<div id="docs-body">
 <div class="section">
  <div class="titlepage">
   <div>
    <div>
     <h4 class="title">
      <a name="audit-log-filtering">
      </a>
      8.4.5.7 Audit Log Filtering
     </h4>
    </div>
   </div>
  </div>
  <a class="indexterm" name="idm46045237322224">
  </a>
  <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
   <div class="admon-title">
    Note
   </div>
   <p>
    For audit log filtering to work as described here, the audit
          log plugin
    <span class="emphasis">
     <em>
      and the accompanying audit tables and
          functions
     </em>
    </span>
    must be installed. If the plugin is
          installed without the accompanying audit tables and functions
          needed for rule-based filtering, the plugin operates in legacy
          filtering mode, described in
    <a class="xref" href="audit-log-legacy-filtering.html" title="8.4.5.10 Legacy Mode Audit Log Filtering">
     Section 8.4.5.10, “Legacy Mode Audit Log Filtering”
    </a>
    . Legacy mode
          (deprecated) is filtering behavior as it was prior to MySQL
          5.7.13; that is, before the introduction of rule-based
          filtering.
   </p>
  </div>
  <div class="itemizedlist">
   <ul class="itemizedlist" style="list-style-type: disc; ">
    <li class="listitem">
     <p>
      <a class="xref" href="audit-log-filtering.html#audit-log-filtering-properties" title="Properties of Audit Log Filtering">
       Properties of Audit Log Filtering
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="audit-log-filtering.html#audit-log-filtering-function-constraints" title="Constraints on Audit Log Filtering Functions">
       Constraints on Audit Log Filtering Functions
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="audit-log-filtering.html#audit-log-filtering-function-usage" title="Using Audit Log Filtering Functions">
       Using Audit Log Filtering Functions
      </a>
     </p>
    </li>
   </ul>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h5 class="title">
       <a name="audit-log-filtering-properties">
       </a>
       Properties of Audit Log Filtering
      </h5>
     </div>
    </div>
   </div>
   <p>
    The audit log plugin has the capability of controlling logging
          of audited events by filtering them:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       Audited events can be filtered using these
              characteristics:
      </p>
      <div class="itemizedlist">
       <ul class="itemizedlist" style="list-style-type: circle; ">
        <li class="listitem">
         <p>
          User account
         </p>
        </li>
        <li class="listitem">
         <p>
          Audit event class
         </p>
        </li>
        <li class="listitem">
         <p>
          Audit event subclass
         </p>
        </li>
        <li class="listitem">
         <p>
          Audit event fields such as those that indicate
                  operation status or SQL statement executed
         </p>
        </li>
       </ul>
      </div>
     </li>
     <li class="listitem">
      <p>
       Audit filtering is rule based:
      </p>
      <div class="itemizedlist">
       <ul class="itemizedlist" style="list-style-type: circle; ">
        <li class="listitem">
         <p>
          A filter definition creates a set of auditing rules.
                  Definitions can be configured to include or exclude
                  events for logging based on the characteristics just
                  described.
         </p>
        </li>
        <li class="listitem">
         <p>
          Filter rules have the capability of blocking
                  (aborting) execution of qualifying events, in addition
                  to existing capabilities for event logging.
         </p>
        </li>
        <li class="listitem">
         <p>
          Multiple filters can be defined, and any given filter
                  can be assigned to any number of user accounts.
         </p>
        </li>
        <li class="listitem">
         <p>
          It is possible to define a default filter to use with
                  any user account that has no explicitly assigned
                  filter.
         </p>
        </li>
       </ul>
      </div>
      <p>
       Audit log filtering is used to implement component
              services. To get the optional query statistics available
              from that release, you set them up as a filter using the
              service component, which implements the services that
              write the statistics to the audit log. For instructions to
              set this filter up, see
       <a class="xref" href="audit-log-logging-configuration.html#audit-log-query-statistics" title="Adding Query Statistics for Outlier Detection">
        Adding Query Statistics for Outlier Detection
       </a>
       .
      </p>
      <p>
       For information about writing filtering rules, see
       <a class="xref" href="audit-log-filter-definitions.html" title="8.4.5.8 Writing Audit Log Filter Definitions">
        Section 8.4.5.8, “Writing Audit Log Filter Definitions”
       </a>
       .
      </p>
     </li>
     <li class="listitem">
      <p>
       Audit filters can be defined and modified using an SQL
              interface based on function calls. To display audit
              filters, query the
       <code class="literal">
        mysql.audit_log_filter
       </code>
       table.
      </p>
     </li>
     <li class="listitem">
      <p>
       Audit filter definitions are stored in the tables in the
       <code class="literal">
        mysql
       </code>
       system database.
      </p>
     </li>
     <li class="listitem">
      <p>
       Within a given session, the value of the read-only
       <a class="link" href="audit-log-reference.html#sysvar_audit_log_filter_id">
        <code class="literal">
         audit_log_filter_id
        </code>
       </a>
       system variable indicates whether a filter is assigned to
              the session.
      </p>
     </li>
    </ul>
   </div>
   <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
    <div class="admon-title">
     Note
    </div>
    <p>
     By default, rule-based audit log filtering logs no auditable
            events for any users. To log all auditable events for all
            users, use the following statements, which create a simple
            filter to enable logging and assign it to the default
            account:
    </p>
    <div class="copytoclipboard-wrapper">
     <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa71775112"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">SELECT</span> audit_log_filter_set_filter<span class="token punctuation">(</span><span class="token string">'log_all'</span><span class="token punctuation">,</span> <span class="token string">'{ "filter": { "log": true } }'</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
<span class="token keyword">SELECT</span> audit_log_filter_set_user<span class="token punctuation">(</span><span class="token string">'%'</span><span class="token punctuation">,</span> <span class="token string">'log_all'</span><span class="token punctuation">)</span><span class="token punctuation">;</span></code></pre>
    </div>
    <p>
     The filter assigned to
     <code class="literal">
      %
     </code>
     is used for
            connections from any account that has no explicitly assigned
            filter (which initially is true for all accounts).
    </p>
   </div>
   <p>
    As previously mentioned, the SQL interface for audit filtering
          control is function based. The following list briefly
          summarizes these functions:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       <a class="link" href="audit-log-reference.html#function_audit-log-filter-set-filter">
        <code class="literal">
         audit_log_filter_set_filter()
        </code>
       </a>
       :
              Define a filter.
      </p>
     </li>
     <li class="listitem">
      <p>
       <a class="link" href="audit-log-reference.html#function_audit-log-filter-remove-filter">
        <code class="literal">
         audit_log_filter_remove_filter()
        </code>
       </a>
       :
              Remove a filter.
      </p>
     </li>
     <li class="listitem">
      <p>
       <a class="link" href="audit-log-reference.html#function_audit-log-filter-set-user">
        <code class="literal">
         audit_log_filter_set_user()
        </code>
       </a>
       :
              Start filtering a user account.
      </p>
     </li>
     <li class="listitem">
      <p>
       <a class="link" href="audit-log-reference.html#function_audit-log-filter-remove-user">
        <code class="literal">
         audit_log_filter_remove_user()
        </code>
       </a>
       :
              Stop filtering a user account.
      </p>
     </li>
     <li class="listitem">
      <p>
       <a class="link" href="audit-log-reference.html#function_audit-log-filter-flush">
        <code class="literal">
         audit_log_filter_flush()
        </code>
       </a>
       :
              Flush manual changes to the filter tables to affect
              ongoing filtering.
      </p>
     </li>
    </ul>
   </div>
   <p>
    For usage examples and complete details about the filtering
          functions, see
    <a class="xref" href="audit-log-filtering.html#audit-log-filtering-function-usage" title="Using Audit Log Filtering Functions">
     Using Audit Log Filtering Functions
    </a>
    , and
    <a class="xref" href="audit-log-reference.html#audit-log-routines" title="Audit Log Functions">
     Audit Log Functions
    </a>
    .
   </p>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h5 class="title">
       <a name="audit-log-filtering-function-constraints">
       </a>
       Constraints on Audit Log Filtering Functions
      </h5>
     </div>
    </div>
   </div>
   <p>
    Audit log filtering functions are subject to these
          constraints:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       To use any filtering function, the
       <code class="literal">
        audit_log
       </code>
       plugin must be enabled or an
              error occurs. In addition, the audit tables must exist or
              an error occurs. To install the
       <code class="literal">
        audit_log
       </code>
       plugin and its accompanying
              functions and tables, see
       <a class="xref" href="audit-log-installation.html" title="8.4.5.2 Installing or Uninstalling MySQL Enterprise Audit">
        Section 8.4.5.2, “Installing or Uninstalling MySQL Enterprise Audit”
       </a>
       .
      </p>
     </li>
     <li class="listitem">
      <p>
       To use any filtering function, a user must possess the
       <a class="link" href="privileges-provided.html#priv_audit-admin">
        <code class="literal">
         AUDIT_ADMIN
        </code>
       </a>
       <a class="link" href="privileges-provided.html#priv_super">
        <code class="literal">
         SUPER
        </code>
       </a>
       privilege or an error
              occurs. To grant one of these privileges to a user
              account, use this statement:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa88120094"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">GRANT</span> <em class="replaceable">privilege</em> <span class="token keyword">ON</span> <span class="token operator">*</span><span class="token punctuation">.</span><span class="token operator">*</span> <span class="token keyword">TO</span> <span class="token keyword"><em class="replaceable">user</em></span><span class="token punctuation">;</span></code></pre>
      </div>
      <p>
       Alternatively, should you prefer to avoid granting the
       <a class="link" href="privileges-provided.html#priv_audit-admin">
        <code class="literal">
         AUDIT_ADMIN
        </code>
       </a>
       or
       <a class="link" href="privileges-provided.html#priv_super">
        <code class="literal">
         SUPER
        </code>
       </a>
       privilege while still
              permitting users to access specific filtering functions,
       <span class="quote">
        “
        <span class="quote">
         wrapper
        </span>
        ”
       </span>
       stored programs can be defined.
              This technique is described in the context of keyring
              functions in
       <a class="xref" href="keyring-functions-general-purpose.html#keyring-function-usage" title="Using General-Purpose Keyring Functions">
        Using General-Purpose Keyring Functions
       </a>
       ; it
              can be adapted for use with filtering functions.
      </p>
     </li>
     <li class="listitem">
      <p>
       The
       <code class="literal">
        audit_log
       </code>
       plugin operates in legacy
              mode if it is installed but the accompanying audit tables
              and functions are not created. The plugin writes these
              messages to the error log at server startup:
      </p>
      <a class="indexterm" name="idm46045237260608">
      </a>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-none"><div class="docs-select-all right" id="sa69320142"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-none">[Warning] Plugin audit_log reported: 'Failed to open the audit log filter tables.'
[Warning] Plugin audit_log reported: 'Audit Log plugin supports a filtering,
which has not been installed yet. Audit Log plugin will run in the legacy
mode, which will be disabled in the next release.'</code></pre>
      </div>
      <p>
       In legacy mode, which is deprecated, filtering can be done
              based only on event account or status. For details, see
       <a class="xref" href="audit-log-legacy-filtering.html" title="8.4.5.10 Legacy Mode Audit Log Filtering">
        Section 8.4.5.10, “Legacy Mode Audit Log Filtering”
       </a>
       .
      </p>
     </li>
     <li class="listitem">
      <p>
       It is theoretically possible for a user with sufficient
              permissions to mistakenly create an
       <span class="quote">
        “
        <span class="quote">
         abort
        </span>
        ”
       </span>
       item in the audit log filter that prevents themselves and
              other administrators from accessing the system. The
       <a class="link" href="privileges-provided.html#priv_audit-abort-exempt">
        <code class="literal">
         AUDIT_ABORT_EXEMPT
        </code>
       </a>
       privilege is available to permit a user account’s
              queries to always be executed even if an
       <span class="quote">
        “
        <span class="quote">
         abort
        </span>
        ”
       </span>
       item would block them. Accounts with
              this privilege can therefore be used to regain access to a
              system following an audit misconfiguration. The query is
              still logged in the audit log, but instead of being
              rejected, it is permitted due to the privilege.
      </p>
      <p>
       Accounts created with the
       <a class="link" href="privileges-provided.html#priv_system-user">
        <code class="literal">
         SYSTEM_USER
        </code>
       </a>
       privilege have
              the
       <a class="link" href="privileges-provided.html#priv_audit-abort-exempt">
        <code class="literal">
         AUDIT_ABORT_EXEMPT
        </code>
       </a>
       privilege assigned automatically when they are created.
              The
       <a class="link" href="privileges-provided.html#priv_audit-abort-exempt">
        <code class="literal">
         AUDIT_ABORT_EXEMPT
        </code>
       </a>
       privilege is also assigned to existing accounts with the
       <a class="link" href="privileges-provided.html#priv_system-user">
        <code class="literal">
         SYSTEM_USER
        </code>
       </a>
       privilege when
              you carry out an upgrade procedure, if no existing
              accounts have that privilege assigned.
      </p>
     </li>
    </ul>
   </div>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h5 class="title">
       <a name="audit-log-filtering-function-usage">
       </a>
       Using Audit Log Filtering Functions
      </h5>
     </div>
    </div>
   </div>
   <p>
    Before using the audit log functions, install them according
          to the instructions provided in
    <a class="xref" href="audit-log-installation.html" title="8.4.5.2 Installing or Uninstalling MySQL Enterprise Audit">
     Section 8.4.5.2, “Installing or Uninstalling MySQL Enterprise Audit”
    </a>
    . The
    <a class="link" href="privileges-provided.html#priv_audit-admin">
     <code class="literal">
      AUDIT_ADMIN
     </code>
    </a>
    or
    <a class="link" href="privileges-provided.html#priv_super">
     <code class="literal">
      SUPER
     </code>
    </a>
    privilege is required to
          use any of these functions.
   </p>
   <p>
    The audit log filtering functions enable filtering control by
          providing an interface to create, modify, and remove filter
          definitions and assign filters to user accounts.
   </p>
   <p>
    Filter definitions are
    <a class="link" href="json.html" title="13.5 The JSON Data Type">
     <code class="literal">
      JSON
     </code>
    </a>
    values. For information about using
    <a class="link" href="json.html" title="13.5 The JSON Data Type">
     <code class="literal">
      JSON
     </code>
    </a>
    data in MySQL, see
    <a class="xref" href="json.html" title="13.5 The JSON Data Type">
     Section 13.5, “The JSON Data Type”
    </a>
    . This section shows some simple filter
          definitions. For more information about filter definitions,
          see
    <a class="xref" href="audit-log-filter-definitions.html" title="8.4.5.8 Writing Audit Log Filter Definitions">
     Section 8.4.5.8, “Writing Audit Log Filter Definitions”
    </a>
    .
   </p>
   <p>
    When a connection arrives, the audit log plugin determines
          which filter to use for the new session by searching for the
          user account name in the current filter assignments:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       If a filter is assigned to the user, the audit log uses
              that filter.
      </p>
     </li>
     <li class="listitem">
      <p>
       Otherwise, if no user-specific filter assignment exists,
              but there is a filter assigned to the default account
              (
       <code class="literal">
        %
       </code>
       ), the audit log uses the default
              filter.
      </p>
     </li>
     <li class="listitem">
      <p>
       Otherwise, the audit log selects no audit events from the
              session for processing.
      </p>
     </li>
    </ul>
   </div>
   <p>
    If a change-user operation occurs during a session (see
    <a class="ulink" href="/doc/c-api/8.4/en/mysql-change-user.html" target="_top">
     mysql_change_user()
    </a>
    ), filter assignment for
          the session is updated using the same rules but for the new
          user.
   </p>
   <p>
    By default, no accounts have a filter assigned, so no
          processing of auditable events occurs for any account.
   </p>
   <p>
    Suppose that you want to change the default to be to log only
          connection-related activity (for example, to see connect,
          change-user, and disconnect events, but not the SQL statements
          users execute while connected). To achieve this, define a
          filter (shown here named
    <code class="literal">
     log_conn_events
    </code>
    )
          that enables logging only of events in the
    <code class="literal">
     connection
    </code>
    class, and assign that filter to
          the default account, represented by the
    <code class="literal">
     %
    </code>
    account name:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa54485022"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">SET</span> <span class="token variable">@f</span> <span class="token operator">=</span> <span class="token string">'{ "filter": { "class": { "name": "connection" } } }'</span><span class="token punctuation">;</span>
<span class="token keyword">SELECT</span> audit_log_filter_set_filter<span class="token punctuation">(</span><span class="token string">'log_conn_events'</span><span class="token punctuation">,</span> <span class="token variable">@f</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
<span class="token keyword">SELECT</span> audit_log_filter_set_user<span class="token punctuation">(</span><span class="token string">'%'</span><span class="token punctuation">,</span> <span class="token string">'log_conn_events'</span><span class="token punctuation">)</span><span class="token punctuation">;</span></code></pre>
   </div>
   <p>
    Now the audit log uses this default account filter for
          connections from any account that has no explicitly defined
          filter.
   </p>
   <p>
    To assign a filter explicitly to a particular user account or
          accounts, define the filter, then assign it to the relevant
          accounts:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa37738113"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">SELECT</span> audit_log_filter_set_filter<span class="token punctuation">(</span><span class="token string">'log_all'</span><span class="token punctuation">,</span> <span class="token string">'{ "filter": { "log": true } }'</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
<span class="token keyword">SELECT</span> audit_log_filter_set_user<span class="token punctuation">(</span><span class="token string">'user1@localhost'</span><span class="token punctuation">,</span> <span class="token string">'log_all'</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
<span class="token keyword">SELECT</span> audit_log_filter_set_user<span class="token punctuation">(</span><span class="token string">'user2@localhost'</span><span class="token punctuation">,</span> <span class="token string">'log_all'</span><span class="token punctuation">)</span><span class="token punctuation">;</span></code></pre>
   </div>
   <p>
    Now full logging is enabled for
    <code class="literal">
     user1@localhost
    </code>
    and
    <code class="literal">
     user2@localhost
    </code>
    . Connections from other
          accounts continue to be filtered using the default account
          filter.
   </p>
   <p>
    To disassociate a user account from its current filter, either
          unassign the filter or assign a different filter:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       To unassign the filter from the user account:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa72099046"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">SELECT</span> audit_log_filter_remove_user<span class="token punctuation">(</span><span class="token string">'user1@localhost'</span><span class="token punctuation">)</span><span class="token punctuation">;</span></code></pre>
      </div>
      <p>
       Filtering of current sessions for the account remains
              unaffected. Subsequent connections from the account are
              filtered using the default account filter if there is one,
              and are not logged otherwise.
      </p>
     </li>
     <li class="listitem">
      <p>
       To assign a different filter to the user account:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa3929482"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">SELECT</span> audit_log_filter_set_filter<span class="token punctuation">(</span><span class="token string">'log_nothing'</span><span class="token punctuation">,</span> <span class="token string">'{ "filter": { "log": false } }'</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
<span class="token keyword">SELECT</span> audit_log_filter_set_user<span class="token punctuation">(</span><span class="token string">'user1@localhost'</span><span class="token punctuation">,</span> <span class="token string">'log_nothing'</span><span class="token punctuation">)</span><span class="token punctuation">;</span></code></pre>
      </div>
      <p>
       Filtering of current sessions for the account remains
              unaffected. Subsequent connections from the account are
              filtered using the new filter. For the filter shown here,
              that means no logging for new connections from
       <code class="literal">
        user1@localhost
       </code>
       .
      </p>
     </li>
    </ul>
   </div>
   <p>
    For audit log filtering, user name and host name comparisons
          are case-sensitive. This differs from comparisons for
          privilege checking, for which host name comparisons are not
          case-sensitive.
   </p>
   <p>
    To remove a filter, do this:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa19280512"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">SELECT</span> audit_log_filter_remove_filter<span class="token punctuation">(</span><span class="token string">'log_nothing'</span><span class="token punctuation">)</span><span class="token punctuation">;</span></code></pre>
   </div>
   <p>
    Removing a filter also unassigns it from any users to whom it
          is assigned, including any current sessions for those users.
   </p>
   <p>
    The filtering functions just described affect audit filtering
          immediately and update the audit log tables in the
    <code class="literal">
     mysql
    </code>
    system database that store filters
          and user accounts (see
    <a class="xref" href="audit-log-reference.html#audit-log-tables" title="Audit Log Tables">
     Audit Log Tables
    </a>
    ). It
          is also possible to modify the audit log tables directly using
          statements such as
    <a class="link" href="insert.html" title="15.2.7 INSERT Statement">
     <code class="literal">
      INSERT
     </code>
    </a>
    ,
    <a class="link" href="update.html" title="15.2.17 UPDATE Statement">
     <code class="literal">
      UPDATE
     </code>
    </a>
    , and
    <a class="link" href="delete.html" title="15.2.2 DELETE Statement">
     <code class="literal">
      DELETE
     </code>
    </a>
    , but such changes do not
          affect filtering immediately. To flush your changes and make
          them operational, call
    <a class="link" href="audit-log-reference.html#function_audit-log-filter-flush">
     <code class="literal">
      audit_log_filter_flush()
     </code>
    </a>
    :
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa69356782"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">SELECT</span> audit_log_filter_flush<span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">;</span></code></pre>
   </div>
   <div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;">
    <div class="admon-title">
     Warning
    </div>
    <p>
     <a class="link" href="audit-log-reference.html#function_audit-log-filter-flush">
      <code class="literal">
       audit_log_filter_flush()
      </code>
     </a>
     should be used only after modifying the audit tables
            directly, to force reloading all filters. Otherwise, this
            function should be avoided. It is, in effect, a simplified
            version of unloading and reloading the
     <code class="literal">
      audit_log
     </code>
     plugin with
     <a class="link" href="uninstall-plugin.html" title="15.7.4.6 UNINSTALL PLUGIN Statement">
      <code class="literal">
       UNINSTALL PLUGIN
      </code>
     </a>
     plus
     <a class="link" href="install-plugin.html" title="15.7.4.4 INSTALL PLUGIN Statement">
      <code class="literal">
       INSTALL PLUGIN
      </code>
     </a>
     .
    </p>
    <p>
     <a class="link" href="audit-log-reference.html#function_audit-log-filter-flush">
      <code class="literal">
       audit_log_filter_flush()
      </code>
     </a>
     affects all current sessions and detaches them from their
            previous filters. Current sessions are no longer logged
            unless they disconnect and reconnect, or execute a
            change-user operation.
    </p>
   </div>
   <p>
    To determine whether a filter is assigned to the current
          session, check the session value of the read-only
    <a class="link" href="audit-log-reference.html#sysvar_audit_log_filter_id">
     <code class="literal">
      audit_log_filter_id
     </code>
    </a>
    system
          variable. If the value is 0, no filter is assigned. A nonzero
          value indicates the internally maintained ID of the assigned
          filter:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa22017846"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token prompt">mysql&gt;</span> <span class="token keyword">SELECT</span> <span class="token variable">@@audit_log_filter_id</span><span class="token punctuation">;</span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output"><span class="token punctuation">|</span> @@audit_log_filter_id <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output"><span class="token punctuation">|</span>                     2 <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span></code></pre>
   </div>
  </div>
 </div>
 <br/>
</div>
