A string representing a UTC value in YYYY-MM-DD T hh:mm:ss  UTC  format indicating the date and time when the audit event was generated. For example, the event corresponding to execution of an SQL statement received from a client has a <TIMESTAMP>  value occurring after the statement finishes, not when it was received. 

Example: 

<TIMESTAMP>2019-10-03T14:09:45 UTC</TIMESTAMP> 

The following elements are optional in <AUDIT_RECORD>  elements. Many of them occur only with specific <NAME>  element values. 

• <COMMAND_CLASS> 

A string that indicates the type of action performed. 

Example: 

<COMMAND_CLASS>drop_table</COMMAND_CLASS> 

The values correspond to the statement/sql/ xxx  command counters. For example, xxx  is drop_table  and select  for DROP TABLE  and SELECT  statements, respectively. The following statement displays the possible names: 

SELECT REPLACE(EVENT_NAME, ’statement/sql/’, ’’) AS name FROM performance_schema.events_statements_summary_global_by_event_name WHERE EVENT_NAME LIKE ’statement/sql/%’ ORDER BY name; 

• <CONNECTION_ATTRIBUTES> 

As of MySQL 8.0.19, events with a <COMMAND_CLASS>  value of connect  may include a <CONNECTION_ATTRIBUTES>  element to display the connection attributes passed by the client at connect time. (For information about these attributes, which are also exposed in Performance Schema tables, see Section 27.12.9, “Performance Schema Connection Attribute Tables” .) 

The <CONNECTION_ATTRIBUTES>  element contains one <ATTRIBUTE>  element per attribute, each of which contains <NAME>  and <VALUE>  elements to indicate the attribute name and value, respectively. 

Example: 

<CONNECTION_ATTRIBUTES>  <ATTRIBUTE> <NAME>_pid</NAME> <VALUE>42794</VALUE>  </ATTRIBUTE>  <ATTRIBUTE> <NAME>_os</NAME> <VALUE>macos0.14</VALUE>  </ATTRIBUTE>  <ATTRIBUTE> <NAME>_platform</NAME> <VALUE>x86_64</VALUE>  </ATTRIBUTE>  <ATTRIBUTE> <NAME>_client_version</NAME> <VALUE>8.0.19</VALUE>  </ATTRIBUTE>  <ATTRIBUTE> <NAME>_client_name</NAME> <VALUE>libmysql</VALUE> 

