USER="root" OS_LOGIN="" HOST="localhost" IP="127.0.0.1" COMMAND_CLASS="connect" CONNECTION_TYPE="SSL/TLS"/> <AUDIT_RECORD TIMESTAMP="2019-10-03T14:25:32 UTC" RECORD_ID="12_2019-10-03T14:25:00" NAME="NoAudit" SERVER_ID="1"/> </AUDIT> 

The audit log file is written as XML, using UTF-8 (up to 4 bytes per character). The root element is <AUDIT> . The root element contains <AUDIT_RECORD>  elements, each of which provides information about an audited event. When the audit log plugin begins writing a new log file, it writes the XML declaration and opening <AUDIT>  root element tag. When the plugin closes a log file, it writes the closing </AUDIT>  root element tag. The closing tag is not present while the file is open. 

Attributes of <AUDIT_RECORD>  elements have these characteristics: 

•Some attributes appear in every <AUDIT_RECORD>  element. Others are optional and may appear depending on the audit record type. 

•Order of attributes within an <AUDIT_RECORD>  element is not guaranteed. 

•Attribute values are not fixed length. Long values may be truncated as indicated in the attribute descriptions given later. 

•The < , > , " , and &  characters are encoded as &lt; , &gt; , &quot; , and &amp; , respectively. NUL bytes (U+00) are encoded as the ?  character. 

•Characters not valid as XML characters are encoded using numeric character references. Valid XML characters are: 

#x9 | #xA | #xD | [#x20-#xD7FF] | [#xE000-#xFFFD] | [#x10000-#x10FFFF] 

The following attributes are mandatory in every <AUDIT_RECORD>  element: 

• NAME 

A string representing the type of instruction that generated the audit event, such as a command that the server received from a client. 

Example: NAME="Query" 

Some common NAME  values: 

Audit When auditing starts, which may be server startup time Connect When a client connects, also known as logging in Query An SQL statement (executed directly) Prepare Preparation of an SQL statement; usually followed by Execute Execute Execution of an SQL statement; usually follows Prepare Shutdown Server shutdown Quit When a client disconnects NoAudit Auditing has been turned off 

The possible values are Audit , Binlog Dump , Change user , Close stmt , Connect Out , Connect , Create DB , Daemon , Debug , Delayed insert , Drop DB , Execute , Fetch , Field List , Init DB , Kill , Long Data , NoAudit , Ping , Prepare , Processlist , Query , Quit , Refresh , Register Slave , Reset stmt , Set option , Shutdown , Sleep , Statistics , Table Dump , TableDelete , TableInsert , TableRead , TableUpdate , Time . 

