## New-Style XML Audit Log File Format 

•Old-Style XML Audit Log File Format 

•JSON Audit Log File Format 

Here is a sample log file in new-style XML format ( audit_log_format=NEW ), reformatted slightly for readability: 

<?xml version="1.0" encoding="utf-8"?> <AUDIT>  <AUDIT_RECORD> <TIMESTAMP>2019-10-03T14:06:33 UTC</TIMESTAMP> <RECORD_ID>1_2019-10-03T14:06:33</RECORD_ID> <NAME>Audit</NAME> <SERVER_ID>1</SERVER_ID> <VERSION>1</VERSION> <STARTUP_OPTIONS>/usr/local/mysql/bin/mysqld --socket=/usr/local/mysql/mysql.sock --port=3306</STARTUP_OPTIONS> <OS_VERSION>i686-Linux</OS_VERSION> <MYSQL_VERSION>5.7.21-log</MYSQL_VERSION>  </AUDIT_RECORD>  <AUDIT_RECORD> <TIMESTAMP>2019-10-03T14:09:38 UTC</TIMESTAMP> <RECORD_ID>2_2019-10-03T14:06:33</RECORD_ID> <NAME>Connect</NAME> <CONNECTION_ID>5</CONNECTION_ID> <STATUS>0</STATUS> <STATUS_CODE>0</STATUS_CODE> <USER>root</USER> <OS_LOGIN/> <HOST>localhost</HOST> <IP>127.0.0.1</IP> <COMMAND_CLASS>connect</COMMAND_CLASS> <CONNECTION_TYPE>SSL/TLS</CONNECTION_TYPE> <CONNECTION_ATTRIBUTES> <ATTRIBUTE> <NAME>_pid</NAME> <VALUE>42794</VALUE> </ATTRIBUTE> ... <ATTRIBUTE> <NAME>program_name</NAME> <VALUE>mysqladmin</VALUE> </ATTRIBUTE> </CONNECTION_ATTRIBUTES> <PRIV_USER>root</PRIV_USER> <PROXY_USER/> <DB>test</DB>  </AUDIT_RECORD> ...  <AUDIT_RECORD> <TIMESTAMP>2019-10-03T14:09:38 UTC</TIMESTAMP> <RECORD_ID>6_2019-10-03T14:06:33</RECORD_ID> <NAME>Query</NAME> <CONNECTION_ID>5</CONNECTION_ID> <STATUS>0</STATUS> <STATUS_CODE>0</STATUS_CODE> <USER>root[root] @ localhost [127.0.0.1]</USER> <OS_LOGIN/> <HOST>localhost</HOST> <IP>127.0.0.1</IP> <COMMAND_CLASS>drop_table</COMMAND_CLASS> 

