<div id="docs-body">
 <div class="section">
  <div class="titlepage">
   <div>
    <div>
     <h4 class="title">
      <a name="audit-log-filter-definitions">
      </a>
      8.4.5.8 Writing Audit Log Filter Definitions
     </h4>
    </div>
   </div>
  </div>
  <p>
   Filter definitions are
   <a class="link" href="json.html" title="13.5 The JSON Data Type">
    <code class="literal">
     JSON
    </code>
   </a>
   values. For information about using
   <a class="link" href="json.html" title="13.5 The JSON Data Type">
    <code class="literal">
     JSON
    </code>
   </a>
   data in MySQL, see
   <a class="xref" href="json.html" title="13.5 The JSON Data Type">
    Section 13.5, “The JSON Data Type”
   </a>
   .
  </p>
  <p>
   Filter definitions have this form, where
   <em class="replaceable">
    <code>
     actions
    </code>
   </em>
   indicates how filtering takes
        place:
  </p>
  <div class="copytoclipboard-wrapper">
   <pre class="programlisting one-line language-json"><div class="docs-select-all right" id="sa48588991"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-json"><span class="token punctuation">{</span> <span class="token property">"filter"</span><span class="token operator">:</span> <em class="replaceable">actions</em> <span class="token punctuation">}</span></code></pre>
  </div>
  <p>
   The following discussion describes permitted constructs in
        filter definitions.
  </p>
  <div class="itemizedlist">
   <ul class="itemizedlist" style="list-style-type: disc; ">
    <li class="listitem">
     <p>
      <a class="xref" href="audit-log-filter-definitions.html#audit-log-filtering-enabling-logging" title="Logging All Events">
       Logging All Events
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="audit-log-filter-definitions.html#audit-log-filtering-class-logging" title="Logging Specific Event Classes">
       Logging Specific Event Classes
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="audit-log-filter-definitions.html#audit-log-filtering-subclass-logging" title="Logging Specific Event Subclasses">
       Logging Specific Event Subclasses
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="audit-log-filter-definitions.html#audit-log-filtering-inclusive-exclusive" title="Inclusive and Exclusive Logging">
       Inclusive and Exclusive Logging
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="audit-log-filter-definitions.html#audit-log-filtering-event-fields" title="Testing Event Field Values">
       Testing Event Field Values
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="audit-log-filter-definitions.html#audit-log-filtering-blocking-events" title="Blocking Execution of Specific Events">
       Blocking Execution of Specific Events
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="audit-log-filter-definitions.html#audit-log-filtering-logical-operators" title="Logical Operators">
       Logical Operators
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="audit-log-filter-definitions.html#audit-log-filtering-predefined-variables" title="Referencing Predefined Variables">
       Referencing Predefined Variables
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="audit-log-filter-definitions.html#audit-log-filtering-predefined-functions" title="Referencing Predefined Functions">
       Referencing Predefined Functions
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="audit-log-filter-definitions.html#audit-log-filtering-field-replacement" title="Replacement of Event Field Values">
       Replacement of Event Field Values
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="audit-log-filter-definitions.html#audit-log-filtering-filter-replacement" title="Replacing a User Filter">
       Replacing a User Filter
      </a>
     </p>
    </li>
   </ul>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h5 class="title">
       <a name="audit-log-filtering-enabling-logging">
       </a>
       Logging All Events
      </h5>
     </div>
    </div>
   </div>
   <p>
    To explicitly enable or disable logging of all events, use a
    <code class="literal">
     log
    </code>
    item in the filter:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-json"><div class="docs-select-all right" id="sa91955043"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-json"><span class="token punctuation">{</span>
  <span class="token property">"filter"</span><span class="token operator">:</span> <span class="token punctuation">{</span> <span class="token property">"log"</span><span class="token operator">:</span> <span class="token boolean">true</span> <span class="token punctuation">}</span>
<span class="token punctuation">}</span></code></pre>
   </div>
   <p>
    The
    <code class="literal">
     log
    </code>
    value can be either
    <code class="literal">
     true
    </code>
    or
    <code class="literal">
     false
    </code>
    .
   </p>
   <p>
    The preceding filter enables logging of all events. It is
          equivalent to:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-json"><div class="docs-select-all right" id="sa12962291"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-json"><span class="token punctuation">{</span>
  <span class="token property">"filter"</span><span class="token operator">:</span> <span class="token punctuation">{</span> <span class="token punctuation">}</span>
<span class="token punctuation">}</span></code></pre>
   </div>
   <p>
    Logging behavior depends on the
    <code class="literal">
     log
    </code>
    value
          and whether
    <code class="literal">
     class
    </code>
    or
    <code class="literal">
     event
    </code>
    items are specified:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       With
       <code class="literal">
        log
       </code>
       specified, its given value is
              used.
      </p>
     </li>
     <li class="listitem">
      <p>
       Without
       <code class="literal">
        log
       </code>
       specified, logging is
       <code class="literal">
        true
       </code>
       if no
       <code class="literal">
        class
       </code>
       or
       <code class="literal">
        event
       </code>
       item is specified, and
       <code class="literal">
        false
       </code>
       otherwise (in which case,
       <code class="literal">
        class
       </code>
       or
       <code class="literal">
        event
       </code>
       can
              include their own
       <code class="literal">
        log
       </code>
       item).
      </p>
     </li>
    </ul>
   </div>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h5 class="title">
       <a name="audit-log-filtering-class-logging">
       </a>
       Logging Specific Event Classes
      </h5>
     </div>
    </div>
   </div>
   <p>
    To log events of a specific class, use a
    <code class="literal">
     class
    </code>
    item in the filter, with its
    <code class="literal">
     name
    </code>
    field denoting the name of the class
          to log:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-json"><div class="docs-select-all right" id="sa94303265"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-json"><span class="token punctuation">{</span>
  <span class="token property">"filter"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
    <span class="token property">"class"</span><span class="token operator">:</span> <span class="token punctuation">{</span> <span class="token property">"name"</span><span class="token operator">:</span> <span class="token string">"connection"</span> <span class="token punctuation">}</span>
  <span class="token punctuation">}</span>
<span class="token punctuation">}</span></code></pre>
   </div>
   <p>
    The
    <code class="literal">
     name
    </code>
    value can be
    <code class="literal">
     connection
    </code>
    ,
    <code class="literal">
     general
    </code>
    , or
    <code class="literal">
     table_access
    </code>
    to log connection, general, or
          table-access events, respectively.
   </p>
   <p>
    The preceding filter enables logging of events in the
    <code class="literal">
     connection
    </code>
    class. It is equivalent to the
          following filter with
    <code class="literal">
     log
    </code>
    items made
          explicit:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-json"><div class="docs-select-all right" id="sa15188825"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-json"><span class="token punctuation">{</span>
  <span class="token property">"filter"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
    <span class="token property">"log"</span><span class="token operator">:</span> <span class="token boolean">false</span><span class="token punctuation">,</span>
    <span class="token property">"class"</span><span class="token operator">:</span> <span class="token punctuation">{</span> <span class="token property">"log"</span><span class="token operator">:</span> <span class="token boolean">true</span><span class="token punctuation">,</span>
               <span class="token property">"name"</span><span class="token operator">:</span> <span class="token string">"connection"</span> <span class="token punctuation">}</span>
  <span class="token punctuation">}</span>
<span class="token punctuation">}</span></code></pre>
   </div>
   <p>
    To enable logging of multiple classes, define the
    <code class="literal">
     class
    </code>
    value as a
    <a class="link" href="json.html" title="13.5 The JSON Data Type">
     <code class="literal">
      JSON
     </code>
    </a>
    array element that names
          the classes:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-json"><div class="docs-select-all right" id="sa12421093"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-json"><span class="token punctuation">{</span>
  <span class="token property">"filter"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
    <span class="token property">"class"</span><span class="token operator">:</span> <span class="token punctuation">[</span>
      <span class="token punctuation">{</span> <span class="token property">"name"</span><span class="token operator">:</span> <span class="token string">"connection"</span> <span class="token punctuation">}</span><span class="token punctuation">,</span>
      <span class="token punctuation">{</span> <span class="token property">"name"</span><span class="token operator">:</span> <span class="token string">"general"</span> <span class="token punctuation">}</span><span class="token punctuation">,</span>
      <span class="token punctuation">{</span> <span class="token property">"name"</span><span class="token operator">:</span> <span class="token string">"table_access"</span> <span class="token punctuation">}</span>
    <span class="token punctuation">]</span>
  <span class="token punctuation">}</span>
<span class="token punctuation">}</span></code></pre>
   </div>
   <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
    <div class="admon-title">
     Note
    </div>
    <p>
     When multiple instances of a given item appear at the same
            level within a filter definition, the item values can be
            combined into a single instance of that item within an array
            value. The preceding definition can be written like this:
    </p>
    <div class="copytoclipboard-wrapper">
     <pre class="programlisting language-json"><div class="docs-select-all right" id="sa87807845"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-json"><span class="token punctuation">{</span>
  <span class="token property">"filter"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
    <span class="token property">"class"</span><span class="token operator">:</span> <span class="token punctuation">[</span>
      <span class="token punctuation">{</span> <span class="token property">"name"</span><span class="token operator">:</span> <span class="token punctuation">[</span> <span class="token string">"connection"</span><span class="token punctuation">,</span> <span class="token string">"general"</span><span class="token punctuation">,</span> <span class="token string">"table_access"</span> <span class="token punctuation">]</span> <span class="token punctuation">}</span>
    <span class="token punctuation">]</span>
  <span class="token punctuation">}</span>
<span class="token punctuation">}</span></code></pre>
    </div>
   </div>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h5 class="title">
       <a name="audit-log-filtering-subclass-logging">
       </a>
       Logging Specific Event Subclasses
      </h5>
     </div>
    </div>
   </div>
   <p>
    To select specific event subclasses, use an
    <code class="literal">
     event
    </code>
    item containing a
    <code class="literal">
     name
    </code>
    item that names the subclasses. The
          default action for events selected by an
    <code class="literal">
     event
    </code>
    item is to log them. For example,
          this filter enables logging for the named event subclasses:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-json"><div class="docs-select-all right" id="sa69789163"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-json"><span class="token punctuation">{</span>
  <span class="token property">"filter"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
    <span class="token property">"class"</span><span class="token operator">:</span> <span class="token punctuation">[</span>
      <span class="token punctuation">{</span>
        <span class="token property">"name"</span><span class="token operator">:</span> <span class="token string">"connection"</span><span class="token punctuation">,</span>
        <span class="token property">"event"</span><span class="token operator">:</span> <span class="token punctuation">[</span>
          <span class="token punctuation">{</span> <span class="token property">"name"</span><span class="token operator">:</span> <span class="token string">"connect"</span> <span class="token punctuation">}</span><span class="token punctuation">,</span>
          <span class="token punctuation">{</span> <span class="token property">"name"</span><span class="token operator">:</span> <span class="token string">"disconnect"</span> <span class="token punctuation">}</span>
        <span class="token punctuation">]</span>
      <span class="token punctuation">}</span><span class="token punctuation">,</span>
      <span class="token punctuation">{</span> <span class="token property">"name"</span><span class="token operator">:</span> <span class="token string">"general"</span> <span class="token punctuation">}</span><span class="token punctuation">,</span>
      <span class="token punctuation">{</span>
        <span class="token property">"name"</span><span class="token operator">:</span> <span class="token string">"table_access"</span><span class="token punctuation">,</span>
        <span class="token property">"event"</span><span class="token operator">:</span> <span class="token punctuation">[</span>
          <span class="token punctuation">{</span> <span class="token property">"name"</span><span class="token operator">:</span> <span class="token string">"insert"</span> <span class="token punctuation">}</span><span class="token punctuation">,</span>
          <span class="token punctuation">{</span> <span class="token property">"name"</span><span class="token operator">:</span> <span class="token string">"delete"</span> <span class="token punctuation">}</span><span class="token punctuation">,</span>
          <span class="token punctuation">{</span> <span class="token property">"name"</span><span class="token operator">:</span> <span class="token string">"update"</span> <span class="token punctuation">}</span>
        <span class="token punctuation">]</span>
      <span class="token punctuation">}</span>
    <span class="token punctuation">]</span>
  <span class="token punctuation">}</span>
<span class="token punctuation">}</span></code></pre>
   </div>
   <p>
    The
    <code class="literal">
     event
    </code>
    item can also contain explicit
    <code class="literal">
     log
    </code>
    items to indicate whether to log
          qualifying events. This
    <code class="literal">
     event
    </code>
    item selects
          multiple events and explicitly indicates logging behavior for
          them:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-json"><div class="docs-select-all right" id="sa50537859"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-json"><span class="token property">"event"</span><span class="token operator">:</span> <span class="token punctuation">[</span>
  <span class="token punctuation">{</span> <span class="token property">"name"</span><span class="token operator">:</span> <span class="token string">"read"</span><span class="token punctuation">,</span> <span class="token property">"log"</span><span class="token operator">:</span> <span class="token boolean">false</span> <span class="token punctuation">}</span><span class="token punctuation">,</span>
  <span class="token punctuation">{</span> <span class="token property">"name"</span><span class="token operator">:</span> <span class="token string">"insert"</span><span class="token punctuation">,</span> <span class="token property">"log"</span><span class="token operator">:</span> <span class="token boolean">true</span> <span class="token punctuation">}</span><span class="token punctuation">,</span>
  <span class="token punctuation">{</span> <span class="token property">"name"</span><span class="token operator">:</span> <span class="token string">"delete"</span><span class="token punctuation">,</span> <span class="token property">"log"</span><span class="token operator">:</span> <span class="token boolean">true</span> <span class="token punctuation">}</span><span class="token punctuation">,</span>
  <span class="token punctuation">{</span> <span class="token property">"name"</span><span class="token operator">:</span> <span class="token string">"update"</span><span class="token punctuation">,</span> <span class="token property">"log"</span><span class="token operator">:</span> <span class="token boolean">true</span> <span class="token punctuation">}</span>
<span class="token punctuation">]</span></code></pre>
   </div>
   <p>
    The
    <code class="literal">
     event
    </code>
    item can also indicate whether to
          block qualifying events, if it contains an
    <code class="literal">
     abort
    </code>
    item. For details, see
    <a class="xref" href="audit-log-filter-definitions.html#audit-log-filtering-blocking-events" title="Blocking Execution of Specific Events">
     Blocking Execution of Specific Events
    </a>
    .
   </p>
   <p>
    <a class="xref" href="audit-log-filter-definitions.html#audit-log-event-subclass-combinations" title="Table 8.34 Event Class and Subclass Combinations">
     Table 8.34, “Event Class and Subclass Combinations”
    </a>
    describes the permitted subclass values for each event class.
   </p>
   <div class="table">
    <a name="audit-log-event-subclass-combinations">
    </a>
    <p class="title">
     <b>
      Table 8.34 Event Class and Subclass Combinations
     </b>
    </p>
    <div class="table-contents">
     <table summary="Permitted combiniations of event class and subclass values.">
      <colgroup>
       <col style="width: 20%"/>
       <col style="width: 20%"/>
       <col style="width: 60%"/>
      </colgroup>
      <thead>
       <tr>
        <th scope="col">
         Event Class
        </th>
        <th scope="col">
         Event Subclass
        </th>
        <th scope="col">
         Description
        </th>
       </tr>
      </thead>
      <tbody>
       <tr>
        <th scope="row">
         <code class="literal">
          connection
         </code>
        </th>
        <td>
         <code class="literal">
          connect
         </code>
        </td>
        <td>
         Connection initiation (successful or unsuccessful)
        </td>
       </tr>
       <tr>
        <th scope="row">
         <code class="literal">
          connection
         </code>
        </th>
        <td>
         <code class="literal">
          change_user
         </code>
        </td>
        <td>
         User re-authentication with different user/password during session
        </td>
       </tr>
       <tr>
        <th scope="row">
         <code class="literal">
          connection
         </code>
        </th>
        <td>
         <code class="literal">
          disconnect
         </code>
        </td>
        <td>
         Connection termination
        </td>
       </tr>
       <tr>
        <th scope="row">
         <code class="literal">
          general
         </code>
        </th>
        <td>
         <code class="literal">
          status
         </code>
        </td>
        <td>
         General operation information
        </td>
       </tr>
       <tr>
        <th scope="row">
         <code class="literal">
          message
         </code>
        </th>
        <td>
         <code class="literal">
          internal
         </code>
        </td>
        <td>
         Internally generated message
        </td>
       </tr>
       <tr>
        <th scope="row">
         <code class="literal">
          message
         </code>
        </th>
        <td>
         <code class="literal">
          user
         </code>
        </td>
        <td>
         Message generated by
         <a class="link" href="audit-api-message-emit.html#function_audit-api-message-emit-udf">
          <code class="literal">
           audit_api_message_emit_udf()
          </code>
         </a>
        </td>
       </tr>
       <tr>
        <th scope="row">
         <code class="literal">
          table_access
         </code>
        </th>
        <td>
         <code class="literal">
          read
         </code>
        </td>
        <td>
         Table read statements, such as
         <a class="link" href="select.html" title="15.2.13 SELECT Statement">
          <code class="literal">
           SELECT
          </code>
         </a>
         or
         <a class="link" href="insert-select.html" title="15.2.7.1 INSERT ... SELECT Statement">
          <code class="literal">
           INSERT
                INTO ... SELECT
          </code>
         </a>
        </td>
       </tr>
       <tr>
        <th scope="row">
         <code class="literal">
          table_access
         </code>
        </th>
        <td>
         <code class="literal">
          delete
         </code>
        </td>
        <td>
         Table delete statements, such as
         <a class="link" href="delete.html" title="15.2.2 DELETE Statement">
          <code class="literal">
           DELETE
          </code>
         </a>
         or
         <a class="link" href="truncate-table.html" title="15.1.37 TRUNCATE TABLE Statement">
          <code class="literal">
           TRUNCATE TABLE
          </code>
         </a>
        </td>
       </tr>
       <tr>
        <th scope="row">
         <code class="literal">
          table_access
         </code>
        </th>
        <td>
         <code class="literal">
          insert
         </code>
        </td>
        <td>
         Table insert statements, such as
         <a class="link" href="insert.html" title="15.2.7 INSERT Statement">
          <code class="literal">
           INSERT
          </code>
         </a>
         or
         <a class="link" href="replace.html" title="15.2.12 REPLACE Statement">
          <code class="literal">
           REPLACE
          </code>
         </a>
        </td>
       </tr>
       <tr>
        <th scope="row">
         <code class="literal">
          table_access
         </code>
        </th>
        <td>
         <code class="literal">
          update
         </code>
        </td>
        <td>
         Table update statements, such as
         <a class="link" href="update.html" title="15.2.17 UPDATE Statement">
          <code class="literal">
           UPDATE
          </code>
         </a>
        </td>
       </tr>
      </tbody>
     </table>
    </div>
    <div class="table-contents">
     <table cellpadding="0" cellspacing="0" style="position: fixed; top: 0px; display: none; left: 401px; width: 739px;">
      <thead>
       <tr>
        <th scope="col" style="width: 147.594px;">
         Event Class
        </th>
        <th scope="col" style="width: 147.594px;">
         Event Subclass
        </th>
        <th scope="col" style="width: 442.812px;">
         Description
        </th>
       </tr>
      </thead>
     </table>
    </div>
   </div>
   <br class="table-break"/>
   <p>
    <a class="xref" href="audit-log-filter-definitions.html#audit-log-event-subclass-log-abort" title="Table 8.35 Log and Abort Characteristics Per Event Class and Subclass Combination">
     Table 8.35, “Log and Abort Characteristics Per Event Class and Subclass Combination”
    </a>
    describes
          for each event subclass whether it can be logged or aborted.
   </p>
   <div class="table">
    <a name="audit-log-event-subclass-log-abort">
    </a>
    <p class="title">
     <b>
      Table 8.35 Log and Abort Characteristics Per Event Class and Subclass Combination
     </b>
    </p>
    <div class="table-contents">
     <table summary="Log and abort characteristics for event class and subclass combinations.">
      <colgroup>
       <col style="width: 20%"/>
       <col style="width: 20%"/>
       <col style="width: 30%"/>
       <col style="width: 30%"/>
      </colgroup>
      <thead>
       <tr>
        <th scope="col">
         Event Class
        </th>
        <th scope="col">
         Event Subclass
        </th>
        <th scope="col">
         Can be Logged
        </th>
        <th scope="col">
         Can be Aborted
        </th>
       </tr>
      </thead>
      <tbody>
       <tr>
        <th scope="row">
         <code class="literal">
          connection
         </code>
        </th>
        <td>
         <code class="literal">
          connect
         </code>
        </td>
        <td>
         Yes
        </td>
        <td>
         No
        </td>
       </tr>
       <tr>
        <th scope="row">
         <code class="literal">
          connection
         </code>
        </th>
        <td>
         <code class="literal">
          change_user
         </code>
        </td>
        <td>
         Yes
        </td>
        <td>
         No
        </td>
       </tr>
       <tr>
        <th scope="row">
         <code class="literal">
          connection
         </code>
        </th>
        <td>
         <code class="literal">
          disconnect
         </code>
        </td>
        <td>
         Yes
        </td>
        <td>
         No
        </td>
       </tr>
       <tr>
        <th scope="row">
         <code class="literal">
          general
         </code>
        </th>
        <td>
         <code class="literal">
          status
         </code>
        </td>
        <td>
         Yes
        </td>
        <td>
         No
        </td>
       </tr>
       <tr>
        <th scope="row">
         <code class="literal">
          message
         </code>
        </th>
        <td>
         <code class="literal">
          internal
         </code>
        </td>
        <td>
         Yes
        </td>
        <td>
         Yes
        </td>
       </tr>
       <tr>
        <th scope="row">
         <code class="literal">
          message
         </code>
        </th>
        <td>
         <code class="literal">
          user
         </code>
        </td>
        <td>
         Yes
        </td>
        <td>
         Yes
        </td>
       </tr>
       <tr>
        <th scope="row">
         <code class="literal">
          table_access
         </code>
        </th>
        <td>
         <code class="literal">
          read
         </code>
        </td>
        <td>
         Yes
        </td>
        <td>
         Yes
        </td>
       </tr>
       <tr>
        <th scope="row">
         <code class="literal">
          table_access
         </code>
        </th>
        <td>
         <code class="literal">
          delete
         </code>
        </td>
        <td>
         Yes
        </td>
        <td>
         Yes
        </td>
       </tr>
       <tr>
        <th scope="row">
         <code class="literal">
          table_access
         </code>
        </th>
        <td>
         <code class="literal">
          insert
         </code>
        </td>
        <td>
         Yes
        </td>
        <td>
         Yes
        </td>
       </tr>
       <tr>
        <th scope="row">
         <code class="literal">
          table_access
         </code>
        </th>
        <td>
         <code class="literal">
          update
         </code>
        </td>
        <td>
         Yes
        </td>
        <td>
         Yes
        </td>
       </tr>
      </tbody>
     </table>
    </div>
    <div class="table-contents">
     <table cellpadding="0" cellspacing="0" style="position: fixed; top: 0px; display: none; left: 401px; width: 558px;">
      <thead>
       <tr>
        <th scope="col" style="width: 111.453px;">
         Event Class
        </th>
        <th scope="col" style="width: 111.453px;">
         Event Subclass
        </th>
        <th scope="col" style="width: 167.172px;">
         Can be Logged
        </th>
        <th scope="col" style="width: 167.188px;">
         Can be Aborted
        </th>
       </tr>
      </thead>
     </table>
    </div>
   </div>
   <br class="table-break"/>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h5 class="title">
       <a name="audit-log-filtering-inclusive-exclusive">
       </a>
       Inclusive and Exclusive Logging
      </h5>
     </div>
    </div>
   </div>
   <p>
    A filter can be defined in inclusive or exclusive mode:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       Inclusive mode logs only explicitly specified items.
      </p>
     </li>
     <li class="listitem">
      <p>
       Exclusive mode logs everything but explicitly specified
              items.
      </p>
     </li>
    </ul>
   </div>
   <p>
    To perform inclusive logging, disable logging globally and
          enable logging for specific classes. This filter logs
    <code class="literal">
     connect
    </code>
    and
    <code class="literal">
     disconnect
    </code>
    events in the
    <code class="literal">
     connection
    </code>
    class, and events
          in the
    <code class="literal">
     general
    </code>
    class:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-json"><div class="docs-select-all right" id="sa91814338"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-json"><span class="token punctuation">{</span>
  <span class="token property">"filter"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
    <span class="token property">"log"</span><span class="token operator">:</span> <span class="token boolean">false</span><span class="token punctuation">,</span>
    <span class="token property">"class"</span><span class="token operator">:</span> <span class="token punctuation">[</span>
      <span class="token punctuation">{</span>
        <span class="token property">"name"</span><span class="token operator">:</span> <span class="token string">"connection"</span><span class="token punctuation">,</span>
        <span class="token property">"event"</span><span class="token operator">:</span> <span class="token punctuation">[</span>
          <span class="token punctuation">{</span> <span class="token property">"name"</span><span class="token operator">:</span> <span class="token string">"connect"</span><span class="token punctuation">,</span> <span class="token property">"log"</span><span class="token operator">:</span> <span class="token boolean">true</span> <span class="token punctuation">}</span><span class="token punctuation">,</span>
          <span class="token punctuation">{</span> <span class="token property">"name"</span><span class="token operator">:</span> <span class="token string">"disconnect"</span><span class="token punctuation">,</span> <span class="token property">"log"</span><span class="token operator">:</span> <span class="token boolean">true</span> <span class="token punctuation">}</span>
        <span class="token punctuation">]</span>
      <span class="token punctuation">}</span><span class="token punctuation">,</span>
      <span class="token punctuation">{</span> <span class="token property">"name"</span><span class="token operator">:</span> <span class="token string">"general"</span><span class="token punctuation">,</span> <span class="token property">"log"</span><span class="token operator">:</span> <span class="token boolean">true</span> <span class="token punctuation">}</span>
    <span class="token punctuation">]</span>
  <span class="token punctuation">}</span>
<span class="token punctuation">}</span></code></pre>
   </div>
   <p>
    To perform exclusive logging, enable logging globally and
          disable logging for specific classes. This filter logs
          everything except events in the
    <code class="literal">
     general
    </code>
    class:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-json"><div class="docs-select-all right" id="sa54411983"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-json"><span class="token punctuation">{</span>
  <span class="token property">"filter"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
    <span class="token property">"log"</span><span class="token operator">:</span> <span class="token boolean">true</span><span class="token punctuation">,</span>
    <span class="token property">"class"</span><span class="token operator">:</span>
      <span class="token punctuation">{</span> <span class="token property">"name"</span><span class="token operator">:</span> <span class="token string">"general"</span><span class="token punctuation">,</span> <span class="token property">"log"</span><span class="token operator">:</span> <span class="token boolean">false</span> <span class="token punctuation">}</span>
  <span class="token punctuation">}</span>
<span class="token punctuation">}</span></code></pre>
   </div>
   <p>
    This filter logs
    <code class="literal">
     change_user
    </code>
    events in the
    <code class="literal">
     connection
    </code>
    class,
    <code class="literal">
     message
    </code>
    events, and
    <code class="literal">
     table_access
    </code>
    events, by virtue of
    <span class="emphasis">
     <em>
      not
     </em>
    </span>
    logging everything else:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-json"><div class="docs-select-all right" id="sa30320516"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-json"><span class="token punctuation">{</span>
  <span class="token property">"filter"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
    <span class="token property">"log"</span><span class="token operator">:</span> <span class="token boolean">true</span><span class="token punctuation">,</span>
    <span class="token property">"class"</span><span class="token operator">:</span> <span class="token punctuation">[</span>
      <span class="token punctuation">{</span>
        <span class="token property">"name"</span><span class="token operator">:</span> <span class="token string">"connection"</span><span class="token punctuation">,</span>
        <span class="token property">"event"</span><span class="token operator">:</span> <span class="token punctuation">[</span>
          <span class="token punctuation">{</span> <span class="token property">"name"</span><span class="token operator">:</span> <span class="token string">"connect"</span><span class="token punctuation">,</span> <span class="token property">"log"</span><span class="token operator">:</span> <span class="token boolean">false</span> <span class="token punctuation">}</span><span class="token punctuation">,</span>
          <span class="token punctuation">{</span> <span class="token property">"name"</span><span class="token operator">:</span> <span class="token string">"disconnect"</span><span class="token punctuation">,</span> <span class="token property">"log"</span><span class="token operator">:</span> <span class="token boolean">false</span> <span class="token punctuation">}</span>
        <span class="token punctuation">]</span>
      <span class="token punctuation">}</span><span class="token punctuation">,</span>
      <span class="token punctuation">{</span> <span class="token property">"name"</span><span class="token operator">:</span> <span class="token string">"general"</span><span class="token punctuation">,</span> <span class="token property">"log"</span><span class="token operator">:</span> <span class="token boolean">false</span> <span class="token punctuation">}</span>
    <span class="token punctuation">]</span>
  <span class="token punctuation">}</span>
<span class="token punctuation">}</span></code></pre>
   </div>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h5 class="title">
       <a name="audit-log-filtering-event-fields">
       </a>
       Testing Event Field Values
      </h5>
     </div>
    </div>
   </div>
   <p>
    To enable logging based on specific event field values,
          specify a
    <code class="literal">
     field
    </code>
    item within the
    <code class="literal">
     log
    </code>
    item that indicates the field name and
          its expected value:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-json"><div class="docs-select-all right" id="sa39632174"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-json"><span class="token punctuation">{</span>
  <span class="token property">"filter"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
    <span class="token property">"class"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
    <span class="token property">"name"</span><span class="token operator">:</span> <span class="token string">"general"</span><span class="token punctuation">,</span>
      <span class="token property">"event"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
        <span class="token property">"name"</span><span class="token operator">:</span> <span class="token string">"status"</span><span class="token punctuation">,</span>
        <span class="token property">"log"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
          <span class="token property">"field"</span><span class="token operator">:</span> <span class="token punctuation">{</span> <span class="token property">"name"</span><span class="token operator">:</span> <span class="token string">"general_command.str"</span><span class="token punctuation">,</span> <span class="token property">"value"</span><span class="token operator">:</span> <span class="token string">"Query"</span> <span class="token punctuation">}</span>
        <span class="token punctuation">}</span>
      <span class="token punctuation">}</span>
    <span class="token punctuation">}</span>
  <span class="token punctuation">}</span>
<span class="token punctuation">}</span></code></pre>
   </div>
   <p>
    Each event contains event class-specific fields that can be
          accessed from within a filter to perform custom filtering.
   </p>
   <p>
    An event in the
    <code class="literal">
     connection
    </code>
    class indicates
          when a connection-related activity occurs during a session,
          such as a user connecting to or disconnecting from the server.
    <a class="xref" href="audit-log-filter-definitions.html#audit-log-connection-event-fields" title="Table 8.36 Connection Event Fields">
     Table 8.36, “Connection Event Fields”
    </a>
    indicates
          the permitted fields for
    <code class="literal">
     connection
    </code>
    events.
   </p>
   <div class="table">
    <a name="audit-log-connection-event-fields">
    </a>
    <p class="title">
     <b>
      Table 8.36 Connection Event Fields
     </b>
    </p>
    <div class="table-contents">
     <table summary="Permitted fields for connection events.">
      <colgroup>
       <col style="width: 35%"/>
       <col style="width: 20%"/>
       <col style="width: 45%"/>
      </colgroup>
      <thead>
       <tr>
        <th scope="col">
         Field Name
        </th>
        <th scope="col">
         Field Type
        </th>
        <th scope="col">
         Description
        </th>
       </tr>
      </thead>
      <tbody>
       <tr>
        <th scope="row">
         <code class="literal">
          status
         </code>
        </th>
        <td>
         integer
        </td>
        <td>
         <p class="valid-value">
          Event status:
         </p>
         <p class="valid-value">
          0: OK
         </p>
         <p class="valid-value">
          Otherwise: Failed
         </p>
        </td>
       </tr>
       <tr>
        <th scope="row">
         <code class="literal">
          connection_id
         </code>
        </th>
        <td>
         unsigned integer
        </td>
        <td>
         Connection ID
        </td>
       </tr>
       <tr>
        <th scope="row">
         <code class="literal">
          user.str
         </code>
        </th>
        <td>
         string
        </td>
        <td>
         User name specified during authentication
        </td>
       </tr>
       <tr>
        <th scope="row">
         <code class="literal">
          user.length
         </code>
        </th>
        <td>
         unsigned integer
        </td>
        <td>
         User name length
        </td>
       </tr>
       <tr>
        <th scope="row">
         <code class="literal">
          priv_user.str
         </code>
        </th>
        <td>
         string
        </td>
        <td>
         Authenticated user name (account user name)
        </td>
       </tr>
       <tr>
        <th scope="row">
         <code class="literal">
          priv_user.length
         </code>
        </th>
        <td>
         unsigned integer
        </td>
        <td>
         Authenticated user name length
        </td>
       </tr>
       <tr>
        <th scope="row">
         <code class="literal">
          external_user.str
         </code>
        </th>
        <td>
         string
        </td>
        <td>
         External user name (provided by third-party authentication plugin)
        </td>
       </tr>
       <tr>
        <th scope="row">
         <code class="literal">
          external_user.length
         </code>
        </th>
        <td>
         unsigned integer
        </td>
        <td>
         External user name length
        </td>
       </tr>
       <tr>
        <th scope="row">
         <code class="literal">
          proxy_user.str
         </code>
        </th>
        <td>
         string
        </td>
        <td>
         Proxy user name
        </td>
       </tr>
       <tr>
        <th scope="row">
         <code class="literal">
          proxy_user.length
         </code>
        </th>
        <td>
         unsigned integer
        </td>
        <td>
         Proxy user name length
        </td>
       </tr>
       <tr>
        <th scope="row">
         <code class="literal">
          host.str
         </code>
        </th>
        <td>
         string
        </td>
        <td>
         Connected user host
        </td>
       </tr>
       <tr>
        <th scope="row">
         <code class="literal">
          host.length
         </code>
        </th>
        <td>
         unsigned integer
        </td>
        <td>
         Connected user host length
        </td>
       </tr>
       <tr>
        <th scope="row">
         <code class="literal">
          ip.str
         </code>
        </th>
        <td>
         string
        </td>
        <td>
         Connected user IP address
        </td>
       </tr>
       <tr>
        <th scope="row">
         <code class="literal">
          ip.length
         </code>
        </th>
        <td>
         unsigned integer
        </td>
        <td>
         Connected user IP address length
        </td>
       </tr>
       <tr>
        <th scope="row">
         <code class="literal">
          database.str
         </code>
        </th>
        <td>
         string
        </td>
        <td>
         Database name specified at connect time
        </td>
       </tr>
       <tr>
        <th scope="row">
         <code class="literal">
          database.length
         </code>
        </th>
        <td>
         unsigned integer
        </td>
        <td>
         Database name length
        </td>
       </tr>
       <tr>
        <th scope="row">
         <code class="literal">
          connection_type
         </code>
        </th>
        <td>
         integer
        </td>
        <td>
         <p class="valid-value">
          Connection type:
         </p>
         <p class="valid-value">
          0 or
          <code class="literal">
           "::undefined"
          </code>
          : Undefined
         </p>
         <p class="valid-value">
          1 or
          <code class="literal">
           "::tcp/ip"
          </code>
          : TCP/IP
         </p>
         <p class="valid-value">
          2 or
          <code class="literal">
           "::socket"
          </code>
          : Socket
         </p>
         <p class="valid-value">
          3 or
          <code class="literal">
           "::named_pipe"
          </code>
          : Named pipe
         </p>
         <p class="valid-value">
          4 or
          <code class="literal">
           "::ssl"
          </code>
          : TCP/IP with
                  encryption
         </p>
         <p class="valid-value">
          5 or
          <code class="literal">
           "::shared_memory"
          </code>
          : Shared
                  memory
         </p>
        </td>
       </tr>
      </tbody>
     </table>
    </div>
    <div class="table-contents">
     <table cellpadding="0" cellspacing="0" style="position: fixed; top: 0px; display: none; left: 401px; width: 739px;">
      <thead>
       <tr>
        <th scope="col" style="width: 258.297px;">
         Field Name
        </th>
        <th scope="col" style="width: 147.594px;">
         Field Type
        </th>
        <th scope="col" style="width: 332.109px;">
         Description
        </th>
       </tr>
      </thead>
     </table>
    </div>
   </div>
   <br class="table-break"/>
   <p>
    The
    <code class="literal">
     "::
     <em class="replaceable">
      <code>
       xxx
      </code>
     </em>
     "
    </code>
    values are symbolic pseudo-constants that may be given instead
          of the literal numeric values. They must be quoted as strings
          and are case-sensitive.
   </p>
   <p>
    An event in the
    <code class="literal">
     general
    </code>
    class indicates the
          status code of an operation and its details.
    <a class="xref" href="audit-log-filter-definitions.html#audit-log-general-event-fields" title="Table 8.37 General Event Fields">
     Table 8.37, “General Event Fields”
    </a>
    indicates the
          permitted fields for
    <code class="literal">
     general
    </code>
    events.
   </p>
   <div class="table">
    <a name="audit-log-general-event-fields">
    </a>
    <p class="title">
     <b>
      Table 8.37 General Event Fields
     </b>
    </p>
    <div class="table-contents">
     <table summary="Permitted field types for general events.">
      <colgroup>
       <col style="width: 35%"/>
       <col style="width: 20%"/>
       <col style="width: 45%"/>
      </colgroup>
      <thead>
       <tr>
        <th scope="col">
         Field Name
        </th>
        <th scope="col">
         Field Type
        </th>
        <th scope="col">
         Description
        </th>
       </tr>
      </thead>
      <tbody>
       <tr>
        <th scope="row">
         <code class="literal">
          general_error_code
         </code>
        </th>
        <td>
         integer
        </td>
        <td>
         <p class="valid-value">
          Event status:
         </p>
         <p class="valid-value">
          0: OK
         </p>
         <p class="valid-value">
          Otherwise: Failed
         </p>
        </td>
       </tr>
       <tr>
        <th scope="row">
         <code class="literal">
          general_thread_id
         </code>
        </th>
        <td>
         unsigned integer
        </td>
        <td>
         Connection/thread ID
        </td>
       </tr>
       <tr>
        <th scope="row">
         <code class="literal">
          general_user.str
         </code>
        </th>
        <td>
         string
        </td>
        <td>
         User name specified during authentication
        </td>
       </tr>
       <tr>
        <th scope="row">
         <code class="literal">
          general_user.length
         </code>
        </th>
        <td>
         unsigned integer
        </td>
        <td>
         User name length
        </td>
       </tr>
       <tr>
        <th scope="row">
         <code class="literal">
          general_command.str
         </code>
        </th>
        <td>
         string
        </td>
        <td>
         Command name
        </td>
       </tr>
       <tr>
        <th scope="row">
         <code class="literal">
          general_command.length
         </code>
        </th>
        <td>
         unsigned integer
        </td>
        <td>
         Command name length
        </td>
       </tr>
       <tr>
        <th scope="row">
         <code class="literal">
          general_query.str
         </code>
        </th>
        <td>
         string
        </td>
        <td>
         SQL statement text
        </td>
       </tr>
       <tr>
        <th scope="row">
         <code class="literal">
          general_query.length
         </code>
        </th>
        <td>
         unsigned integer
        </td>
        <td>
         SQL statement text length
        </td>
       </tr>
       <tr>
        <th scope="row">
         <code class="literal">
          general_host.str
         </code>
        </th>
        <td>
         string
        </td>
        <td>
         Host name
        </td>
       </tr>
       <tr>
        <th scope="row">
         <code class="literal">
          general_host.length
         </code>
        </th>
        <td>
         unsigned integer
        </td>
        <td>
         Host name length
        </td>
       </tr>
       <tr>
        <th scope="row">
         <code class="literal">
          general_sql_command.str
         </code>
        </th>
        <td>
         string
        </td>
        <td>
         SQL command type name
        </td>
       </tr>
       <tr>
        <th scope="row">
         <code class="literal">
          general_sql_command.length
         </code>
        </th>
        <td>
         unsigned integer
        </td>
        <td>
         SQL command type name length
        </td>
       </tr>
       <tr>
        <th scope="row">
         <code class="literal">
          general_external_user.str
         </code>
        </th>
        <td>
         string
        </td>
        <td>
         External user name (provided by third-party authentication plugin)
        </td>
       </tr>
       <tr>
        <th scope="row">
         <code class="literal">
          general_external_user.length
         </code>
        </th>
        <td>
         unsigned integer
        </td>
        <td>
         External user name length
        </td>
       </tr>
       <tr>
        <th scope="row">
         <code class="literal">
          general_ip.str
         </code>
        </th>
        <td>
         string
        </td>
        <td>
         Connected user IP address
        </td>
       </tr>
       <tr>
        <th scope="row">
         <code class="literal">
          general_ip.length
         </code>
        </th>
        <td>
         unsigned integer
        </td>
        <td>
         Connection user IP address length
        </td>
       </tr>
      </tbody>
     </table>
    </div>
    <div class="table-contents">
     <table cellpadding="0" cellspacing="0" style="position: fixed; top: 0px; display: none; left: 401px; width: 739px;">
      <thead>
       <tr>
        <th scope="col" style="width: 258.297px;">
         Field Name
        </th>
        <th scope="col" style="width: 147.594px;">
         Field Type
        </th>
        <th scope="col" style="width: 332.109px;">
         Description
        </th>
       </tr>
      </thead>
     </table>
    </div>
   </div>
   <br class="table-break"/>
   <p>
    <code class="literal">
     general_command.str
    </code>
    indicates a command
          name:
    <code class="literal">
     Query
    </code>
    ,
    <code class="literal">
     Execute
    </code>
    ,
    <code class="literal">
     Quit
    </code>
    , or
    <code class="literal">
     Change user
    </code>
    .
   </p>
   <p>
    A
    <code class="literal">
     general
    </code>
    event with the
    <code class="literal">
     general_command.str
    </code>
    field set to
    <code class="literal">
     Query
    </code>
    or
    <code class="literal">
     Execute
    </code>
    contains
    <code class="literal">
     general_sql_command.str
    </code>
    set to a
          value that specifies the type of SQL command:
    <code class="literal">
     alter_db
    </code>
    ,
    <code class="literal">
     alter_db_upgrade
    </code>
    ,
    <code class="literal">
     admin_commands
    </code>
    , and so forth. The available
    <code class="literal">
     general_sql_command.str
    </code>
    values can be seen
          as the last components of the Performance Schema instruments
          displayed by this statement:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa18676532"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token prompt">mysql&gt;</span> <span class="token keyword">SELECT</span> <span class="token keyword">NAME</span> <span class="token keyword">FROM</span> performance_schema<span class="token punctuation">.</span>setup_instruments
       <span class="token keyword">WHERE</span> <span class="token keyword">NAME</span> <span class="token operator">LIKE</span> <span class="token string">'statement/sql/%'</span> <span class="token keyword">ORDER</span> <span class="token keyword">BY</span> <span class="token keyword">NAME</span><span class="token punctuation">;</span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output"><span class="token punctuation">|</span> NAME                                  <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output"><span class="token punctuation">|</span> statement/sql/alter_db                <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">|</span> statement/sql/alter_db_upgrade        <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">|</span> statement/sql/alter_event             <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">|</span> statement/sql/alter_function          <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">|</span> statement/sql/alter_instance          <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">|</span> statement/sql/alter_procedure         <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">|</span> statement/sql/alter_server            <span class="token punctuation">|</span></span>
<span class="token punctuation">.</span><span class="token punctuation">.</span><span class="token punctuation">.</span></code></pre>
   </div>
   <p>
    An event in the
    <code class="literal">
     table_access
    </code>
    class provides
          information about a specific type of access to a table.
    <a class="xref" href="audit-log-filter-definitions.html#audit-log-table-access-event-fields" title="Table 8.38 Table-Access Event Fields">
     Table 8.38, “Table-Access Event Fields”
    </a>
    indicates the permitted fields for
    <code class="literal">
     table_access
    </code>
    events.
   </p>
   <div class="table">
    <a name="audit-log-table-access-event-fields">
    </a>
    <p class="title">
     <b>
      Table 8.38 Table-Access Event Fields
     </b>
    </p>
    <div class="table-contents">
     <table summary="Permitted fields for table-access events.">
      <colgroup>
       <col style="width: 35%"/>
       <col style="width: 20%"/>
       <col style="width: 45%"/>
      </colgroup>
      <thead>
       <tr>
        <th scope="col">
         Field Name
        </th>
        <th scope="col">
         Field Type
        </th>
        <th scope="col">
         Description
        </th>
       </tr>
      </thead>
      <tbody>
       <tr>
        <th scope="row">
         <code class="literal">
          connection_id
         </code>
        </th>
        <td>
         unsigned integer
        </td>
        <td>
         Event connection ID
        </td>
       </tr>
       <tr>
        <th scope="row">
         <code class="literal">
          sql_command_id
         </code>
        </th>
        <td>
         integer
        </td>
        <td>
         SQL command ID
        </td>
       </tr>
       <tr>
        <th scope="row">
         <code class="literal">
          query.str
         </code>
        </th>
        <td>
         string
        </td>
        <td>
         SQL statement text
        </td>
       </tr>
       <tr>
        <th scope="row">
         <code class="literal">
          query.length
         </code>
        </th>
        <td>
         unsigned integer
        </td>
        <td>
         SQL statement text length
        </td>
       </tr>
       <tr>
        <th scope="row">
         <code class="literal">
          table_database.str
         </code>
        </th>
        <td>
         string
        </td>
        <td>
         Database name associated with event
        </td>
       </tr>
       <tr>
        <th scope="row">
         <code class="literal">
          table_database.length
         </code>
        </th>
        <td>
         unsigned integer
        </td>
        <td>
         Database name length
        </td>
       </tr>
       <tr>
        <th scope="row">
         <code class="literal">
          table_name.str
         </code>
        </th>
        <td>
         string
        </td>
        <td>
         Table name associated with event
        </td>
       </tr>
       <tr>
        <th scope="row">
         <code class="literal">
          table_name.length
         </code>
        </th>
        <td>
         unsigned integer
        </td>
        <td>
         Table name length
        </td>
       </tr>
      </tbody>
     </table>
    </div>
   </div>
   <br class="table-break"/>
   <p>
    The following list shows which statements produce which
          table-access events:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       <code class="literal">
        read
       </code>
       event:
      </p>
      <div class="itemizedlist">
       <ul class="itemizedlist" style="list-style-type: circle; ">
        <li class="listitem">
         <p>
          <code class="literal">
           SELECT
          </code>
         </p>
        </li>
        <li class="listitem">
         <p>
          <code class="literal">
           INSERT ... SELECT
          </code>
          (for tables
                  referenced in
          <code class="literal">
           SELECT
          </code>
          clause)
         </p>
        </li>
        <li class="listitem">
         <p>
          <code class="literal">
           REPLACE ... SELECT
          </code>
          (for tables
                  referenced in
          <code class="literal">
           SELECT
          </code>
          clause)
         </p>
        </li>
        <li class="listitem">
         <p>
          <code class="literal">
           UPDATE ... WHERE
          </code>
          (for tables
                  referenced in
          <code class="literal">
           WHERE
          </code>
          clause)
         </p>
        </li>
        <li class="listitem">
         <p>
          <code class="literal">
           HANDLER ... READ
          </code>
         </p>
        </li>
       </ul>
      </div>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        delete
       </code>
       event:
      </p>
      <div class="itemizedlist">
       <ul class="itemizedlist" style="list-style-type: circle; ">
        <li class="listitem">
         <p>
          <code class="literal">
           DELETE
          </code>
         </p>
        </li>
        <li class="listitem">
         <p>
          <code class="literal">
           TRUNCATE TABLE
          </code>
         </p>
        </li>
       </ul>
      </div>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        insert
       </code>
       event:
      </p>
      <div class="itemizedlist">
       <ul class="itemizedlist" style="list-style-type: circle; ">
        <li class="listitem">
         <p>
          <code class="literal">
           INSERT
          </code>
         </p>
        </li>
        <li class="listitem">
         <p>
          <code class="literal">
           INSERT ... SELECT
          </code>
          (for table
                  referenced in
          <code class="literal">
           INSERT
          </code>
          clause)
         </p>
        </li>
        <li class="listitem">
         <p>
          <code class="literal">
           REPLACE
          </code>
         </p>
        </li>
        <li class="listitem">
         <p>
          <code class="literal">
           REPLACE ... SELECT
          </code>
          (for table
                  referenced in
          <code class="literal">
           REPLACE
          </code>
          clause
         </p>
        </li>
        <li class="listitem">
         <p>
          <code class="literal">
           LOAD DATA
          </code>
         </p>
        </li>
        <li class="listitem">
         <p>
          <code class="literal">
           LOAD XML
          </code>
         </p>
        </li>
       </ul>
      </div>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        update
       </code>
       event:
      </p>
      <div class="itemizedlist">
       <ul class="itemizedlist" style="list-style-type: circle; ">
        <li class="listitem">
         <p>
          <code class="literal">
           UPDATE
          </code>
         </p>
        </li>
        <li class="listitem">
         <p>
          <code class="literal">
           UPDATE ... WHERE
          </code>
          (for tables
                  referenced in
          <code class="literal">
           UPDATE
          </code>
          clause)
         </p>
        </li>
       </ul>
      </div>
     </li>
    </ul>
   </div>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h5 class="title">
       <a name="audit-log-filtering-blocking-events">
       </a>
       Blocking Execution of Specific Events
      </h5>
     </div>
    </div>
   </div>
   <p>
    <code class="literal">
     event
    </code>
    items can include an
    <code class="literal">
     abort
    </code>
    item that indicates whether to
          prevent qualifying events from executing.
    <code class="literal">
     abort
    </code>
    enables rules to be written that
          block execution of specific SQL statements.
   </p>
   <div class="important" style="margin-left: 0.5in; margin-right: 0.5in;">
    <div class="admon-title">
     Important
    </div>
    <p>
     It is theoretically possible for a user with sufficient
            permissions to mistakenly create an
     <code class="literal">
      abort
     </code>
     item in the audit log filter that prevents themselves and
            other administrators from accessing the system. The
     <a class="link" href="privileges-provided.html#priv_audit-abort-exempt">
      <code class="literal">
       AUDIT_ABORT_EXEMPT
      </code>
     </a>
     privilege is available to permit a user account’s queries
            to always be executed even if an
     <code class="literal">
      abort
     </code>
     item would block them. Accounts with this privilege can
            therefore be used to regain access to a system following an
            audit misconfiguration. The query is still logged in the
            audit log, but instead of being rejected, it is permitted
            due to the privilege.
    </p>
    <p>
     Accounts created with the
     <a class="link" href="privileges-provided.html#priv_system-user">
      <code class="literal">
       SYSTEM_USER
      </code>
     </a>
     privilege have
            the
     <a class="link" href="privileges-provided.html#priv_audit-abort-exempt">
      <code class="literal">
       AUDIT_ABORT_EXEMPT
      </code>
     </a>
     privilege assigned automatically when they are created. The
     <a class="link" href="privileges-provided.html#priv_audit-abort-exempt">
      <code class="literal">
       AUDIT_ABORT_EXEMPT
      </code>
     </a>
     privilege
            is also assigned to existing accounts with the
     <a class="link" href="privileges-provided.html#priv_system-user">
      <code class="literal">
       SYSTEM_USER
      </code>
     </a>
     privilege when you carry out an upgrade procedure, if no
            existing accounts have that privilege assigned.
    </p>
   </div>
   <p>
    The
    <code class="literal">
     abort
    </code>
    item must appear within an
    <code class="literal">
     event
    </code>
    item. For example:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-json"><div class="docs-select-all right" id="sa48748913"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-json"><span class="token property">"event"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
  <span class="token property">"name"</span><span class="token operator">:</span> <em class="replaceable">qualifying event subclass names</em>
  <span class="token property">"abort"</span><span class="token operator">:</span> <em class="replaceable">condition</em>
<span class="token punctuation">}</span></code></pre>
   </div>
   <p>
    For event subclasses selected by the
    <code class="literal">
     name
    </code>
    item, the
    <code class="literal">
     abort
    </code>
    action is true or false,
          depending on
    <em class="replaceable">
     <code>
      condition
     </code>
    </em>
    evaluation.
          If the condition evaluates to true, the event is blocked.
          Otherwise, the event continues executing.
   </p>
   <p>
    The
    <em class="replaceable">
     <code>
      condition
     </code>
    </em>
    specification can be
          as simple as
    <code class="literal">
     true
    </code>
    or
    <code class="literal">
     false
    </code>
    , or it can be more complex such that
          evaluation depends on event characteristics.
   </p>
   <p>
    This filter blocks
    <a class="link" href="insert.html" title="15.2.7 INSERT Statement">
     <code class="literal">
      INSERT
     </code>
    </a>
    ,
    <a class="link" href="update.html" title="15.2.17 UPDATE Statement">
     <code class="literal">
      UPDATE
     </code>
    </a>
    , and
    <a class="link" href="delete.html" title="15.2.2 DELETE Statement">
     <code class="literal">
      DELETE
     </code>
    </a>
    statements:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-json"><div class="docs-select-all right" id="sa75702508"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-json"><span class="token punctuation">{</span>
  <span class="token property">"filter"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
    <span class="token property">"class"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
      <span class="token property">"name"</span><span class="token operator">:</span> <span class="token string">"table_access"</span><span class="token punctuation">,</span>
      <span class="token property">"event"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
        <span class="token property">"name"</span><span class="token operator">:</span> <span class="token punctuation">[</span> <span class="token string">"insert"</span><span class="token punctuation">,</span> <span class="token string">"update"</span><span class="token punctuation">,</span> <span class="token string">"delete"</span> <span class="token punctuation">]</span><span class="token punctuation">,</span>
        <span class="token property">"abort"</span><span class="token operator">:</span> <span class="token boolean">true</span>
      <span class="token punctuation">}</span>
    <span class="token punctuation">}</span>
  <span class="token punctuation">}</span>
<span class="token punctuation">}</span></code></pre>
   </div>
   <p>
    This more complex filter blocks the same statements, but only
          for a specific table
          (
    <code class="literal">
     finances.bank_account
    </code>
    ):
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-json"><div class="docs-select-all right" id="sa39253436"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-json"><span class="token punctuation">{</span>
  <span class="token property">"filter"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
    <span class="token property">"class"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
      <span class="token property">"name"</span><span class="token operator">:</span> <span class="token string">"table_access"</span><span class="token punctuation">,</span>
      <span class="token property">"event"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
        <span class="token property">"name"</span><span class="token operator">:</span> <span class="token punctuation">[</span> <span class="token string">"insert"</span><span class="token punctuation">,</span> <span class="token string">"update"</span><span class="token punctuation">,</span> <span class="token string">"delete"</span> <span class="token punctuation">]</span><span class="token punctuation">,</span>
        <span class="token property">"abort"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
          <span class="token property">"and"</span><span class="token operator">:</span> <span class="token punctuation">[</span>
            <span class="token punctuation">{</span> <span class="token property">"field"</span><span class="token operator">:</span> <span class="token punctuation">{</span> <span class="token property">"name"</span><span class="token operator">:</span> <span class="token string">"table_database.str"</span><span class="token punctuation">,</span> <span class="token property">"value"</span><span class="token operator">:</span> <span class="token string">"finances"</span> <span class="token punctuation">}</span> <span class="token punctuation">}</span><span class="token punctuation">,</span>
            <span class="token punctuation">{</span> <span class="token property">"field"</span><span class="token operator">:</span> <span class="token punctuation">{</span> <span class="token property">"name"</span><span class="token operator">:</span> <span class="token string">"table_name.str"</span><span class="token punctuation">,</span> <span class="token property">"value"</span><span class="token operator">:</span> <span class="token string">"bank_account"</span> <span class="token punctuation">}</span> <span class="token punctuation">}</span>
          <span class="token punctuation">]</span>
        <span class="token punctuation">}</span>
      <span class="token punctuation">}</span>
    <span class="token punctuation">}</span>
  <span class="token punctuation">}</span>
<span class="token punctuation">}</span></code></pre>
   </div>
   <p>
    Statements matched and blocked by the filter return an error
          to the client:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting one-line language-none"><div class="docs-select-all right" id="sa1077529"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-none">ERROR 1045 (28000): Statement was aborted by an audit log filter</code></pre>
   </div>
   <p>
    Not all events can be blocked (see
    <a class="xref" href="audit-log-filter-definitions.html#audit-log-event-subclass-log-abort" title="Table 8.35 Log and Abort Characteristics Per Event Class and Subclass Combination">
     Table 8.35, “Log and Abort Characteristics Per Event Class and Subclass Combination”
    </a>
    ). For an
          event that cannot be blocked, the audit log writes a warning
          to the error log rather than blocking it.
   </p>
   <p>
    For attempts to define a filter in which the
    <code class="literal">
     abort
    </code>
    item appears elsewhere than in an
    <code class="literal">
     event
    </code>
    item, an error occurs.
   </p>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h5 class="title">
       <a name="audit-log-filtering-logical-operators">
       </a>
       Logical Operators
      </h5>
     </div>
    </div>
   </div>
   <p>
    Logical operators (
    <code class="literal">
     and
    </code>
    ,
    <code class="literal">
     or
    </code>
    ,
    <code class="literal">
     not
    </code>
    ) permit
          construction of complex conditions, enabling more advanced
          filtering configurations to be written. The following
    <code class="literal">
     log
    </code>
    item logs only
    <code class="literal">
     general
    </code>
    events with
    <code class="literal">
     general_command
    </code>
    fields having a specific
          value and length:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-json"><div class="docs-select-all right" id="sa79765543"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-json"><span class="token punctuation">{</span>
  <span class="token property">"filter"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
    <span class="token property">"class"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
      <span class="token property">"name"</span><span class="token operator">:</span> <span class="token string">"general"</span><span class="token punctuation">,</span>
      <span class="token property">"event"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
        <span class="token property">"name"</span><span class="token operator">:</span> <span class="token string">"status"</span><span class="token punctuation">,</span>
        <span class="token property">"log"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
          <span class="token property">"or"</span><span class="token operator">:</span> <span class="token punctuation">[</span>
            <span class="token punctuation">{</span>
              <span class="token property">"and"</span><span class="token operator">:</span> <span class="token punctuation">[</span>
                <span class="token punctuation">{</span> <span class="token property">"field"</span><span class="token operator">:</span> <span class="token punctuation">{</span> <span class="token property">"name"</span><span class="token operator">:</span> <span class="token string">"general_command.str"</span><span class="token punctuation">,</span>    <span class="token property">"value"</span><span class="token operator">:</span> <span class="token string">"Query"</span> <span class="token punctuation">}</span> <span class="token punctuation">}</span><span class="token punctuation">,</span>
                <span class="token punctuation">{</span> <span class="token property">"field"</span><span class="token operator">:</span> <span class="token punctuation">{</span> <span class="token property">"name"</span><span class="token operator">:</span> <span class="token string">"general_command.length"</span><span class="token punctuation">,</span> <span class="token property">"value"</span><span class="token operator">:</span> <span class="token number">5</span> <span class="token punctuation">}</span> <span class="token punctuation">}</span>
              <span class="token punctuation">]</span>
            <span class="token punctuation">}</span><span class="token punctuation">,</span>
            <span class="token punctuation">{</span>
              <span class="token property">"and"</span><span class="token operator">:</span> <span class="token punctuation">[</span>
                <span class="token punctuation">{</span> <span class="token property">"field"</span><span class="token operator">:</span> <span class="token punctuation">{</span> <span class="token property">"name"</span><span class="token operator">:</span> <span class="token string">"general_command.str"</span><span class="token punctuation">,</span>    <span class="token property">"value"</span><span class="token operator">:</span> <span class="token string">"Execute"</span> <span class="token punctuation">}</span> <span class="token punctuation">}</span><span class="token punctuation">,</span>
                <span class="token punctuation">{</span> <span class="token property">"field"</span><span class="token operator">:</span> <span class="token punctuation">{</span> <span class="token property">"name"</span><span class="token operator">:</span> <span class="token string">"general_command.length"</span><span class="token punctuation">,</span> <span class="token property">"value"</span><span class="token operator">:</span> <span class="token number">7</span> <span class="token punctuation">}</span> <span class="token punctuation">}</span>
              <span class="token punctuation">]</span>
            <span class="token punctuation">}</span>
          <span class="token punctuation">]</span>
        <span class="token punctuation">}</span>
      <span class="token punctuation">}</span>
    <span class="token punctuation">}</span>
  <span class="token punctuation">}</span>
<span class="token punctuation">}</span></code></pre>
   </div>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h5 class="title">
       <a name="audit-log-filtering-predefined-variables">
       </a>
       Referencing Predefined Variables
      </h5>
     </div>
    </div>
   </div>
   <p>
    To refer to a predefined variable in a
    <code class="literal">
     log
    </code>
    condition, use a
    <code class="literal">
     variable
    </code>
    item, which takes
    <code class="literal">
     name
    </code>
    and
    <code class="literal">
     value
    </code>
    items and
          tests equality of the named variable against a given value:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-json"><div class="docs-select-all right" id="sa79822112"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-json"><span class="token property">"variable"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
  <span class="token property">"name"</span><span class="token operator">:</span> <span class="token string">"<em class="replaceable">variable_name</em>"</span><span class="token punctuation">,</span>
  <span class="token property">"value"</span><span class="token operator">:</span> <em class="replaceable">comparison_value</em>
<span class="token punctuation">}</span></code></pre>
   </div>
   <p>
    This is true if
    <em class="replaceable">
     <code>
      variable_name
     </code>
    </em>
    has
          the value
    <em class="replaceable">
     <code>
      comparison_value
     </code>
    </em>
    , false
          otherwise.
   </p>
   <p>
    Example:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-json"><div class="docs-select-all right" id="sa57733275"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-json"><span class="token punctuation">{</span>
  <span class="token property">"filter"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
    <span class="token property">"class"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
      <span class="token property">"name"</span><span class="token operator">:</span> <span class="token string">"general"</span><span class="token punctuation">,</span>
      <span class="token property">"event"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
        <span class="token property">"name"</span><span class="token operator">:</span> <span class="token string">"status"</span><span class="token punctuation">,</span>
        <span class="token property">"log"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
          <span class="token property">"variable"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
            <span class="token property">"name"</span><span class="token operator">:</span> <span class="token string">"audit_log_connection_policy_value"</span><span class="token punctuation">,</span>
            <span class="token property">"value"</span><span class="token operator">:</span> "<span class="token operator">:</span><span class="token operator">:</span>none"
          <span class="token punctuation">}</span>
        <span class="token punctuation">}</span>
      <span class="token punctuation">}</span>
    <span class="token punctuation">}</span>
  <span class="token punctuation">}</span>
<span class="token punctuation">}</span></code></pre>
   </div>
   <p>
    Each predefined variable corresponds to a system variable. By
          writing a filter that tests a predefined variable, you can
          modify filter operation by setting the corresponding system
          variable, without having to redefine the filter. For example,
          by writing a filter that tests the value of the
    <code class="literal">
     audit_log_connection_policy_value
    </code>
    predefined variable, you can modify filter operation by
          changing the value of the
    <a class="link" href="audit-log-reference.html#sysvar_audit_log_connection_policy">
     <code class="literal">
      audit_log_connection_policy
     </code>
    </a>
    system variable.
   </p>
   <a class="indexterm" name="idm46045236677040">
   </a>
   <p>
    The
    <code class="literal">
     audit_log_
     <em class="replaceable">
      <code>
       xxx
      </code>
     </em>
     _policy
    </code>
    system variables are used for the deprecated legacy mode audit
          log (see
    <a class="xref" href="audit-log-legacy-filtering.html" title="8.4.5.10 Legacy Mode Audit Log Filtering">
     Section 8.4.5.10, “Legacy Mode Audit Log Filtering”
    </a>
    ). With
          rule-based audit log filtering, those variables remain visible
          (for example, using
    <a class="link" href="show-variables.html" title="15.7.7.41 SHOW VARIABLES Statement">
     <code class="literal">
      SHOW
          VARIABLES
     </code>
    </a>
    ), but changes to them have no effect
          unless you write filters containing constructs that refer to
          them.
   </p>
   <p>
    The following list describes the permitted predefined
          variables for
    <code class="literal">
     variable
    </code>
    items:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       <code class="literal">
        audit_log_connection_policy_value
       </code>
      </p>
      <p>
       This variable corresponds to the value of the
       <a class="link" href="audit-log-reference.html#sysvar_audit_log_connection_policy">
        <code class="literal">
         audit_log_connection_policy
        </code>
       </a>
       system variable. The value is an unsigned integer.
       <a class="xref" href="audit-log-filter-definitions.html#audit-log-connection-policy-value-values" title="Table 8.39 audit_log_connection_policy_value Values">
        Table 8.39, “audit_log_connection_policy_value Values”
       </a>
       shows the permitted values and the corresponding
       <a class="link" href="audit-log-reference.html#sysvar_audit_log_connection_policy">
        <code class="literal">
         audit_log_connection_policy
        </code>
       </a>
       values.
      </p>
      <div class="table">
       <a name="audit-log-connection-policy-value-values">
       </a>
       <p class="title">
        <b>
         Table 8.39 audit_log_connection_policy_value Values
        </b>
       </p>
       <div class="table-contents">
        <table summary="Permitted audit_log_connection_policy_value values and the corresponding audit_log_connection_policy values.">
         <colgroup>
          <col style="width: 20%"/>
          <col style="width: 80%"/>
         </colgroup>
         <thead>
          <tr>
           <th>
            Value
           </th>
           <th>
            Corresponding audit_log_connection_policy Value
           </th>
          </tr>
         </thead>
         <tbody>
          <tr>
           <td>
            <code class="literal">
             0
            </code>
            or
            <code class="literal">
             "::none"
            </code>
           </td>
           <td>
            <code class="literal">
             NONE
            </code>
           </td>
          </tr>
          <tr>
           <td>
            <code class="literal">
             1
            </code>
            or
            <code class="literal">
             "::errors"
            </code>
           </td>
           <td>
            <code class="literal">
             ERRORS
            </code>
           </td>
          </tr>
          <tr>
           <td>
            <code class="literal">
             2
            </code>
            or
            <code class="literal">
             "::all"
            </code>
           </td>
           <td>
            <code class="literal">
             ALL
            </code>
           </td>
          </tr>
         </tbody>
        </table>
       </div>
      </div>
      <br class="table-break"/>
      <p>
       The
       <code class="literal">
        "::
        <em class="replaceable">
         <code>
          xxx
         </code>
        </em>
        "
       </code>
       values are symbolic pseudo-constants that may be given
              instead of the literal numeric values. They must be quoted
              as strings and are case-sensitive.
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        audit_log_policy_value
       </code>
      </p>
      <p>
       This variable corresponds to the value of the
       <a class="link" href="audit-log-reference.html#sysvar_audit_log_policy">
        <code class="literal">
         audit_log_policy
        </code>
       </a>
       system
              variable. The value is an unsigned integer.
       <a class="xref" href="audit-log-filter-definitions.html#audit-log-policy-value-values" title="Table 8.40 audit_log_policy_value Values">
        Table 8.40, “audit_log_policy_value Values”
       </a>
       shows the
              permitted values and the corresponding
       <a class="link" href="audit-log-reference.html#sysvar_audit_log_policy">
        <code class="literal">
         audit_log_policy
        </code>
       </a>
       values.
      </p>
      <div class="table">
       <a name="audit-log-policy-value-values">
       </a>
       <p class="title">
        <b>
         Table 8.40 audit_log_policy_value Values
        </b>
       </p>
       <div class="table-contents">
        <table summary="Permitted audit_log_policy_value values and the corresponding audit_log_policy values.">
         <colgroup>
          <col style="width: 20%"/>
          <col style="width: 80%"/>
         </colgroup>
         <thead>
          <tr>
           <th>
            Value
           </th>
           <th>
            Corresponding audit_log_policy Value
           </th>
          </tr>
         </thead>
         <tbody>
          <tr>
           <td>
            <code class="literal">
             0
            </code>
            or
            <code class="literal">
             "::none"
            </code>
           </td>
           <td>
            <code class="literal">
             NONE
            </code>
           </td>
          </tr>
          <tr>
           <td>
            <code class="literal">
             1
            </code>
            or
            <code class="literal">
             "::logins"
            </code>
           </td>
           <td>
            <code class="literal">
             LOGINS
            </code>
           </td>
          </tr>
          <tr>
           <td>
            <code class="literal">
             2
            </code>
            or
            <code class="literal">
             "::all"
            </code>
           </td>
           <td>
            <code class="literal">
             ALL
            </code>
           </td>
          </tr>
          <tr>
           <td>
            <code class="literal">
             3
            </code>
            or
            <code class="literal">
             "::queries"
            </code>
           </td>
           <td>
            <code class="literal">
             QUERIES
            </code>
           </td>
          </tr>
         </tbody>
        </table>
       </div>
      </div>
      <br class="table-break"/>
      <p>
       The
       <code class="literal">
        "::
        <em class="replaceable">
         <code>
          xxx
         </code>
        </em>
        "
       </code>
       values are symbolic pseudo-constants that may be given
              instead of the literal numeric values. They must be quoted
              as strings and are case-sensitive.
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        audit_log_statement_policy_value
       </code>
      </p>
      <p>
       This variable corresponds to the value of the
       <a class="link" href="audit-log-reference.html#sysvar_audit_log_statement_policy">
        <code class="literal">
         audit_log_statement_policy
        </code>
       </a>
       system variable. The value is an unsigned integer.
       <a class="xref" href="audit-log-filter-definitions.html#audit-log-statement-policy-value-values" title="Table 8.41 audit_log_statement_policy_value Values">
        Table 8.41, “audit_log_statement_policy_value Values”
       </a>
       shows the permitted values and the corresponding
       <a class="link" href="audit-log-reference.html#sysvar_audit_log_statement_policy">
        <code class="literal">
         audit_log_statement_policy
        </code>
       </a>
       values.
      </p>
      <div class="table">
       <a name="audit-log-statement-policy-value-values">
       </a>
       <p class="title">
        <b>
         Table 8.41 audit_log_statement_policy_value Values
        </b>
       </p>
       <div class="table-contents">
        <table summary="Permitted audit_log_statement_policy_value values and the corresponding audit_log_statement_policy values.">
         <colgroup>
          <col style="width: 20%"/>
          <col style="width: 80%"/>
         </colgroup>
         <thead>
          <tr>
           <th>
            Value
           </th>
           <th>
            Corresponding audit_log_statement_policy Value
           </th>
          </tr>
         </thead>
         <tbody>
          <tr>
           <td>
            <code class="literal">
             0
            </code>
            or
            <code class="literal">
             "::none"
            </code>
           </td>
           <td>
            <code class="literal">
             NONE
            </code>
           </td>
          </tr>
          <tr>
           <td>
            <code class="literal">
             1
            </code>
            or
            <code class="literal">
             "::errors"
            </code>
           </td>
           <td>
            <code class="literal">
             ERRORS
            </code>
           </td>
          </tr>
          <tr>
           <td>
            <code class="literal">
             2
            </code>
            or
            <code class="literal">
             "::all"
            </code>
           </td>
           <td>
            <code class="literal">
             ALL
            </code>
           </td>
          </tr>
         </tbody>
        </table>
       </div>
      </div>
      <br class="table-break"/>
      <p>
       The
       <code class="literal">
        "::
        <em class="replaceable">
         <code>
          xxx
         </code>
        </em>
        "
       </code>
       values are symbolic pseudo-constants that may be given
              instead of the literal numeric values. They must be quoted
              as strings and are case-sensitive.
      </p>
     </li>
    </ul>
   </div>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h5 class="title">
       <a name="audit-log-filtering-predefined-functions">
       </a>
       Referencing Predefined Functions
      </h5>
     </div>
    </div>
   </div>
   <p>
    To refer to a predefined function in a
    <code class="literal">
     log
    </code>
    condition, use a
    <code class="literal">
     function
    </code>
    item, which takes
    <code class="literal">
     name
    </code>
    and
    <code class="literal">
     args
    </code>
    items to
          specify the function name and its arguments, respectively:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-json"><div class="docs-select-all right" id="sa27559230"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-json"><span class="token property">"function"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
  <span class="token property">"name"</span><span class="token operator">:</span> <span class="token string">"<em class="replaceable">function_name</em>"</span><span class="token punctuation">,</span>
  <span class="token property">"args"</span><span class="token operator">:</span> <em class="replaceable">arguments</em>
<span class="token punctuation">}</span></code></pre>
   </div>
   <p>
    The
    <code class="literal">
     name
    </code>
    item should specify the function
          name only, without parentheses or the argument list.
   </p>
   <p>
    The
    <code class="literal">
     args
    </code>
    item must satisfy these
          conditions:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       If the function takes no arguments, no
       <code class="literal">
        args
       </code>
       item should be given.
      </p>
     </li>
     <li class="listitem">
      <p>
       If the function does take arguments, an
       <code class="literal">
        args
       </code>
       item is needed, and the arguments
              must be given in the order listed in the function
              description. Arguments can refer to predefined variables,
              event fields, or string or numeric constants.
      </p>
     </li>
    </ul>
   </div>
   <p>
    If the number of arguments is incorrect or the arguments are
          not of the correct data types required by the function an
          error occurs.
   </p>
   <p>
    Example:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-json"><div class="docs-select-all right" id="sa19814026"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-json"><span class="token punctuation">{</span>
  <span class="token property">"filter"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
    <span class="token property">"class"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
      <span class="token property">"name"</span><span class="token operator">:</span> <span class="token string">"general"</span><span class="token punctuation">,</span>
      <span class="token property">"event"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
        <span class="token property">"name"</span><span class="token operator">:</span> <span class="token string">"status"</span><span class="token punctuation">,</span>
        <span class="token property">"log"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
          <span class="token property">"function"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
            <span class="token property">"name"</span><span class="token operator">:</span> <span class="token string">"find_in_include_list"</span><span class="token punctuation">,</span>
            <span class="token property">"args"</span><span class="token operator">:</span> <span class="token punctuation">[</span> <span class="token punctuation">{</span> <span class="token property">"string"</span><span class="token operator">:</span> <span class="token punctuation">[</span> <span class="token punctuation">{</span> <span class="token property">"field"</span><span class="token operator">:</span> <span class="token string">"user.str"</span> <span class="token punctuation">}</span><span class="token punctuation">,</span>
                                    <span class="token punctuation">{</span> <span class="token property">"string"</span><span class="token operator">:</span> <span class="token string">"@"</span><span class="token punctuation">}</span><span class="token punctuation">,</span>
                                    <span class="token punctuation">{</span> <span class="token property">"field"</span><span class="token operator">:</span> <span class="token string">"host.str"</span> <span class="token punctuation">}</span> <span class="token punctuation">]</span> <span class="token punctuation">}</span> <span class="token punctuation">]</span>
          <span class="token punctuation">}</span>
        <span class="token punctuation">}</span>
      <span class="token punctuation">}</span>
    <span class="token punctuation">}</span>
  <span class="token punctuation">}</span>
<span class="token punctuation">}</span></code></pre>
   </div>
   <p>
    The preceding filter determines whether to log
    <code class="literal">
     general
    </code>
    class
    <code class="literal">
     status
    </code>
    events depending on whether the current user is found in the
    <a class="link" href="audit-log-reference.html#sysvar_audit_log_include_accounts">
     <code class="literal">
      audit_log_include_accounts
     </code>
    </a>
    system variable. That user is constructed using fields in the
          event.
   </p>
   <p>
    The following list describes the permitted predefined
          functions for
    <code class="literal">
     function
    </code>
    items:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       <code class="literal">
        audit_log_exclude_accounts_is_null()
       </code>
      </p>
      <p>
       Checks whether the
       <a class="link" href="audit-log-reference.html#sysvar_audit_log_exclude_accounts">
        <code class="literal">
         audit_log_exclude_accounts
        </code>
       </a>
       system variable is
       <code class="literal">
        NULL
       </code>
       . This function
              can be helpful when defining filters that correspond to
              the legacy audit log implementation.
      </p>
      <p>
       Arguments:
      </p>
      <p>
       None.
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        audit_log_include_accounts_is_null()
       </code>
      </p>
      <p>
       Checks whether the
       <a class="link" href="audit-log-reference.html#sysvar_audit_log_include_accounts">
        <code class="literal">
         audit_log_include_accounts
        </code>
       </a>
       system variable is
       <code class="literal">
        NULL
       </code>
       . This function
              can be helpful when defining filters that correspond to
              the legacy audit log implementation.
      </p>
      <p>
       Arguments:
      </p>
      <p>
       None.
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        debug_sleep(millisec)
       </code>
      </p>
      <p>
       Sleeps for the given number of milliseconds. This function
              is used during performance measurement.
      </p>
      <p>
       <code class="literal">
        debug_sleep()
       </code>
       is available for debug
              builds only.
      </p>
      <p>
       Arguments:
      </p>
      <div class="itemizedlist">
       <ul class="itemizedlist" style="list-style-type: circle; ">
        <li class="listitem">
         <p>
          <em class="replaceable">
           <code>
            millisec
           </code>
          </em>
          : An unsigned
                  integer that specifies the number of milliseconds to
                  sleep.
         </p>
        </li>
       </ul>
      </div>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        find_in_exclude_list(account)
       </code>
      </p>
      <p>
       Checks whether an account string exists in the audit log
              exclude list (the value of the
       <a class="link" href="audit-log-reference.html#sysvar_audit_log_exclude_accounts">
        <code class="literal">
         audit_log_exclude_accounts
        </code>
       </a>
       system variable).
      </p>
      <p>
       Arguments:
      </p>
      <div class="itemizedlist">
       <ul class="itemizedlist" style="list-style-type: circle; ">
        <li class="listitem">
         <p>
          <em class="replaceable">
           <code>
            account
           </code>
          </em>
          : A string that
                  specifies the user account name.
         </p>
        </li>
       </ul>
      </div>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        find_in_include_list(account)
       </code>
      </p>
      <p>
       Checks whether an account string exists in the audit log
              include list (the value of the
       <a class="link" href="audit-log-reference.html#sysvar_audit_log_include_accounts">
        <code class="literal">
         audit_log_include_accounts
        </code>
       </a>
       system variable).
      </p>
      <p>
       Arguments:
      </p>
      <div class="itemizedlist">
       <ul class="itemizedlist" style="list-style-type: circle; ">
        <li class="listitem">
         <p>
          <em class="replaceable">
           <code>
            account
           </code>
          </em>
          : A string that
                  specifies the user account name.
         </p>
        </li>
       </ul>
      </div>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        query_digest([str])
       </code>
      </p>
      <p>
       This function has differing behavior depending on whether
              an argument is given:
      </p>
      <div class="itemizedlist">
       <ul class="itemizedlist" style="list-style-type: circle; ">
        <li class="listitem">
         <p>
          With no argument,
          <code class="literal">
           query_digest
          </code>
          returns the statement digest value corresponding to
                  the statement literal text in the current event.
         </p>
        </li>
        <li class="listitem">
         <p>
          With an argument,
          <code class="literal">
           query_digest
          </code>
          returns a Boolean indicating whether the argument is
                  equal to the current statement digest.
         </p>
        </li>
       </ul>
      </div>
      <p>
       Arguments:
      </p>
      <div class="itemizedlist">
       <ul class="itemizedlist" style="list-style-type: circle; ">
        <li class="listitem">
         <p>
          <em class="replaceable">
           <code>
            str
           </code>
          </em>
          : This argument is
                  optional. If given, it specifies a statement digest to
                  be compared against the digest for the statement in
                  the current event.
         </p>
        </li>
       </ul>
      </div>
      <p>
       Examples:
      </p>
      <p>
       This
       <code class="literal">
        function
       </code>
       item includes no
              argument, so
       <code class="literal">
        query_digest
       </code>
       returns the
              current statement digest as a string:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-json"><div class="docs-select-all right" id="sa99762375"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-json"><span class="token property">"function"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
  <span class="token property">"name"</span><span class="token operator">:</span> <span class="token string">"query_digest"</span>
<span class="token punctuation">}</span></code></pre>
      </div>
      <p>
       This
       <code class="literal">
        function
       </code>
       item includes an
              argument, so
       <code class="literal">
        query_digest
       </code>
       returns a
              Boolean indicating whether the argument equals the current
              statement digest:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-json"><div class="docs-select-all right" id="sa29059560"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-json"><span class="token property">"function"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
  <span class="token property">"name"</span><span class="token operator">:</span> <span class="token string">"query_digest"</span><span class="token punctuation">,</span>
  <span class="token property">"args"</span><span class="token operator">:</span> <span class="token string">"SELECT ?"</span>
<span class="token punctuation">}</span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        string_find(text, substr)
       </code>
      </p>
      <p>
       Checks whether the
       <code class="literal">
        substr
       </code>
       value is
              contained in the
       <code class="literal">
        text
       </code>
       value. This
              search is case-sensitive.
      </p>
      <p>
       Arguments:
      </p>
      <div class="itemizedlist">
       <ul class="itemizedlist" style="list-style-type: circle; ">
        <li class="listitem">
         <p>
          <em class="replaceable">
           <code>
            text
           </code>
          </em>
          : The text string to
                  search.
         </p>
        </li>
        <li class="listitem">
         <p>
          <em class="replaceable">
           <code>
            substr
           </code>
          </em>
          : The substring to
                  search for in
          <em class="replaceable">
           <code>
            text
           </code>
          </em>
          .
         </p>
        </li>
       </ul>
      </div>
     </li>
    </ul>
   </div>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h5 class="title">
       <a name="audit-log-filtering-field-replacement">
       </a>
       Replacement of Event Field Values
      </h5>
     </div>
    </div>
   </div>
   <a class="indexterm" name="idm46045236524048">
   </a>
   <a class="indexterm" name="idm46045236522560">
   </a>
   <p>
    Audit filter definitions support replacement of certain audit
          event fields, so that logged events contain the replacement
          value rather than the original value. This capability enables
          logged audit records to include statement digests rather than
          literal statements, which can be useful for MySQL deployments
          for which statements may expose sensitive values.
   </p>
   <p>
    Field replacement in audit events works like this:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       Field replacements are specified in audit filter
              definitions, so audit log filtering must be enabled as
              described in
       <a class="xref" href="audit-log-filtering.html" title="8.4.5.7 Audit Log Filtering">
        Section 8.4.5.7, “Audit Log Filtering”
       </a>
       .
      </p>
     </li>
     <li class="listitem">
      <p>
       Not all fields can be replaced.
       <a class="xref" href="audit-log-filter-definitions.html#audit-log-replaceable-event-fields" title="Table 8.42 Event Fields Subject to Replacement">
        Table 8.42, “Event Fields Subject to Replacement”
       </a>
       shows
              which fields are replaceable in which event classes.
      </p>
      <div class="table">
       <a name="audit-log-replaceable-event-fields">
       </a>
       <p class="title">
        <b>
         Table 8.42 Event Fields Subject to Replacement
        </b>
       </p>
       <div class="table-contents">
        <table summary="Event fields that are subject to replacement during event filtering.">
         <colgroup>
          <col style="width: 50%"/>
          <col style="width: 50%"/>
         </colgroup>
         <thead>
          <tr>
           <th>
            Event Class
           </th>
           <th>
            Field Name
           </th>
          </tr>
         </thead>
         <tbody>
          <tr>
           <td>
            <code class="literal">
             general
            </code>
           </td>
           <td>
            <code class="literal">
             general_query.str
            </code>
           </td>
          </tr>
          <tr>
           <td>
            <code class="literal">
             table_access
            </code>
           </td>
           <td>
            <code class="literal">
             query.str
            </code>
           </td>
          </tr>
         </tbody>
        </table>
       </div>
      </div>
      <br class="table-break"/>
     </li>
     <li class="listitem">
      <p>
       Replacement is conditional. Each replacement specification
              in a filter definition includes a condition, enabling a
              replaceable field to be changed, or left unchanged,
              depending on the condition result.
      </p>
     </li>
     <li class="listitem">
      <p>
       If replacement occurs, the replacement specification
              indicates the replacement value using a function that is
              permitted for that purpose.
      </p>
     </li>
    </ul>
   </div>
   <p>
    As
    <a class="xref" href="audit-log-filter-definitions.html#audit-log-replaceable-event-fields" title="Table 8.42 Event Fields Subject to Replacement">
     Table 8.42, “Event Fields Subject to Replacement”
    </a>
    shows,
          currently the only replaceable fields are those that contain
          statement text (which occurs in events of the
    <code class="literal">
     general
    </code>
    and
    <code class="literal">
     table_access
    </code>
    classes). In addition, the only function permitted for
          specifying the replacement value is
    <code class="literal">
     query_digest
    </code>
    . This means that the only
          permitted replacement operation is to replace statement
          literal text by its corresponding digest.
   </p>
   <p>
    Because field replacement occurs at an early auditing stage
          (during filtering), the choice of whether to write statement
          literal text or digest values applies regardless of log format
          written later (that is, whether the audit log plugin produces
          XML or JSON output).
   </p>
   <p>
    Field replacement can take place at differing levels of event
          granularity:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       To perform field replacement for all events in a class,
              filter events at the class level.
      </p>
     </li>
     <li class="listitem">
      <p>
       To perform replacement on a more fine-grained basis,
              include additional event-selection items. For example, you
              can perform field replacement only for specific subclasses
              of a given event class, or only in events for which fields
              have certain characteristics.
      </p>
     </li>
    </ul>
   </div>
   <p>
    Within a filter definition, specify field replacement by
          including a
    <code class="literal">
     print
    </code>
    item, which has this
          syntax:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-json"><div class="docs-select-all right" id="sa35257113"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-json"><span class="token property">"print"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
  <span class="token property">"field"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
    <span class="token property">"name"</span><span class="token operator">:</span> <span class="token string">"<em class="replaceable">field_name</em>"</span><span class="token punctuation">,</span>
    <span class="token property">"print"</span><span class="token operator">:</span> <em class="replaceable">condition</em><span class="token punctuation">,</span>
    <span class="token property">"replace"</span><span class="token operator">:</span> <em class="replaceable">replacement_value</em>
  <span class="token punctuation">}</span>
<span class="token punctuation">}</span></code></pre>
   </div>
   <p>
    Within the
    <code class="literal">
     print
    </code>
    item, its
    <code class="literal">
     field
    </code>
    item takes these three items to
          indicate how whether and how replacement occurs:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       <code class="literal">
        name
       </code>
       : The field for which replacement
              (potentially) occurs.
       <em class="replaceable">
        <code>
         field_name
        </code>
       </em>
       must be one of those
              shown in
       <a class="xref" href="audit-log-filter-definitions.html#audit-log-replaceable-event-fields" title="Table 8.42 Event Fields Subject to Replacement">
        Table 8.42, “Event Fields Subject to Replacement”
       </a>
       .
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        print
       </code>
       : The condition that determines
              whether to retain the original field value or replace it:
      </p>
      <div class="itemizedlist">
       <ul class="itemizedlist" style="list-style-type: circle; ">
        <li class="listitem">
         <p>
          If
          <em class="replaceable">
           <code>
            condition
           </code>
          </em>
          evaluates to
          <code class="literal">
           true
          </code>
          , the field remains unchanged.
         </p>
        </li>
        <li class="listitem">
         <p>
          If
          <em class="replaceable">
           <code>
            condition
           </code>
          </em>
          evaluates to
          <code class="literal">
           false
          </code>
          , replacement occurs, using
                  the value of the
          <code class="literal">
           replace
          </code>
          item.
         </p>
        </li>
       </ul>
      </div>
      <p>
       To unconditionally replace a field, specify the condition
              like this:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-json"><div class="docs-select-all right" id="sa26942317"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-json"><span class="token property">"print"</span><span class="token operator">:</span> <span class="token boolean">false</span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        replace
       </code>
       : The replacement value to use
              when the
       <code class="literal">
        print
       </code>
       condition evaluates to
       <code class="literal">
        false
       </code>
       . Specify
       <em class="replaceable">
        <code>
         replacement_value
        </code>
       </em>
       using a
       <code class="literal">
        function
       </code>
       item.
      </p>
     </li>
    </ul>
   </div>
   <p>
    For example, this filter definition applies to all events in
          the
    <code class="literal">
     general
    </code>
    class, replacing the statement
          literal text with its digest:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-json"><div class="docs-select-all right" id="sa32299153"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-json"><span class="token punctuation">{</span>
  <span class="token property">"filter"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
    <span class="token property">"class"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
      <span class="token property">"name"</span><span class="token operator">:</span> <span class="token string">"general"</span><span class="token punctuation">,</span>
      <span class="token property">"print"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
        <span class="token property">"field"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
          <span class="token property">"name"</span><span class="token operator">:</span> <span class="token string">"general_query.str"</span><span class="token punctuation">,</span>
          <span class="token property">"print"</span><span class="token operator">:</span> <span class="token boolean">false</span><span class="token punctuation">,</span>
          <span class="token property">"replace"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
            <span class="token property">"function"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
              <span class="token property">"name"</span><span class="token operator">:</span> <span class="token string">"query_digest"</span>
            <span class="token punctuation">}</span>
          <span class="token punctuation">}</span>
        <span class="token punctuation">}</span>
      <span class="token punctuation">}</span>
    <span class="token punctuation">}</span>
  <span class="token punctuation">}</span>
<span class="token punctuation">}</span></code></pre>
   </div>
   <p>
    The preceding filter uses this
    <code class="literal">
     print
    </code>
    item
          to unconditionally replace the statement literal text
          contained in
    <code class="literal">
     general_query.str
    </code>
    by its
          digest value:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-json"><div class="docs-select-all right" id="sa2927293"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-json"><span class="token property">"print"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
  <span class="token property">"field"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
    <span class="token property">"name"</span><span class="token operator">:</span> <span class="token string">"general_query.str"</span><span class="token punctuation">,</span>
    <span class="token property">"print"</span><span class="token operator">:</span> <span class="token boolean">false</span><span class="token punctuation">,</span>
    <span class="token property">"replace"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
      <span class="token property">"function"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
        <span class="token property">"name"</span><span class="token operator">:</span> <span class="token string">"query_digest"</span>
      <span class="token punctuation">}</span>
    <span class="token punctuation">}</span>
  <span class="token punctuation">}</span>
<span class="token punctuation">}</span></code></pre>
   </div>
   <p>
    <code class="literal">
     print
    </code>
    items can be written different ways
          to implement different replacement strategies. The
    <code class="literal">
     replace
    </code>
    item just shown specifies the
          replacement text using this
    <code class="literal">
     function
    </code>
    construct to return a string representing the current
          statement digest:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-json"><div class="docs-select-all right" id="sa18790036"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-json"><span class="token property">"function"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
  <span class="token property">"name"</span><span class="token operator">:</span> <span class="token string">"query_digest"</span>
<span class="token punctuation">}</span></code></pre>
   </div>
   <p>
    The
    <code class="literal">
     query_digest
    </code>
    function can also be used
          in another way, as a comparator that returns a Boolean, which
          enables its use in the
    <code class="literal">
     print
    </code>
    condition. To
          do this, provide an argument that specifies a comparison
          statement digest:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-json"><div class="docs-select-all right" id="sa46413687"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-json"><span class="token property">"function"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
  <span class="token property">"name"</span><span class="token operator">:</span> <span class="token string">"query_digest"</span><span class="token punctuation">,</span>
  <span class="token property">"args"</span><span class="token operator">:</span> <span class="token string">"<em class="replaceable">digest</em>"</span>
<span class="token punctuation">}</span></code></pre>
   </div>
   <p>
    In this case,
    <code class="literal">
     query_digest
    </code>
    returns
    <code class="literal">
     true
    </code>
    or
    <code class="literal">
     false
    </code>
    depending
          on whether the current statement digest is the same as the
          comparison digest. Using
    <code class="literal">
     query_digest
    </code>
    this
          way enables filter definitions to detect statements that match
          particular digests. The condition in the following construct
          is true only for statements that have a digest equal to
    <code class="literal">
     SELECT ?
    </code>
    , thus effecting replacement only
          for statements that do not match the digest:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-json"><div class="docs-select-all right" id="sa63530766"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-json"><span class="token property">"print"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
  <span class="token property">"field"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
    <span class="token property">"name"</span><span class="token operator">:</span> <span class="token string">"general_query.str"</span><span class="token punctuation">,</span>
    <span class="token property">"print"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
      <span class="token property">"function"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
        <span class="token property">"name"</span><span class="token operator">:</span> <span class="token string">"query_digest"</span><span class="token punctuation">,</span>
        <span class="token property">"args"</span><span class="token operator">:</span> <span class="token string">"SELECT ?"</span>
      <span class="token punctuation">}</span>
    <span class="token punctuation">}</span><span class="token punctuation">,</span>
    <span class="token property">"replace"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
      <span class="token property">"function"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
        <span class="token property">"name"</span><span class="token operator">:</span> <span class="token string">"query_digest"</span>
      <span class="token punctuation">}</span>
    <span class="token punctuation">}</span>
  <span class="token punctuation">}</span>
<span class="token punctuation">}</span></code></pre>
   </div>
   <p>
    To perform replacement only for statements that do match the
          digest, use
    <code class="literal">
     not
    </code>
    to invert the condition:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-json"><div class="docs-select-all right" id="sa96041431"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-json"><span class="token property">"print"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
  <span class="token property">"field"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
    <span class="token property">"name"</span><span class="token operator">:</span> <span class="token string">"general_query.str"</span><span class="token punctuation">,</span>
    <span class="token property">"print"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
      <span class="token property">"not"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
        <span class="token property">"function"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
          <span class="token property">"name"</span><span class="token operator">:</span> <span class="token string">"query_digest"</span><span class="token punctuation">,</span>
          <span class="token property">"args"</span><span class="token operator">:</span> <span class="token string">"SELECT ?"</span>
        <span class="token punctuation">}</span>
      <span class="token punctuation">}</span>
    <span class="token punctuation">}</span><span class="token punctuation">,</span>
    <span class="token property">"replace"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
      <span class="token property">"function"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
        <span class="token property">"name"</span><span class="token operator">:</span> <span class="token string">"query_digest"</span>
      <span class="token punctuation">}</span>
    <span class="token punctuation">}</span>
  <span class="token punctuation">}</span>
<span class="token punctuation">}</span></code></pre>
   </div>
   <p>
    Suppose that you want the audit log to contain only statement
          digests and not literal statements. To achieve this, you must
          perform replacement on all events that contain statement text;
          that is, events in the
    <code class="literal">
     general
    </code>
    and
    <code class="literal">
     table_access
    </code>
    classes. An earlier filter
          definition showed how to unconditionally replace statement
          text for
    <code class="literal">
     general
    </code>
    events. To do the same for
    <code class="literal">
     table_access
    </code>
    events, use a filter that is
          similar but changes the class from
    <code class="literal">
     general
    </code>
    to
    <code class="literal">
     table_access
    </code>
    and the field name from
    <code class="literal">
     general_query.str
    </code>
    to
    <code class="literal">
     query.str
    </code>
    :
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-json"><div class="docs-select-all right" id="sa97549721"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-json"><span class="token punctuation">{</span>
  <span class="token property">"filter"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
    <span class="token property">"class"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
      <span class="token property">"name"</span><span class="token operator">:</span> <span class="token string">"table_access"</span><span class="token punctuation">,</span>
      <span class="token property">"print"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
        <span class="token property">"field"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
          <span class="token property">"name"</span><span class="token operator">:</span> <span class="token string">"query.str"</span><span class="token punctuation">,</span>
          <span class="token property">"print"</span><span class="token operator">:</span> <span class="token boolean">false</span><span class="token punctuation">,</span>
          <span class="token property">"replace"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
            <span class="token property">"function"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
              <span class="token property">"name"</span><span class="token operator">:</span> <span class="token string">"query_digest"</span>
            <span class="token punctuation">}</span>
          <span class="token punctuation">}</span>
        <span class="token punctuation">}</span>
      <span class="token punctuation">}</span>
    <span class="token punctuation">}</span>
  <span class="token punctuation">}</span>
<span class="token punctuation">}</span></code></pre>
   </div>
   <p>
    Combining the
    <code class="literal">
     general
    </code>
    and
    <code class="literal">
     table_access
    </code>
    filters results in a single
          filter that performs replacement for all statement
          text-containing events:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-json"><div class="docs-select-all right" id="sa22015932"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-json"><span class="token punctuation">{</span>
  <span class="token property">"filter"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
    <span class="token property">"class"</span><span class="token operator">:</span> <span class="token punctuation">[</span>
      <span class="token punctuation">{</span>
        <span class="token property">"name"</span><span class="token operator">:</span> <span class="token string">"general"</span><span class="token punctuation">,</span>
        <span class="token property">"print"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
          <span class="token property">"field"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
            <span class="token property">"name"</span><span class="token operator">:</span> <span class="token string">"general_query.str"</span><span class="token punctuation">,</span>
            <span class="token property">"print"</span><span class="token operator">:</span> <span class="token boolean">false</span><span class="token punctuation">,</span>
            <span class="token property">"replace"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
              <span class="token property">"function"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
                <span class="token property">"name"</span><span class="token operator">:</span> <span class="token string">"query_digest"</span>
              <span class="token punctuation">}</span>
            <span class="token punctuation">}</span>
          <span class="token punctuation">}</span>
        <span class="token punctuation">}</span>
      <span class="token punctuation">}</span><span class="token punctuation">,</span>
      <span class="token punctuation">{</span>
        <span class="token property">"name"</span><span class="token operator">:</span> <span class="token string">"table_access"</span><span class="token punctuation">,</span>
        <span class="token property">"print"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
          <span class="token property">"field"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
            <span class="token property">"name"</span><span class="token operator">:</span> <span class="token string">"query.str"</span><span class="token punctuation">,</span>
            <span class="token property">"print"</span><span class="token operator">:</span> <span class="token boolean">false</span><span class="token punctuation">,</span>
            <span class="token property">"replace"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
              <span class="token property">"function"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
                <span class="token property">"name"</span><span class="token operator">:</span> <span class="token string">"query_digest"</span>
              <span class="token punctuation">}</span>
            <span class="token punctuation">}</span>
          <span class="token punctuation">}</span>
        <span class="token punctuation">}</span>
      <span class="token punctuation">}</span>
    <span class="token punctuation">]</span>
  <span class="token punctuation">}</span>
<span class="token punctuation">}</span></code></pre>
   </div>
   <p>
    To perform replacement on only some events within a class, add
          items to the filter that indicate more specifically when
          replacement occurs. The following filter applies to events in
          the
    <code class="literal">
     table_access
    </code>
    class, but performs
          replacement only for
    <code class="literal">
     insert
    </code>
    and
    <code class="literal">
     update
    </code>
    events (leaving
    <code class="literal">
     read
    </code>
    and
    <code class="literal">
     delete
    </code>
    events
          unchanged):
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-json"><div class="docs-select-all right" id="sa90839186"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-json"><span class="token punctuation">{</span>
  <span class="token property">"filter"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
    <span class="token property">"class"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
      <span class="token property">"name"</span><span class="token operator">:</span> <span class="token string">"table_access"</span><span class="token punctuation">,</span>
      <span class="token property">"event"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
        <span class="token property">"name"</span><span class="token operator">:</span> <span class="token punctuation">[</span>
          <span class="token string">"insert"</span><span class="token punctuation">,</span>
          <span class="token string">"update"</span>
        <span class="token punctuation">]</span><span class="token punctuation">,</span>
        <span class="token property">"print"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
          <span class="token property">"field"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
            <span class="token property">"name"</span><span class="token operator">:</span> <span class="token string">"query.str"</span><span class="token punctuation">,</span>
            <span class="token property">"print"</span><span class="token operator">:</span> <span class="token boolean">false</span><span class="token punctuation">,</span>
            <span class="token property">"replace"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
              <span class="token property">"function"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
                <span class="token property">"name"</span><span class="token operator">:</span> <span class="token string">"query_digest"</span>
              <span class="token punctuation">}</span>
            <span class="token punctuation">}</span>
          <span class="token punctuation">}</span>
        <span class="token punctuation">}</span>
      <span class="token punctuation">}</span>
    <span class="token punctuation">}</span>
  <span class="token punctuation">}</span>
<span class="token punctuation">}</span></code></pre>
   </div>
   <p>
    This filter performs replacement for
    <code class="literal">
     general
    </code>
    class events corresponding to the
          listed account-management statements (the effect being to hide
          credential and data values in the statements):
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-json"><div class="docs-select-all right" id="sa40469679"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-json"><span class="token punctuation">{</span>
  <span class="token property">"filter"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
    <span class="token property">"class"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
      <span class="token property">"name"</span><span class="token operator">:</span> <span class="token string">"general"</span><span class="token punctuation">,</span>
      <span class="token property">"event"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
        <span class="token property">"name"</span><span class="token operator">:</span> <span class="token string">"status"</span><span class="token punctuation">,</span>
        <span class="token property">"print"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
          <span class="token property">"field"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
            <span class="token property">"name"</span><span class="token operator">:</span> <span class="token string">"general_query.str"</span><span class="token punctuation">,</span>
            <span class="token property">"print"</span><span class="token operator">:</span> <span class="token boolean">false</span><span class="token punctuation">,</span>
            <span class="token property">"replace"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
              <span class="token property">"function"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
                <span class="token property">"name"</span><span class="token operator">:</span> <span class="token string">"query_digest"</span>
              <span class="token punctuation">}</span>
            <span class="token punctuation">}</span>
          <span class="token punctuation">}</span>
        <span class="token punctuation">}</span><span class="token punctuation">,</span>
        <span class="token property">"log"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
          <span class="token property">"or"</span><span class="token operator">:</span> <span class="token punctuation">[</span>
            <span class="token punctuation">{</span>
              <span class="token property">"field"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
                <span class="token property">"name"</span><span class="token operator">:</span> <span class="token string">"general_sql_command.str"</span><span class="token punctuation">,</span>
                <span class="token property">"value"</span><span class="token operator">:</span> <span class="token string">"alter_user"</span>
              <span class="token punctuation">}</span>
            <span class="token punctuation">}</span><span class="token punctuation">,</span>
            <span class="token punctuation">{</span>
              <span class="token property">"field"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
                <span class="token property">"name"</span><span class="token operator">:</span> <span class="token string">"general_sql_command.str"</span><span class="token punctuation">,</span>
                <span class="token property">"value"</span><span class="token operator">:</span> <span class="token string">"alter_user_default_role"</span>
              <span class="token punctuation">}</span>
            <span class="token punctuation">}</span><span class="token punctuation">,</span>
            <span class="token punctuation">{</span>
              <span class="token property">"field"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
                <span class="token property">"name"</span><span class="token operator">:</span> <span class="token string">"general_sql_command.str"</span><span class="token punctuation">,</span>
                <span class="token property">"value"</span><span class="token operator">:</span> <span class="token string">"create_role"</span>
              <span class="token punctuation">}</span>
            <span class="token punctuation">}</span><span class="token punctuation">,</span>
            <span class="token punctuation">{</span>
              <span class="token property">"field"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
                <span class="token property">"name"</span><span class="token operator">:</span> <span class="token string">"general_sql_command.str"</span><span class="token punctuation">,</span>
                <span class="token property">"value"</span><span class="token operator">:</span> <span class="token string">"create_user"</span>
              <span class="token punctuation">}</span>
            <span class="token punctuation">}</span>
          <span class="token punctuation">]</span>
        <span class="token punctuation">}</span>
      <span class="token punctuation">}</span>
    <span class="token punctuation">}</span>
  <span class="token punctuation">}</span>
<span class="token punctuation">}</span></code></pre>
   </div>
   <p>
    For information about the possible
    <code class="literal">
     general_sql_command.str
    </code>
    values, see
    <a class="xref" href="audit-log-filter-definitions.html#audit-log-filtering-event-fields" title="Testing Event Field Values">
     Testing Event Field Values
    </a>
    .
   </p>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h5 class="title">
       <a name="audit-log-filtering-filter-replacement">
       </a>
       Replacing a User Filter
      </h5>
     </div>
    </div>
   </div>
   <p>
    In some cases, the filter definition can be changed
          dynamically. To do this, define a
    <code class="literal">
     filter
    </code>
    configuration within an existing
    <code class="literal">
     filter
    </code>
    .
          For example:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-json"><div class="docs-select-all right" id="sa8866616"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-json"><span class="token punctuation">{</span>
  <span class="token property">"filter"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
    <span class="token property">"id"</span><span class="token operator">:</span> <span class="token string">"main"</span><span class="token punctuation">,</span>
    <span class="token property">"class"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
      <span class="token property">"name"</span><span class="token operator">:</span> <span class="token string">"table_access"</span><span class="token punctuation">,</span>
      <span class="token property">"event"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
        <span class="token property">"name"</span><span class="token operator">:</span> <span class="token punctuation">[</span> <span class="token string">"update"</span><span class="token punctuation">,</span> <span class="token string">"delete"</span> <span class="token punctuation">]</span><span class="token punctuation">,</span>
        <span class="token property">"log"</span><span class="token operator">:</span> <span class="token boolean">false</span><span class="token punctuation">,</span>
        <span class="token property">"filter"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
          <span class="token property">"class"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
            <span class="token property">"name"</span><span class="token operator">:</span> <span class="token string">"general"</span><span class="token punctuation">,</span>
            <span class="token property">"event"</span> <span class="token operator">:</span> <span class="token punctuation">{</span> <span class="token property">"name"</span><span class="token operator">:</span> <span class="token string">"status"</span><span class="token punctuation">,</span>
                        <span class="token property">"filter"</span><span class="token operator">:</span> <span class="token punctuation">{</span> <span class="token property">"ref"</span><span class="token operator">:</span> <span class="token string">"main"</span> <span class="token punctuation">}</span> <span class="token punctuation">}</span>
          <span class="token punctuation">}</span><span class="token punctuation">,</span>
          <span class="token property">"activate"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
            <span class="token property">"or"</span><span class="token operator">:</span> <span class="token punctuation">[</span>
              <span class="token punctuation">{</span> <span class="token property">"field"</span><span class="token operator">:</span> <span class="token punctuation">{</span> <span class="token property">"name"</span><span class="token operator">:</span> <span class="token string">"table_name.str"</span><span class="token punctuation">,</span> <span class="token property">"value"</span><span class="token operator">:</span> <span class="token string">"temp_1"</span> <span class="token punctuation">}</span> <span class="token punctuation">}</span><span class="token punctuation">,</span>
              <span class="token punctuation">{</span> <span class="token property">"field"</span><span class="token operator">:</span> <span class="token punctuation">{</span> <span class="token property">"name"</span><span class="token operator">:</span> <span class="token string">"table_name.str"</span><span class="token punctuation">,</span> <span class="token property">"value"</span><span class="token operator">:</span> <span class="token string">"temp_2"</span> <span class="token punctuation">}</span> <span class="token punctuation">}</span>
            <span class="token punctuation">]</span>
          <span class="token punctuation">}</span>
        <span class="token punctuation">}</span>
      <span class="token punctuation">}</span>
    <span class="token punctuation">}</span>
  <span class="token punctuation">}</span>
<span class="token punctuation">}</span></code></pre>
   </div>
   <p>
    A new filter is activated when the
    <code class="literal">
     activate
    </code>
    item within a subfilter evaluates to
    <code class="literal">
     true
    </code>
    .
          Using
    <code class="literal">
     activate
    </code>
    in a top-level
    <code class="literal">
     filter
    </code>
    is not permitted.
   </p>
   <p>
    A new filter can be replaced with the original one by using a
    <code class="literal">
     ref
    </code>
    item inside the subfilter to refer to
          the original filter
    <code class="literal">
     id
    </code>
    .
   </p>
   <p>
    The filter shown operates like this:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       The
       <code class="literal">
        main
       </code>
       filter waits for
       <code class="literal">
        table_access
       </code>
       events, either
       <code class="literal">
        update
       </code>
       or
       <code class="literal">
        delete
       </code>
       .
      </p>
     </li>
     <li class="listitem">
      <p>
       If the
       <code class="literal">
        update
       </code>
       or
       <code class="literal">
        delete
       </code>
       <code class="literal">
        table_access
       </code>
       event occurs on the
       <code class="literal">
        temp_1
       </code>
       or
       <code class="literal">
        temp_2
       </code>
       table, the filter is replaced
              with the internal one (without an
       <code class="literal">
        id
       </code>
       ,
              since there is no need to refer to it explicitly).
      </p>
     </li>
     <li class="listitem">
      <p>
       If the end of the command is signalled
              (
       <code class="literal">
        general
       </code>
       /
       <code class="literal">
        status
       </code>
       event), an entry is written to the audit log file and the
              filter is replaced with the
       <code class="literal">
        main
       </code>
       filter.
      </p>
     </li>
    </ul>
   </div>
   <p>
    The filter is useful to log statements that update or delete
          anything from the
    <code class="literal">
     temp_1
    </code>
    or
    <code class="literal">
     temp_2
    </code>
    tables, such as this one:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa91475053"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">UPDATE</span> temp_1<span class="token punctuation">,</span> temp_3 <span class="token keyword">SET</span> temp_1<span class="token punctuation">.</span>a<span class="token operator">=</span><span class="token number">21</span><span class="token punctuation">,</span> temp_3<span class="token punctuation">.</span>a<span class="token operator">=</span><span class="token number">23</span><span class="token punctuation">;</span></code></pre>
   </div>
   <p>
    The statement generates multiple
    <code class="literal">
     table_access
    </code>
    events, but the audit log file
          contains only
    <code class="literal">
     general
    </code>
    /
    <code class="literal">
     status
    </code>
    entries.
   </p>
   <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
    <div class="admon-title">
     Note
    </div>
    <p>
     Any
     <code class="literal">
      id
     </code>
     values used in the definition are
            evaluated with respect only to that definition. They have
            nothing to do with the value of the
     <a class="link" href="audit-log-reference.html#sysvar_audit_log_filter_id">
      <code class="literal">
       audit_log_filter_id
      </code>
     </a>
     system
            variable.
    </p>
   </div>
  </div>
 </div>
 <br/>
</div>
