content_image/788630.jpg
This variable corresponds to the value of the audit_log_statement_policy  system variable. The value is an unsigned integer. Table 6.36, “audit_log_statement_policy_value Values”  shows the permitted values and the corresponding audit_log_statement_policy  values. 

<img src='content_image/788630.jpg'>

The ":: xxx "  values are symbolic pseudo-constants that may be given instead of the literal numeric values. They must be quoted as strings and are case-sensitive. 

## Referencing Predefined Functions 

To refer to a predefined function in a log  condition, use a function  item, which takes name  and args values to specify the function name and its arguments, respectively: 

{ "filter": { "class": { "name": "general", "event": { "name": "status", "log": { "function": { "name": "find_in_include_list", "args": [ { "string": [ { "field": "user.str" }, { "string": "@"}, { "field": "host.str" } ] } ] } } } } } } 

The function as specified in the name  item should be the function name only, without parentheses or the argument list. Arguments in the args  item, if there is one, must be given in the order listed in the function description. Arguments can refer to predefined variables, event fields, or string or numeric constants. 

The preceding filter determines whether to log general  class status  events depending on whether the current user is found in the audit_log_include_accounts  system variable. That user is constructed using fields in the event. 

The following list describes the permitted predefined functions for function  items: 

• audit_log_exclude_accounts_is_null() 

Checks whether the audit_log_exclude_accounts  system variable is NULL . This function can be helpful when defining filters that correspond to the legacy audit log implementation. 

Arguments: 

None. 

