content_image/847792.jpg
If log files are encrypted, the original file name already contains a timestamp indicating the encryption password creation time (see Naming Conventions for Audit Log Files). In this case, the file name after rotation contains two timestamps. For example, an encrypted log file named audit.log.20210110T130749-1.enc  is renamed to a value such as audit.20210115T140633.log.20210110T130749-1.enc . 

## Audit Log File Pruning 

The audit log plugin supports pruning of rotated JSON-format audit log files, if automatic log file rotation is enabled. To use this capability: 

•Set audit_log_format  to JSON . (In addition, consider also changing audit_log_file ; see Selecting Audit Log File Format.) 

•Set audit_log_rotate_on_size  greater than 0 to specify the size in bytes at which automatic log file rotation occurs. 

•By default, no pruning of automatically rotated JSON-format log files occurs. To enable pruning, set one of these system variables to a value greater than 0: 

•Set audit_log_max_size  greater than 0 to specify the limit in bytes on the combined size of rotated log files above which the files become subject to pruning. audit_log_max_size  is available as of MySQL 8.0.26. 

•Set audit_log_prune_seconds  greater than 0 to specify the number of seconds after which rotated log files become subject to pruning. audit_log_prune_seconds  is available as of MySQL 8.0.24. 

Nonzero values of audit_log_max_size  take precedence over nonzero values of audit_log_prune_seconds . If both are set greater than 0 at plugin initialization, a warning is written to the server error log. If a client sets both greater than 0 at runtime, a warning is returned to the client. 

<img src='content_image/847792.jpg'>

Pruning of JSON-format log files, if enabled, occurs as follows: 

## Note 

Warnings to the error log are written as Notes, which are information messages. To ensure that such messages appear in the error log and are not discarded, make sure that error-logging verbosity is sufficient to include information messages. For example, if you are using priority-based log filtering, as described in Section 5.4.2.5, “Priority-Based Error Log Filtering (log_filter_internal)” , set the log_error_verbosity  system variable to a value of 3. 

•When automatic rotation takes place; for the conditions under which this happens, see Automatic Audit Log File Rotation. 

•When the global audit_log_max_size  or audit_log_prune_seconds  system variable is set at runtime. 

For pruning based on combined rotated log file size, if the combined size is greater than the limit specified by audit_log_max_size , the audit log plugin removes the oldest files until their combined size does not exceed the limit. 

For pruning based on rotated log file age, the pruning point is the current time minus the value of audit_log_prune_seconds . In rotated JSON-format log files, the timestamp part of each file name indicates the timestamp of the last event written to the file. The audit log plugin uses file name timestamps to determine which files contain only events older than the pruning point, and removes them. 

