content_image/734935.jpg
SELECT audit_log_filter_set_user(’%’, ’log_all’); 

The filter assigned to %  is used for connections from any account that has no explicitly assigned filter (which initially is true for all accounts). 

Once installed as just described, MySQL Enterprise Audit remains installed until uninstalled. To remove it, execute the following statements: 

## 6.4.5.3 MySQL Enterprise Audit Security Considerations 

DROP TABLE IF EXISTS mysql.audit_log_user; DROP TABLE IF EXISTS mysql.audit_log_filter; UNINSTALL PLUGIN audit_log; DROP FUNCTION audit_log_filter_set_filter; DROP FUNCTION audit_log_filter_remove_filter; DROP FUNCTION audit_log_filter_set_user; DROP FUNCTION audit_log_filter_remove_user; DROP FUNCTION audit_log_filter_flush; DROP FUNCTION audit_log_encryption_password_get; DROP FUNCTION audit_log_encryption_password_set; DROP FUNCTION audit_log_read; DROP FUNCTION audit_log_read_bookmark; 

By default, contents of audit log files produced by the audit log plugin are not encrypted and may contain sensitive information, such as the text of SQL statements. For security reasons, audit log files should be written to a directory accessible only to the MySQL server and to users with a legitimate reason to view the log. The default file name is audit.log  in the data directory. This can be changed by setting the audit_log_file  system variable at server startup. Other audit log files may exist due to log rotation. 

For additional security, enable audit log file encryption. See Encrypting Audit Log Files. 

## 6.4.5.4 Audit Log File Formats 

The MySQL server calls the audit log plugin to write an audit record to its log file whenever an auditable event occurs. Typically the first audit record written after plugin startup contains the server description and startup options. Elements following that one represent events such as client connect and disconnect events, executed SQL statements, and so forth. Only top-level statements are logged, not statements within stored programs such as triggers or stored procedures. Contents of files referenced by statements such as LOAD DATA  are not logged. 

To select the log format that the audit log plugin uses to write its log file, set the audit_log_format system variable at server startup. These formats are available: 

•New-style XML format ( audit_log_format=NEW ): An XML format that has better compatibility with Oracle Audit Vault than old-style XML format. MySQL 8.0 uses new-style XML format by default. 

•Old-style XML format ( audit_log_format=OLD ): The original audit log format used by default in older MySQL series. 

•JSON format ( audit_log_format=JSON ) 

By default, audit log file contents are written in new-style XML format, without compression or encryption. 

<img src='content_image/734935.jpg'>

The following sections describe the available audit logging formats: 

•New-Style XML Audit Log File Format 

## Note 

For information about issues to consider when changing the log format, see Selecting Audit Log File Format. 

