• id 

An unsigned integer representing an event ID. 

## Example: 

"id": 2 

For audit records that have the same timestamp  value, their id  values distinguish them and form a sequence. Within the audit log, timestamp / id  pairs are unique. These pairs are bookmarks that identify event locations within the log. 

• login 

Information indicating how a client connected to the server. The value is a hash containing these items: user , os , ip , proxy . 

## Example: 

"login": { "user": "root", "os": "", "ip": "::1", "proxy": "" } 

• shutdown_data 

Information pertaining to audit log plugin termination. The value is a hash containing these items: server_id  This item occurs only for audit records with class  and event  values of audit  and shutdown , respectively. 

## Example: 

"shutdown_data": { "server_id": 1 } 

• startup_data 

Information pertaining to audit log plugin initialization. The value is a hash containing these items: server_id , os_version , mysql_version , args . This item occurs only for audit records with class and event  values of audit  and startup , respectively. 

## Example: 

"startup_data": { "server_id": 1, "os_version": "i686-Linux", "mysql_version": "5.7.21-log", "args": ["/usr/local/mysql/bin/mysqld", "--loose-audit-log-format=JSON", "--log-error=log.err", "--pid-file=mysqld.pid", "--port=3306" ] } 

• table_access_data 

Information about an access to a table. The value is a hash containing these items: db , table , query , sql_command , This item occurs only for audit records with a class  value of table_access . 

## Example: 

"table_access_data": { "db": "test", "table": "t1", "query": "INSERT INTO t1 (i) VALUES(1),(2),(3)", "sql_command": "insert" } 

• timestamp 

