## JSON Audit Log File Format 

• VERSION 

An unsigned integer representing the version of the audit log file format. 

Example: VERSION="1" 

For JSON-format audit logging ( audit_log_format=JSON ), the log file contents form a JSON  array with each array element representing an audited event as a JSON  hash of key-value pairs. Examples of complete event records appear later in this section. The following is an excerpt of partial events: 

[ { "timestamp": "2019-10-03 13:50:01", "id": 0, "class": "audit", "event": "startup", ... }, { "timestamp": "2019-10-03 15:02:32", "id": 0, "class": "connection", "event": "connect", ... }, ... { "timestamp": "2019-10-03 17:37:26", "id": 0, "class": "table_access", "event": "insert", ... } ... ] 

The audit log file is written using UTF-8 (up to 4 bytes per character). When the audit log plugin begins writing a new log file, it writes the opening [  array marker. When the plugin closes a log file, it writes the closing ]  array marker. The closing marker is not present while the file is open. 

Items within audit records have these characteristics: 

•Some items appear in every audit record. Others are optional and may appear depending on the audit record type. 

•Order of items within an audit record is not guaranteed. 

•Item values are not fixed length. Long values may be truncated as indicated in the item descriptions given later. 

•The "  and \  characters are encoded as "  and \\ , respectively. 

The following examples show the JSON object formats for different event types (as indicated by the class and event  items), reformatted slightly for readability: 

Auditing startup event: 

{ "timestamp": "2019-10-03 14:21:56", "id": 0, "class": "audit", "event": "startup", "connection_id": 0, 

