
    </code>
    , so the current password ID
          is the one with the largest sequence number
          (
    <code class="literal">
     2
    </code>
    ).
   </p>
   <p>
    The audit log plugin performs certain actions during
          initialization and termination based on the effective audit
          log file name:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       During initialization, the plugin checks whether a file
              with the audit log file name already exists and renames it
              if so. (In this case, the plugin assumes that the previous
              server invocation exited unexpectedly with the audit log
              plugin running.) The plugin then writes to a new empty
              audit log file.
      </p>
     </li>
     <li class="listitem">
      <p>
       During termination, the plugin renames the audit log file.
      </p>
     </li>
     <li class="listitem">
      <p>
       File renaming (whether during plugin initialization or
              termination) occurs according to the usual rules for
              automatic size-based log file rotation; see
       <a class="xref" href="audit-log-logging-configuration.html#audit-log-manual-rotation" title="Manual Audit Log File Rotation">
        Manual Audit Log File Rotation
       </a>
       .
      </p>
     </li>
    </ul>
   </div>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h5 class="title">
       <a name="audit-log-file-format">
       </a>
       Selecting Audit Log File Format
      </h5>
     </div>
    </div>
   </div>
   <p>
    To configure the audit log file format, set the
    <a class="link" href="audit-log-reference.html#sysvar_audit_log_format">
     <code class="literal">
      audit_log_format
     </code>
    </a>
    system
          variable at server startup. These formats are available:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       <code class="literal">
        NEW
       </code>
       : New-style XML format. This is the
              default.
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        OLD
       </code>
       : Old-style XML format.
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        JSON
       </code>
       : JSON format. Writes the audit log
              as a JSON array. Only this format supports the optional
              query time and size statistics.
      </p>
     </li>
    </ul>
   </div>
   <p>
    For details about each format, see
    <a class="xref" href="audit-log-file-formats.html" title="8.4.5.4 Audit Log File Formats">
     Section 8.4.5.4, “Audit Log File Formats”
    </a>
    .
   </p>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h5 class="title">
       <a name="audit-log-flush-task">
       </a>
       Enabling the Audit Log Flush Task
      </h5>
     </div>
    </div>
   </div>
   <p>
    MySQL Enterprise Audit provides the capability of setting a refresh
          interval to dispose of the in-memory cache automatically. A
          flush task configured using the
    <a class="link" href="audit-log-reference.html#sysvar_audit_log_flush_interval_seconds">
     <code class="literal">
      audit_log_flush_interval_seconds
     </code>
    </a>
    system variable has a value of zero by default, which means
          the task is not scheduled to run.
   </p>
   <p>
    When the task is configured to run (the value is non-zero),
          MySQL Enterprise Audit attempts to call the
    <a class="link" href="scheduler-component.html" title="7.5.5 Scheduler Component">
     scheduler
    </a>
    component
          at its initialization and configure a regular, recurring flush
          of its memory cache:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       If the audit log cannot find an implementation of the
              scheduler registration service, it does not schedule the
              flush and continue loading.
      </p>
     </li>
     <li class="listitem">
      <p>
       Audit log implements the
       <code class="literal">
        dynamic_loader_services_loaded_notification
       </code>
       service and listens for new registrations of
       <code class="literal">
        mysql_scheduler
       </code>
       so that audit log can
              register its scheduled task into the newly loaded
              scheduler.
      </p>
     </li>
     <li class="listitem">
      <p>
       Audit log only registers itself into the first scheduler
              implementation loaded.
      </p>
     </li>
    </ul>
   </div>
   <p>
    Similarly, MySQL Enterprise Audit calls the
    <code class="literal">
     scheduler
    </code>
    component at its deinitialization and unconfigures the
          recurring flush that it has scheduled. It keeps an active
          reference to the scheduler registration service until the
          scheduled task is unregistered, ensuring that the
    <code class="literal">
     scheduler
    </code>
    component cannot be unloaded
          while there are active scheduled jobs. All of the results from
          executing the scheduler and its tasks are written to the
          server error log.
   </p>
   <p>
    To schedule an audit log flush task:
   </p>
   <div class="orderedlist">
    <ol class="orderedlist" type="1">
     <li class="listitem">
      <p>
       Confirm that the
       <code class="literal">
        scheduler
       </code>
       component is
              loaded and enabled. The component is enabled
              (
       <code class="literal">
        ON
       </code>
       ) by default (see
       <a class="link" href="server-system-variables.html#sysvar_component_scheduler.enabled">
        <code class="literal">
         component_scheduler.enabled
        </code>
       </a>
       ).
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa63170328"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">SELECT</span> <span class="token operator">*</span> <span class="token keyword">FROM</span> mysql<span class="token punctuation">.</span>components<span class="token punctuation">;</span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output"><span class="token punctuation">|</span> component_id <span class="token punctuation">|</span> component_group_id <span class="token punctuation">|</span> component_urn              <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output"><span class="token punctuation">|</span>            1 <span class="token punctuation">|</span>                  1 <span class="token punctuation">|</span> file://component_scheduler <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       Install the
       <code class="literal">
        audit_log
       </code>
       plugin, if it is
              not installed already (see
       <a class="xref" href="audit-log-installation.html" title="8.4.5.2 Installing or Uninstalling MySQL Enterprise Audit">
        Section 8.4.5.2, “Installing or Uninstalling MySQL Enterprise Audit”
       </a>
       ).
      </p>
     </li>
     <li class="listitem">
      <p>
       Start the server using
       <a class="link" href="audit-log-reference.html#sysvar_audit_log_flush_interval_seconds">
        <code class="literal">
         audit_log_flush_interval_seconds
        </code>
       </a>
       and set the value to a number greater than 59. The upper
              limit of the value varies by platform. For example, to
              configure the flush task to recur every two minutes:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-terminal"><div class="docs-select-all right" id="sa34138578"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-terminal"><span class="token prompt">$&gt; </span><span class="token command">mysqld</span> <span class="token constant">--audit_log_flush_interval_seconds</span><span class="token attr-value"><span class="token punctuation">=</span>120</span></code></pre>
      </div>
      <p>
       For more information, see the
       <a class="link" href="audit-log-reference.html#sysvar_audit_log_flush_interval_seconds">
        <code class="literal">
         audit_log_flush_interval_seconds
        </code>
       </a>
       system variable.
      </p>
     </li>
    </ol>
   </div>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h5 class="title">
       <a name="audit-log-query-statistics">
       </a>
       Adding Query Statistics for Outlier Detection
      </h5>
     </div>
    </div>
   </div>
   <p>
    In MySQL 8.4, you can extend log files in JSON
          format with optional data fields to show the query time, the
          number of bytes sent and received, the number of rows returned
          to the client, and the number of rows examined. This data is
          available in the slow query log for qualifying queries, and in
          the context of the audit log it similarly helps to detect
          outliers for activity analysis. The extended data fields can
          be added only when the audit log is in JSON format
          (
    <a class="link" href="audit-log-reference.html#sysvar_audit_log_format">
     <code class="literal">
      audit_log_format=JSON
     </code>
    </a>
    ),
          which is not the default setting.
   </p>
   <p>
    The query statistics are delivered to the audit log through
          component services that you set up as an audit log filtering
          function. The services are named
    <code class="literal">
     mysql_audit_print_service_longlong_data_source
    </code>
    and
    <code class="literal">
     mysql_audit_print_service_double_data_source
    </code>
    .
          You can choose either data type for each output item. For the
          query time,
    <code class="literal">
     longlong
    </code>
    outputs the value in
          microseconds, and
    <code class="literal">
     double
    </code>
    outputs the value
          in seconds.
   </p>
   <p>
    You add the query statistics using the
    <a class="link" href="audit-log-reference.html#function_audit-log-filter-set-filter">
     <code class="literal">
      audit_log_filter_set_filter()
     </code>
    </a>
    audit log function, as the
    <code class="literal">
     service
    </code>
    element
          of the JSON filtering syntax, as follows:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa68768660"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">SELECT</span> audit_log_filter_set_filter<span class="token punctuation">(</span><span class="token string">'QueryStatistics'</span><span class="token punctuation">,</span>  
                                   <span class="token string">'{ "filter": { "class": { "name": "general", "event": { "name": "status", "print" : '</span>
                                   <span class="token string">'{ "service": { "implementation": "mysql_server", "tag": "query_statistics", "element": [ '</span>
                                   <span class="token string">'{ "name": "query_time",     "type": "double" }, '</span>
                                   <span class="token string">'{ "name": "bytes_sent",     "type": "longlong" }, '</span>
                                   <span class="token string">'{ "name": "bytes_received", "type": "longlong" }, '</span>
                                   <span class="token string">'{ "name": "rows_sent",      "type": "longlong" }, '</span>
                                   <span class="token string">'{ "name": "rows_examined",  "type": "longlong" } ] } } } } } }'</span><span class="token punctuation">)</span><span class="token punctuation">;</span></code></pre>
   </div>
   <p>
    For the
    <code class="literal">
     bytes_sent
    </code>
    and
    <code class="literal">
     bytes_received
    </code>
    fields to be populated, the
          system variable
    <a class="link" href="server-system-variables.html#sysvar_log_slow_extra">
     <code class="literal">
      log_slow_extra
     </code>
    </a>
    must be set to
    <code class="literal">
     ON
    </code>
    . If the system variable is value is
    <code class="literal">
     OFF
    </code>
    , a null value is written to the log
          file for these fields.
   </p>
   <p>
    If you want to stop collecting the query statistics, use the
    <a class="link" href="audit-log-reference.html#function_audit-log-filter-set-filter">
     <code class="literal">
      audit_log_filter_set_filter()
     </code>
    </a>
    audit log function to remove the filter, for example:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa25966498"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">SELECT</span> audit_log_filter_remove_filter<span class="token punctuation">(</span><span class="token string">'QueryStatistics'</span><span class="token punctuation">)</span><span class="token punctuation">;</span></code></pre>
   </div>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h5 class="title">
       <a name="audit-log-file-compression">
       </a>
       Compressing Audit Log Files
      </h5>
     </div>
    </div>
   </div>
   <p>
    Audit log file compression can be enabled for any logging
          format.
   </p>
   <p>
    To configure audit log file compression, set the
    <a class="link" href="audit-log-reference.html#sysvar_audit_log_compression">
     <code class="literal">
      audit_log_compression
     </code>
    </a>
    system
          variable at server startup. Permitted values are
    <code class="literal">
     NONE
    </code>
    (no compression; the default) and
    <code class="literal">
     GZIP
    </code>
    (GNU Zip compression).
   </p>
   <p>
    If both compression and encryption are enabled, compression
          occurs before encryption. To recover the original file
          manually, first decrypt it, then uncompress it. See
    <a class="xref" href="audit-log-logging-configuration.html#audit-log-file-uncompression-decryption" title="Manually Uncompressing and Decrypting Audit Log Files">
     Manually Uncompressing and Decrypting Audit Log Files
    </a>
    .
   </p>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h5 class="title">
       <a name="audit-log-file-encryption">
       </a>
       Encrypting Audit Log Files
      </h5>
     </div>
    </div>
   </div>
   <p>
    Audit log file encryption can be enabled for any logging
          format. Encryption is based on user-defined passwords (with
          the exception of the initial password that the audit log
          plugin generates). To use this feature, the MySQL keyring must
          be enabled because audit logging uses it for password storage.
          Any keyring component or plugin can be used; for instructions,
          see
    <a class="xref" href="keyring.html" title="8.4.4 The MySQL Keyring">
     Section 8.4.4, “The MySQL Keyring”
    </a>
    .
   </p>
   <p>
    To configure audit log file encryption, set the
    <a class="link" href="audit-log-reference.html#sysvar_audit_log_encryption">
     <code class="literal">
      audit_log_encryption
     </code>
    </a>
    system
          variable at server startup. Permitted values are
    <code class="literal">
     NONE
    </code>
    (no encryption; the default) and
    <code class="literal">
     AES
    </code>
    (AES-256-CBC cipher encryption).
   </p>
   <p>
    To set or get an encryption password at runtime, use these
          audit log functions:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       To set the current encryption password, invoke
       <a class="link" href="audit-log-reference.html#function_audit-log-encryption-password-set">
        <code class="literal">
         audit_log_encryption_password_set()
        </code>
       </a>
       .
              This function stores the new password in the keyring. If
              encryption is enabled, it also performs a log file
              rotation operation that renames the current log file, and
              begins a new log file encrypted with the password. File
              renaming occurs according to the usual rules for automatic
              size-based log file rotation; see
       <a class="xref" href="audit-log-logging-configuration.html#audit-log-manual-rotation" title="Manual Audit Log File Rotation">
        Manual Audit Log File Rotation
       </a>
       .
      </p>
      <a class="indexterm" name="idm46045237717968">
      </a>
      <a class="indexterm" name="idm46045237716848">
      </a>
      <p>
       If the
       <a class="link" href="audit-log-reference.html#sysvar_audit_log_password_history_keep_days">
        <code class="literal">
         audit_log_password_history_keep_days
        </code>
       </a>
       system variable is nonzero, invoking
       <a class="link" href="audit-log-reference.html#function_audit-log-encryption-password-set">
        <code class="literal">
         audit_log_encryption_password_set()
        </code>
       </a>
       also causes expiration of old archived audit log
              encryption passwords. For information about audit log
              password history, including password archiving and
              expiration, see the description of that variable.
      </p>
     </li>
     <li class="listitem">
      <p>
       To get the current encryption password, invoke
       <a class="link" href="audit-log-reference.html#function_audit-log-encryption-password-get">
        <code class="literal">
         audit_log_encryption_password_get()
        </code>
       </a>
       with no argument. To get a password by ID, pass an
              argument that specifies the keyring ID of the current
              password or an archived password.
      </p>
      <a class="indexterm" name="idm46045237709488">
      </a>
      <a class="indexterm" name="idm46045237708368">
      </a>
      <p>
       To determine which audit log keyring IDs exist, query the
              Performance Schema
       <a class="link" href="performance-schema-keyring-keys-table.html" title="29.12.18.2 The keyring_keys table">
        <code class="literal">
         keyring_keys
        </code>
       </a>
       table:
      </p>
      <a class="indexterm" name="idm46045237705008">
      </a>
      <a class="indexterm" name="idm46045237703520">
      </a>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa70388524"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token prompt">mysql&gt;</span> <span class="token keyword">SELECT</span> KEY_ID <span class="token keyword">FROM</span> performance_schema<span class="token punctuation">.</span>keyring_keys
       <span class="token keyword">WHERE</span> KEY_ID <span class="token operator">LIKE</span> <span class="token string">'audit_log%'</span>
       <span class="token keyword">ORDER</span> <span class="token keyword">BY</span> KEY_ID<span class="token punctuation">;</span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output"><span class="token punctuation">|</span> KEY_ID                      <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output"><span class="token punctuation">|</span> audit_log<span class="token punctuation">-</span>20190415T152248<span class="token punctuation">-</span>1 <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">|</span> audit_log<span class="token punctuation">-</span>20190415T153507<span class="token punctuation">-</span>1 <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">|</span> audit_log<span class="token punctuation">-</span>20190416T125122<span class="token punctuation">-</span>1 <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">|</span> audit_log<span class="token punctuation">-</span>20190416T141608<span class="token punctuation">-</span>1 <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span></code></pre>
      </div>
     </li>
    </ul>
   </div>
   <p>
    For additional information about audit log encryption
          functions, see
    <a class="xref" href="audit-log-reference.html#audit-log-routines" title="Audit Log Functions">
     Audit Log Functions
    </a>
    .
   </p>
   <p>
    When the audit log plugin initializes, if it finds that log
          file encryption is enabled, it checks whether the keyring
          contains an audit log encryption password. If not, the plugin
          automatically generates a random initial encryption password
          and stores it in the keyring. To discover this password,
          invoke
    <a class="link" href="audit-log-reference.html#function_audit-log-encryption-password-get">
     <code class="literal">
      audit_log_encryption_password_get()
     </code>
    </a>
    .
   </p>
   <p>
    If both compression and encryption are enabled, compression
          occurs before encryption. To recover the original file
          manually, first decrypt it, then uncompress it. See
    <a class="xref" href="audit-log-logging-configuration.html#audit-log-file-uncompression-decryption" title="Manually Uncompressing and Decrypting Audit Log Files">
     Manually Uncompressing and Decrypting Audit Log Files
    </a>
    .
   </p>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h5 class="title">
       <a name="audit-log-file-uncompression-decryption">
       </a>
       Manually Uncompressing and Decrypting Audit Log Files
      </h5>
     </div>
    </div>
   </div>
   <p>
    Audit log files can be uncompressed and decrypted using
          standard tools. This should be done only for log files that
          have been closed (archived) and are no longer in use, not for
          the log file that the audit log plugin is currently writing.
          You can recognize archived log files because they have been
          renamed by the audit log plugin to include a timestamp in the
          file name just after the base name.
   </p>
   <p>
    For this discussion, assume that
    <a class="link" href="audit-log-reference.html#sysvar_audit_log_file">
     <code class="literal">
      audit_log_file
     </code>
    </a>
    is set to
    <code class="filename">
     audit.log
    </code>
    . In that case, an archived
          audit log file has one of the names shown in the following
          table.
   </p>
   <div class="informaltable">
    <table summary="audit_log archived file names for various combinations of the compression and encryption features.">
     <colgroup>
      <col style="width: 50%"/>
      <col style="width: 50%"/>
     </colgroup>
     <thead>
      <tr>
       <th>
        Enabled Features
       </th>
       <th>
        Archived File Name
       </th>
      </tr>
     </thead>
     <tbody>
      <tr>
       <td>
        No compression or encryption
       </td>
       <td>
        <code class="filename">
         audit.
         <em class="replaceable">
          <code>
           timestamp
          </code>
         </em>
         .log
        </code>
       </td>
      </tr>
      <tr>
       <td>
        Compression
       </td>
       <td>
        <code class="filename">
         audit.
         <em class="replaceable">
          <code>
           timestamp
          </code>
         </em>
         .log.gz
        </code>
       </td>
      </tr>
      <tr>
       <td>
        Encryption
       </td>
       <td>
        <code class="filename">
         audit.
         <em class="replaceable">
          <code>
           timestamp
          </code>
         </em>
         .log.
         <em class="replaceable">
          <code>
           pwd_id
          </code>
         </em>
         .enc
        </code>
       </td>
      </tr>
      <tr>
       <td>
        Compression, encryption
       </td>
       <td>
        <code class="filename">
         audit.
         <em class="replaceable">
          <code>
           timestamp
          </code>
         </em>
         .log.gz.
         <em class="replaceable">
          <code>
           pwd_id
          </code>
         </em>
         .enc
        </code>
       </td>
      </tr>
     </tbody>
    </table>
   </div>
   <p>
    As discussed in
    <a class="xref" href="audit-log-logging-configuration.html#audit-log-file-name" title="Naming Conventions for Audit Log Files">
     Naming Conventions for Audit Log Files
    </a>
    ,
    <em class="replaceable">
     <code>
      pwd_id
     </code>
    </em>
    format is
    <em class="replaceable">
     <code>
      pwd_timestamp-seq
     </code>
    </em>
    . Thus, the names
          of archived encrypted log files actually contain two
          timestamps. The first indicates file rotation time, and the
          second indicates when the encryption password was created.
   </p>
   <p>
    Consider the following set of archived encrypted log file
          names:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-simple"><div class="docs-select-all right" id="sa15623580"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-simple">audit<span class="token punctuation">.</span>20190410T205827<span class="token punctuation">.</span>log<span class="token punctuation">.</span>20190403T185337<span class="token operator">-</span>1<span class="token punctuation">.</span>enc
audit<span class="token punctuation">.</span>20190410T210243<span class="token punctuation">.</span>log<span class="token punctuation">.</span>20190403T185337<span class="token operator">-</span>1<span class="token punctuation">.</span>enc
audit<span class="token punctuation">.</span>20190415T145309<span class="token punctuation">.</span>log<span class="token punctuation">.</span>20190414T223342<span class="token operator">-</span>1<span class="token punctuation">.</span>enc
audit<span class="token punctuation">.</span>20190415T151322<span class="token punctuation">.</span>log<span class="token punctuation">.</span>20190414T223342<span class="token operator">-</span>2<span class="token punctuation">.</span>enc</code></pre>
   </div>
   <p>
    Each file name has a unique rotation-time timestamp. By
          contrast, the password timestamps are not unique:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       The first two files have the same password ID and sequence
              number (
       <code class="literal">
        20190403T185337-1
       </code>
       ). They have
              the same encryption password.
      </p>
     </li>
     <li class="listitem">
      <p>
       The second two files have the same password ID
              (
       <code class="literal">
        20190414T223342
       </code>
       ) but different
              sequence numbers (
       <code class="literal">
        1
       </code>
       ,
       <code class="literal">
        2
       </code>
       ). These files have different
              encryption passwords.
      </p>
     </li>
    </ul>
   </div>
   <p>
    To uncompress a compressed log file manually, use
    <span class="command">
     <strong>
      gunzip
     </strong>
    </span>
    ,
    <span class="command">
     <strong>
      gzip -d
     </strong>
    </span>
    , or
          equivalent command. For example:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting one-line language-terminal"><div class="docs-select-all right" id="sa26591025"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-terminal">gunzip <span class="token property">-c</span> audit<span class="token punctuation">.</span><em class="replaceable">timestamp</em><span class="token punctuation">.</span>log<span class="token punctuation">.</span>gz &gt; audit<span class="token punctuation">.</span><em class="replaceable">timestamp</em><span class="token punctuation">.</span>log</code></pre>
   </div>
   <p>
    To decrypt an encrypted log file manually, use the
    <span class="command">
     <strong>
      openssl
     </strong>
    </span>
    command. For example:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-terminal"><div class="docs-select-all right" id="sa93281705"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-terminal">openssl enc <span class="token property">-d</span> <span class="token property">-aes-256-cbc</span> <span class="token property">-pass</span> pass<span class="token punctuation">:</span><em class="replaceable">password</em> <span class="token property">-md</span> sha256
    <span class="token property">-in</span> audit<span class="token punctuation">.</span><em class="replaceable">timestamp</em><span class="token punctuation">.</span>log<span class="token punctuation">.</span><em class="replaceable">pwd_id</em><span class="token punctuation">.</span>enc
    <span class="token property">-out</span> audit<span class="token punctuation">.</span><em class="replaceable">timestamp</em><span class="token punctuation">.</span>log</code></pre>
   </div>
   <p>
    To execute that command, you must obtain
    <em class="replaceable">
     <code>
      password
     </code>
    </em>
    , the encryption password.
          To do this, use
    <a class="link" href="audit-log-reference.html#function_audit-log-encryption-password-get">
     <code class="literal">
      audit_log_encryption_password_get()
     </code>
    </a>
    .
          For example, if the audit log file name is
    <code class="filename">
     audit.20190415T151322.log.20190414T223342-2.enc
    </code>
    ,
          the password ID is
    <code class="literal">
     20190414T223342-2
    </code>
    and
          the keyring ID is
    <code class="literal">
     audit-log-20190414T223342-2
    </code>
    . Retrieve the
          keyring password like this:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa19880040"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">SELECT</span> audit_log_encryption_password_get<span class="token punctuation">(</span><span class="token string">'audit-log-20190414T223342-2'</span><span class="token punctuation">)</span><span class="token punctuation">;</span></code></pre>
   </div>
   <p>
    If both compression and encryption are enabled for audit
          logging, compression occurs before encryption. In this case,
          the file name has
    <code class="filename">
     .gz
    </code>
    and
    <code class="filename">
     .
     <em class="replaceable">
      <code>
       pwd_id
      </code>
     </em>
     .enc
    </code>
    suffixes added, corresponding to the order in which those
          operations occur. To recover the original file manually,
          perform the operations in reverse. That is, first decrypt the
          file, then uncompress it:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-terminal"><div class="docs-select-all right" id="sa78763749"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-terminal">openssl enc <span class="token property">-d</span> <span class="token property">-aes-256-cbc</span> <span class="token property">-pass</span> pass<span class="token punctuation">:</span><em class="replaceable">password</em> <span class="token property">-md</span> sha256
    <span class="token property">-in</span> audit<span class="token punctuation">.</span><em class="replaceable">timestamp</em><span class="token punctuation">.</span>log<span class="token punctuation">.</span>gz<span class="token punctuation">.</span><em class="replaceable">pwd_id</em><span class="token punctuation">.</span>enc
    <span class="token property">-out</span> audit<span class="token punctuation">.</span><em class="replaceable">timestamp</em><span class="token punctuation">.</span>log<span class="token punctuation">.</span>gz
gunzip <span class="token property">-c</span> audit<span class="token punctuation">.</span><em class="replaceable">timestamp</em><span class="token punctuation">.</span>log<span class="token punctuation">.</span>gz &gt; audit<span class="token punctuation">.</span><em class="replaceable">timestamp</em><span class="token punctuation">.</span>log</code></pre>
   </div>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h5 class="title">
       <a name="audit-log-space-management">
       </a>
       Space Management of Audit Log Files
      </h5>
     </div>
    </div>
   </div>
   <p>
    The audit log file has the potential to grow quite large and
          consume a great deal of disk space. If you are collecting the
          optional query time and size statistics, this increases the
          space requirements. The query statistics are only supported
          with JSON format.
   </p>
   <p>
    To manage the space used, employ these methods:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       Log file rotation. This involves rotating the current log
              file by renaming it, then opening a new current log file
              using the original name. Rotation can be performed
              manually, or configured to occur automatically.
      </p>
     </li>
     <li class="listitem">
      <p>
       Pruning of rotated JSON-format log files, if automatic
              rotation is enabled. Pruning can be performed based on log
              file age or combined log file size.
      </p>
     </li>
    </ul>
   </div>
   <p>
    To configure audit log file space management, use the
          following system variables:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       If
       <a class="link" href="audit-log-reference.html#sysvar_audit_log_rotate_on_size">
        <code class="literal">
         audit_log_rotate_on_size
        </code>
       </a>
       is 0 (the default), automatic log file rotation is
              disabled.
      </p>
      <div class="itemizedlist">
       <ul class="itemizedlist" style="list-style-type: circle; ">
        <li class="listitem">
         <p>
          No rotation occurs unless performed manually.
         </p>
        </li>
        <li class="listitem">
         <p>
          To rotate the current file, use one of the following
                  methods:
         </p>
         <div class="itemizedlist">
          <ul class="itemizedlist" style="list-style-type: square; ">
           <li class="listitem">
            <p>
             Run
             <code class="literal">
              SELECT audit_log_rotate();
             </code>
             to rename the file and open a new audit log file
                      using the original name.
            </p>
            <p>
             With this file rotation method, pruning of rotated
                      JSON-format log files occurs if
             <a class="link" href="audit-log-reference.html#sysvar_audit_log_max_size">
              <code class="literal">
               audit_log_max_size
              </code>
             </a>
             or
             <a class="link" href="audit-log-reference.html#sysvar_audit_log_prune_seconds">
              <code class="literal">
               audit_log_prune_seconds
              </code>
             </a>
             has a value greater than 0.
            </p>
           </li>
           <li class="listitem">
            <p>
             Manually rename the file, then enable
             <a class="link" href="audit-log-reference.html#sysvar_audit_log_flush">
              <code class="literal">
               audit_log_flush
              </code>
             </a>
             to close it and open a new current log file using
                      the original name. This file rotation method and
                      the
             <a class="link" href="audit-log-reference.html#sysvar_audit_log_flush">
              <code class="literal">
               audit_log_flush
              </code>
             </a>
             variable are deprecated.
            </p>
            <p>
             With this file rotation method, pruning of rotated
                      JSON-format log files does not occur;
             <a class="link" href="audit-log-reference.html#sysvar_audit_log_max_size">
              <code class="literal">
               audit_log_max_size
              </code>
             </a>
             and
             <a class="link" href="audit-log-reference.html#sysvar_audit_log_prune_seconds">
              <code class="literal">
               audit_log_prune_seconds
              </code>
             </a>
             have no effect.
            </p>
           </li>
          </ul>
         </div>
         <p>
          See
          <a class="xref" href="audit-log-logging-configuration.html#audit-log-manual-rotation" title="Manual Audit Log File Rotation">
           Manual Audit Log File Rotation
          </a>
          , for
                  more information.
         </p>
        </li>
       </ul>
      </div>
     </li>
     <li class="listitem">
      <p>
       If
       <a class="link" href="audit-log-reference.html#sysvar_audit_log_rotate_on_size">
        <code class="literal">
         audit_log_rotate_on_size
        </code>
       </a>
       is greater than 0, automatic audit log file rotation is
              enabled:
      </p>
      <div class="itemizedlist">
       <ul class="itemizedlist" style="list-style-type: circle; ">
        <li class="listitem">
         <p>
          Automatic rotation occurs when a write to the current
                  log file causes its size to exceed the
          <a class="link" href="audit-log-reference.html#sysvar_audit_log_rotate_on_size">
           <code class="literal">
            audit_log_rotate_on_size
           </code>
          </a>
          value, as well as under certain other conditions; see
          <a class="xref" href="audit-log-logging-configuration.html#audit-log-automatic-rotation" title="Automatic Audit Log File Rotation">
           Automatic Audit Log File Rotation
          </a>
          . When
                  automatic rotation occurs, the audit log plugin
                  renames the current log file and opens a new current
                  log file using the original name.
         </p>
        </li>
        <li class="listitem">
         <p>
          Pruning of rotated JSON-format log files occurs if
          <a class="link" href="audit-log-reference.html#sysvar_audit_log_max_size">
           <code class="literal">
            audit_log_max_size
           </code>
          </a>
          or
          <a class="link" href="audit-log-reference.html#sysvar_audit_log_prune_seconds">
           <code class="literal">
            audit_log_prune_seconds
           </code>
          </a>
          has a value greater than 0.
         </p>
        </li>
        <li class="listitem">
         <p>
          <a class="link" href="audit-log-reference.html#sysvar_audit_log_flush">
           <code class="literal">
            audit_log_flush
           </code>
          </a>
          has
                  no effect.
         </p>
        </li>
       </ul>
      </div>
     </li>
    </ul>
   </div>
   <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
    <div class="admon-title">
     Note
    </div>
    <p>
     For JSON-format log files, rotation also occurs when the
            value of the
     <a class="link" href="audit-log-reference.html#sysvar_audit_log_format_unix_timestamp">
      <code class="literal">
       audit_log_format_unix_timestamp
      </code>
     </a>
     system variable is changed at runtime. However, this does
            not occur for space-management purposes, but rather so that,
            for a given JSON-format log file, all records in the file
            either do or do not include the
     <code class="literal">
      time
     </code>
     field.
    </p>
   </div>
   <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
    <div class="admon-title">
     Note
    </div>
    <p>
     Rotated (renamed) log files are not removed automatically.
            For example, with size-based log file rotation, renamed log
            files have unique names and accumulate indefinitely. They do
            not rotate off the end of the name sequence. To avoid
            excessive use of space:
    </p>
    <div class="itemizedlist">
     <ul class="itemizedlist" style="list-style-type: disc; ">
      <li class="listitem">
       <p>
        For JSON-format log files: Enable log file pruning as
                described in
        <a class="xref" href="audit-log-logging-configuration.html#audit-log-pruning" title="Audit Log File Pruning">
         Audit Log File Pruning
        </a>
        .
       </p>
      </li>
      <li class="listitem">
       <p>
        Otherwise: Remove old files periodically, backing them
                up first as necessary. If backed-up log files are
                encrypted, also back up the corresponding encryption
                passwords to a safe place, should you need to decrypt
                the files later.
       </p>
      </li>
     </ul>
    </div>
   </div>
   <p>
    The following sections describe log file rotation and pruning
          in greater detail.
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       <a class="xref" href="audit-log-logging-configuration.html#audit-log-manual-rotation" title="Manual Audit Log File Rotation">
        Manual Audit Log File Rotation
       </a>
      </p>
     </li>
     <li class="listitem">
      <p>
       <a class="xref" href="audit-log-logging-configuration.html#audit-log-manual-rotation-old" title="Manual Audit Log File Rotation (Old Method)">
        Manual Audit Log File Rotation (Old Method)
       </a>
      </p>
     </li>
     <li class="listitem">
      <p>
       <a class="xref" href="audit-log-logging-configuration.html#audit-log-automatic-rotation" title="Automatic Audit Log File Rotation">
        Automatic Audit Log File Rotation
       </a>
      </p>
     </li>
     <li class="listitem">
      <p>
       <a class="xref" href="audit-log-logging-configuration.html#audit-log-pruning" title="Audit Log File Pruning">
        Audit Log File Pruning
       </a>
      </p>
     </li>
    </ul>
   </div>
   <h6>
    <a name="audit-log-manual-rotation">
    </a>
    Manual Audit Log File Rotation
   </h6>
   <p>
    If
    <a class="link" href="audit-log-reference.html#sysvar_audit_log_rotate_on_size">
     <code class="literal">
      audit_log_rotate_on_size
     </code>
    </a>
    is 0 (the default), no log rotation occurs unless performed
          manually.
   </p>
   <p>
    To rotate the audit log file manually, run
    <code class="literal">
     SELECT
          audit_log_rotate();
    </code>
    to rename the current audit log
          file and open a new audit log file. Files are renamed
          according to the conventions described in
    <a class="xref" href="audit-log-logging-configuration.html#audit-log-file-name" title="Naming Conventions for Audit Log Files">
     Naming Conventions for Audit Log Files
    </a>
    .
   </p>
   <p>
    The
    <a class="link" href="privileges-provided.html#priv_audit-admin">
     <code class="literal">
      AUDIT_ADMIN
     </code>
    </a>
    privilege is
          required to use the
    <a class="link" href="audit-log-reference.html#function_audit-log-rotate">
     <code class="literal">
      audit_log_rotate()
     </code>
    </a>
    function.
   </p>
   <p>
    Managing the number of archived log files (the files that have
          been renamed) and the space they use is a manual task that
          involves removing archived audit log files that are no longer
          needed from your file system.
   </p>
   <p>
    The content of audit log files that are renamed using the
    <code class="literal">
     audit_log_rotate()
    </code>
    function can be read by
    <a class="link" href="audit-log-reference.html#function_audit-log-read">
     <code class="literal">
      audit_log_read()
     </code>
    </a>
    function.
   </p>
   <h6>
    <a name="audit-log-manual-rotation-old">
    </a>
    Manual Audit Log File Rotation (Old Method)
   </h6>
   <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
    <div class="admon-title">
     Note
    </div>
    <p>
     The
     <a class="link" href="audit-log-reference.html#sysvar_audit_log_flush">
      <code class="literal">
       audit_log_flush
      </code>
     </a>
     variable and this method of audit log file rotation are
            deprecated; expect support to be removed in a future version
            of MySQL.
    </p>
   </div>
   <p>
    If
    <a class="link" href="audit-log-reference.html#sysvar_audit_log_rotate_on_size">
     <code class="literal">
      audit_log_rotate_on_size
     </code>
    </a>
    is 0 (the default), no log rotation occurs unless performed
          manually. In this case, the audit log plugin closes and
          reopens the log file when the
    <a class="link" href="audit-log-reference.html#sysvar_audit_log_flush">
     <code class="literal">
      audit_log_flush
     </code>
    </a>
    value changes
          from disabled to enabled. Log file renaming must be done
          externally to the server. Suppose that the log file name is
    <code class="filename">
     audit.log
    </code>
    and you want to maintain the
          three most recent log files, cycling through the names
    <code class="filename">
     audit.log.1
    </code>
    through
    <code class="filename">
     audit.log.3
    </code>
    . On Unix, perform rotation
          manually like this:
   </p>
   <div class="orderedlist">
    <ol class="orderedlist" type="1">
     <li class="listitem">
      <p>
       From the command line, rename the current log files:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-terminal"><div class="docs-select-all right" id="sa37063714"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-terminal">mv audit<span class="token punctuation">.</span>log<span class="token punctuation">.</span>2 audit<span class="token punctuation">.</span>log<span class="token punctuation">.</span>3
mv audit<span class="token punctuation">.</span>log<span class="token punctuation">.</span>1 audit<span class="token punctuation">.</span>log<span class="token punctuation">.</span>2
mv audit<span class="token punctuation">.</span>log audit<span class="token punctuation">.</span>log<span class="token punctuation">.</span>1</code></pre>
      </div>
      <p>
       This strategy overwrites the current
       <code class="filename">
        audit.log.3
       </code>
       contents, placing a bound
              on the number of archived log files and the space they
              use.
      </p>
     </li>
     <li class="listitem">
      <p>
       At this point, the plugin is still writing to the current
              log file, which has been renamed to
       <code class="filename">
        audit.log.1
       </code>
       . Connect to the server
              and flush the log file so the plugin closes it and reopens
              a new
       <code class="filename">
        audit.log
       </code>
       file:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa83062998"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">SET</span> <span class="token keyword">GLOBAL</span> audit_log_flush <span class="token operator">=</span> <span class="token keyword">ON</span><span class="token punctuation">;</span></code></pre>
      </div>
      <p>
       <a class="link" href="audit-log-reference.html#sysvar_audit_log_flush">
        <code class="literal">
         audit_log_flush
        </code>
       </a>
       is
              special in that its value remains
       <code class="literal">
        OFF
       </code>
       so that you need not disable it explicitly before enabling
              it again to perform another flush.
      </p>
     </li>
    </ol>
   </div>
   <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
    <div class="admon-title">
     Note
    </div>
    <p>
     If compression or encryption are enabled, log file names
            include suffixes that signify the enabled features, as well
            as a password ID if encryption is enabled. If file names
            include a password ID, be sure to retain the ID in the name
            of any files you rename manually so that the password to use
            for decryption operations can be determined.
    </p>
   </div>
   <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
    <div class="admon-title">
     Note
    </div>
    <p>
     For JSON-format logging, renaming audit log files manually
            makes them unavailable to the log-reading functions because
            the audit log plugin can no longer determine that they are
            part of the log file sequence (see
     <a class="xref" href="audit-log-file-reading.html" title="8.4.5.6 Reading Audit Log Files">
      Section 8.4.5.6, “Reading Audit Log Files”
     </a>
     ). Consider setting
     <a class="link" href="audit-log-reference.html#sysvar_audit_log_rotate_on_size">
      <code class="literal">
       audit_log_rotate_on_size
      </code>
     </a>
     greater than 0 to use size-based rotation instead.
    </p>
   </div>
   <h6>
    <a name="audit-log-automatic-rotation">
    </a>
    Automatic Audit Log File Rotation
   </h6>
   <p>
    If
    <a class="link" href="audit-log-reference.html#sysvar_audit_log_rotate_on_size">
     <code class="literal">
      audit_log_rotate_on_size
     </code>
    </a>
    is greater than 0, setting
    <a class="link" href="audit-log-reference.html#sysvar_audit_log_flush">
     <code class="literal">
      audit_log_flush
     </code>
    </a>
    has no
          effect. Instead, whenever a write to the current log file
          causes its size to exceed the
    <a class="link" href="audit-log-reference.html#sysvar_audit_log_rotate_on_size">
     <code class="literal">
      audit_log_rotate_on_size
     </code>
    </a>
    value, the audit log plugin automatically renames the current
          log file and opens a new current log file using the original
          name.
   </p>
   <p>
    Automatic size-based rotation also occurs under these
          conditions:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       During plugin initialization, if a file with the audit log
              file name already exists (see
       <a class="xref" href="audit-log-logging-configuration.html#audit-log-file-name" title="Naming Conventions for Audit Log Files">
        Naming Conventions for Audit Log Files
       </a>
       ).
      </p>
     </li>
     <li class="listitem">
      <p>
       During plugin termination.
      </p>
     </li>
     <li class="listitem">
      <p>
       When the
       <a class="link" href="audit-log-reference.html#function_audit-log-encryption-password-set">
        <code class="literal">
         audit_log_encryption_password_set()
        </code>
       </a>
       function is called to set the encryption password, if
              encryption is enabled. (Rotation does not occur if
              encryption is disabled.)
      </p>
     </li>
    </ul>
   </div>
   <p>
    The plugin renames the original file by inserting a timestamp
          just after its base name. For example, if the file name is
    <code class="filename">
     audit.log
    </code>
    , the plugin renames it to a
          value such as
    <code class="filename">
     audit.20210115T140633.log
    </code>
    .
          The timestamp is a UTC value in
    <code class="literal">
     <em class="replaceable">
      <code>
       YYYYMMDD
      </code>
     </em>
     T
     <em class="replaceable">
      <code>
       hhmmss
      </code>
     </em>
    </code>
    format. For XML logging, the timestamp indicates rotation
          time. For JSON logging, the timestamp is that of the last
          event written to the file.
   </p>
   <p>
    If log files are encrypted, the original file name already
          contains a timestamp indicating the encryption password
          creation time (see
    <a class="xref" href="audit-log-logging-configuration.html#audit-log-file-name" title="Naming Conventions for Audit Log Files">
     Naming Conventions for Audit Log Files
    </a>
    ). In
          this case, the file name after rotation contains two
          timestamps. For example, an encrypted log file named
    <code class="filename">
     audit.log.20210110T130749-1.enc
    </code>
    is
          renamed to a value such as
    <code class="filename">
     audit.20210115T140633.log.20210110T130749-1.enc
    </code>
    .
   </p>
   <h6>
    <a name="audit-log-pruning">
    </a>
    Audit Log File Pruning
   </h6>
   <p>
    The audit log plugin supports pruning of rotated JSON-format
          audit log files, if automatic log file rotation is enabled. To
          use this capability:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       Set
       <code class="literal">
        audit_log_format
       </code>
       to
       <code class="literal">
        JSON
       </code>
       . (In addition, consider also
              changing
       <a class="link" href="audit-log-reference.html#sysvar_audit_log_file">
        <code class="literal">
         audit_log_file
        </code>
       </a>
       ;
              see
       <a class="xref" href="audit-log-logging-configuration.html#audit-log-file-format" title="Selecting Audit Log File Format">
        Selecting Audit Log File Format
       </a>
       .)
      </p>
     </li>
     <li class="listitem">
      <p>
       Set
       <a class="link" href="audit-log-reference.html#sysvar_audit_log_rotate_on_size">
        <code class="literal">
         audit_log_rotate_on_size
        </code>
       </a>
       greater than 0 to specify the size in bytes at which
              automatic log file rotation occurs.
      </p>
     </li>
     <li class="listitem">
      <p>
       By default, no pruning of automatically rotated
              JSON-format log files occurs. To enable pruning, set one
              of these system variables to a value greater than 0:
      </p>
      <div class="itemizedlist">
       <ul class="itemizedlist" style="list-style-type: circle; ">
        <li class="listitem">
         <p>
          Set
          <a class="link" href="audit-log-reference.html#sysvar_audit_log_max_size">
           <code class="literal">
            audit_log_max_size
           </code>
          </a>
          greater than 0 to specify the limit in bytes on the
                  combined size of rotated log files above which the
                  files become subject to pruning.
         </p>
        </li>
        <li class="listitem">
         <p>
          Set
          <a class="link" href="audit-log-reference.html#sysvar_audit_log_prune_seconds">
           <code class="literal">
            audit_log_prune_seconds
           </code>
          </a>
          greater than 0 to specify the number of seconds after
                  which rotated log files become subject to pruning.
         </p>
        </li>
       </ul>
      </div>
      <p>
       Nonzero values of
       <a class="link" href="audit-log-reference.html#sysvar_audit_log_max_size">
        <code class="literal">
         audit_log_max_size
        </code>
       </a>
       take
              precedence over nonzero values of
       <a class="link" href="audit-log-reference.html#sysvar_audit_log_prune_seconds">
        <code class="literal">
         audit_log_prune_seconds
        </code>
       </a>
       .
              If both are set greater than 0 at plugin initialization, a
              warning is written to the server error log. If a client
              sets both greater than 0 at runtime, a warning is returned
              to the client.
      </p>
      <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
       <div class="admon-title">
        Note
       </div>
       <p>
        Warnings to the error log are written as Notes, which
                are information messages. To ensure that such messages
                appear in the error log and are not discarded, make sure
                that error-logging verbosity is sufficient to include
                information messages. For example, if you are using
                priority-based log filtering, as described in
        <a class="xref" href="error-log-priority-based-filtering.html" title="7.4.2.5 Priority-Based Error Log Filtering (log_filter_internal)">
         Section 7.4.2.5, “Priority-Based Error Log Filtering (log_filter_internal)”
        </a>
        ,
                set the
        <a class="link" href="server-system-variables.html#sysvar_log_error_verbosity">
         <code class="literal">
          log_error_verbosity
         </code>
        </a>
        system variable to a value of 3.
       </p>
      </div>
     </li>
    </ul>
   </div>
   <p>
    Pruning of JSON-format log files, if enabled, occurs as
          follows:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       When automatic rotation takes place; for the conditions
              under which this happens, see
       <a class="xref" href="audit-log-logging-configuration.html#audit-log-automatic-rotation" title="Automatic Audit Log File Rotation">
        Automatic Audit Log File Rotation
       </a>
       .
      </p>
     </li>
     <li class="listitem">
      <p>
       When the global
       <a class="link" href="audit-log-reference.html#sysvar_audit_log_max_size">
        <code class="literal">
         audit_log_max_size
        </code>
       </a>
       or
       <a class="link" href="audit-log-reference.html#sysvar_audit_log_prune_seconds">
        <code class="literal">
         audit_log_prune_seconds
        </code>
       </a>
       system variable is set at runtime.
      </p>
     </li>
    </ul>
   </div>
   <p>
    For pruning based on combined rotated log file size, if the
          combined size is greater than the limit specified by
    <a class="link" href="audit-log-reference.html#sysvar_audit_log_max_size">
     <code class="literal">
      audit_log_max_size
     </code>
    </a>
    , the audit
          log plugin removes the oldest files until their combined size
          does not exceed the limit.
   </p>
   <p>
    For pruning based on rotated log file age, the pruning point
          is the current time minus the value of
    <a class="link" href="audit-log-reference.html#sysvar_audit_log_prune_seconds">
     <code class="literal">
      audit_log_prune_seconds
     </code>
    </a>
    . In
          rotated JSON-format log files, the timestamp part of each file
          name indicates the timestamp of the last event written to the
          file. The audit log plugin uses file name timestamps to
          determine which files contain only events older than the
          pruning point, and removes them.
   </p>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h5 class="title">
       <a name="audit-log-strategy">
       </a>
       Write Strategies for Audit Logging
      </h5>
     </div>
    </div>
   </div>
   <p>
    The audit log plugin can use any of several strategies for log
          writes. Regardless of strategy, logging occurs on a
          best-effort basis, with no guarantee of consistency.
   </p>
   <p>
    To specify a write strategy, set the
    <a class="link" href="audit-log-reference.html#sysvar_audit_log_strategy">
     <code class="literal">
      audit_log_strategy
     </code>
    </a>
    system
          variable at server startup. By default, the strategy value is
    <code class="literal">
     ASYNCHRONOUS
    </code>
    and the plugin logs
          asynchronously to a buffer, waiting if the buffer is full. You
          can tell the plugin not to wait
          (
    <code class="literal">
     PERFORMANCE
    </code>
    ) or to log synchronously,
          either using file system caching
          (
    <code class="literal">
     SEMISYNCHRONOUS
    </code>
    ) or forcing output with a
    <code class="literal">
     sync()
    </code>
    call after each write request
          (
    <code class="literal">
     SYNCHRONOUS
    </code>
    ).
   </p>
   <p>
    In many cases, the plugin writes directly to a JSON-format
          audit log if the current query is too large for the buffer.
          The write strategy determines how the plugin increments the
          direct write count. You can track the number direct writes
          with the
    <a class="link" href="audit-log-reference.html#statvar_Audit_log_direct_writes">
     <code class="literal">
      Audit_log_direct_writes
     </code>
    </a>
    status variable.
   </p>
   <p>
    For asynchronous write strategy, the
    <a class="link" href="audit-log-reference.html#sysvar_audit_log_buffer_size">
     <code class="literal">
      audit_log_buffer_size
     </code>
    </a>
    system
          variable is the buffer size in bytes. Set this variable at
          server startup to change the buffer size. The plugin uses a
          single buffer, which it allocates when it initializes and
          removes when it terminates. The plugin does not allocate this
          buffer for nonasynchronous write strategies.
   </p>
   <p>
    Asynchronous logging strategy has these characteristics:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       Minimal impact on server performance and scalability.
      </p>
     </li>
     <li class="listitem">
      <p>
       Blocking of threads that generate audit events for the
              shortest possible time; that is, time to allocate the
              buffer plus time to copy the event to the buffer.
      </p>
     </li>
     <li class="listitem">
      <p>
       Output goes to the buffer. A separate thread handles
              writes from the buffer to the log file.
      </p>
     </li>
    </ul>
   </div>
   <p>
    With asynchronous logging, the integrity of the log file may
          be compromised if a problem occurs during a write to the file
          or if the plugin does not shut down cleanly (for example, in
          the event that the server host exits unexpectedly). To reduce
          this risk, set
    <a class="link" href="audit-log-reference.html#sysvar_audit_log_strategy">
     <code class="literal">
      audit_log_strategy
     </code>
    </a>
    to use
          synchronous logging.
   </p>
   <p>
    A disadvantage of
    <code class="literal">
     PERFORMANCE
    </code>
    strategy is
          that it drops events when the buffer is full. For a heavily
          loaded server, the audit log may have events missing.
   </p>
  </div>
 </div>
 <br/>
</div>
