} } } } } 

Statements matched and blocked by the filter return an error to the client: 

ERROR 1045 (28000): Statement was aborted by an audit log filter 

Not all events can be blocked (see Table 6.30, “Log and Abort Characteristics Per Event Class and Subclass Combination” ). For an event that cannot, the audit log writes a warning to the error log rather than blocking it. 

For attempts to define a filter in which the abort  item appears elsewhere than in an event  item, an error occurs. 

## Logical Operators 

Logical operators ( and , or , not ) can be used in log  items. This permits construction of more advanced filtering configurations: 

{ "filter": { "class": { "name": "general", "event": { "name": "status", "log": { "or": [ { "and": [ { "field": { "name": "general_command.str", "value": "Query" } }, { "field": { "name": "general_command.length", "value": 5 } } ] }, { "and": [ { "field": { "name": "general_command.str", "value": "Execute" } }, { "field": { "name": "general_command.length", "value": 7 } } ] } ] } } } } } 

## Referencing Predefined Variables 

To refer to a predefined variable in a log  condition, use a variable  item, which tests equality against a given value: 

{ "filter": { "class": { "name": "general", "event": { "name": "status", "log": { "variable": { "name": "audit_log_connection_policy_value", "value": "::none" 

