## Event Filtering by Account 

•Event Filtering by Account 

•Event Filtering by Status 

To filter audited events based on the originating account, set one of these system variables at server startup or runtime: 

• audit_log_include_accounts : The accounts to include in audit logging. If this variable is set, only these accounts are audited. 

• audit_log_exclude_accounts : The accounts to exclude from audit logging. If this variable is set, all but these accounts are audited. 

The value for either variable can be NULL  or a string containing one or more comma-separated account names, each in user_name @ host_name  format. By default, both variables are NULL , in which case, no account filtering is done and auditing occurs for all accounts. 

Modifications to audit_log_include_accounts  or audit_log_exclude_accounts  affect only connections created subsequent to the modification, not existing connections. 

Example: To enable audit logging only for the user1  and user2  local host account accounts, set the audit_log_include_accounts  system variable like this: 

SET GLOBAL audit_log_include_accounts = ’user1@localhost,user2@localhost’; 

Only one of audit_log_include_accounts  or audit_log_exclude_accounts  can be non- NULL  at a time: 

•If you set audit_log_include_accounts , the server sets audit_log_exclude_accounts  to NULL . 

•If you attempt to set audit_log_exclude_accounts , an error occurs unless audit_log_include_accounts  is NULL . In this case, you must first clear audit_log_include_accounts  by setting it to NULL . 

-- This sets audit_log_exclude_accounts to NULL SET GLOBAL audit_log_include_accounts = value ; -- This fails because audit_log_include_accounts is not NULL SET GLOBAL audit_log_exclude_accounts = value ; -- To set audit_log_exclude_accounts, first set -- audit_log_include_accounts to NULL SET GLOBAL audit_log_include_accounts = NULL; SET GLOBAL audit_log_exclude_accounts = value ; 

If you inspect the value of either variable, be aware that SHOW VARIABLES  displays NULL  as an empty string. To avoid this, use SELECT  instead: 

mysql> SHOW VARIABLES LIKE ’audit_log_include_accounts’; +----------------------------+-------+ | Variable_name | Value | +----------------------------+-------+ | audit_log_include_accounts | | +----------------------------+-------+ mysql> SELECT @@audit_log_include_accounts; +------------------------------+ | @@audit_log_include_accounts | 

