Many of these values correspond to the COM_ xxx  command values listed in the my_command.h header file. For example, "Create DB"  and "Change user"  correspond to COM_CREATE_DB  and COM_CHANGE_USER , respectively. 

Events having NAME  values of Table XXX  accompany Query  events. For example, the following statement generates one Query  event, two TableRead  events, and a TableInsert  events: 

INSERT INTO t3 SELECT t1.* FROM t1 JOIN t2; 

Each Table XXX  event has DB  and TABLE  attributes to identify the table to which the event refers. 

Connect  events for old-style XML audit log format do not include connection attributes. 

• RECORD_ID 

A unique identifier for the audit record. The value is composed from a sequence number and timestamp, in the format SEQ_TIMESTAMP . When the audit log plugin opens the audit log file, it initializes the sequence number to the size of the audit log file, then increments the sequence by 1 for each record logged. The timestamp is a UTC value in YYYY-MM-DD T hh:mm:ss  format indicating the date and time when the audit log plugin opened the file. 

Example: RECORD_ID="12_2019-10-03T14:25:00" 

• TIMESTAMP 

A string representing a UTC value in YYYY-MM-DD T hh:mm:ss  UTC  format indicating the date and time when the audit event was generated. For example, the event corresponding to execution of an SQL statement received from a client has a TIMESTAMP  value occurring after the statement finishes, not when it was received. 

Example: TIMESTAMP="2019-10-03T14:25:32 UTC" 

The following attributes are optional in <AUDIT_RECORD>  elements. Many of them occur only for elements with specific values of the NAME  attribute. 

• COMMAND_CLASS 

A string that indicates the type of action performed. 

Example: COMMAND_CLASS="drop_table" 

The values correspond to the statement/sql/ xxx  command counters. For example, xxx  is drop_table  and select  for DROP TABLE  and SELECT  statements, respectively. The following statement displays the possible names: 

SELECT REPLACE(EVENT_NAME, ’statement/sql/’, ’’) AS name FROM performance_schema.events_statements_summary_global_by_event_name WHERE EVENT_NAME LIKE ’statement/sql/%’ ORDER BY name; 

• CONNECTION_ID 

An unsigned integer representing the client connection identifier. This is the same as the value returned by the CONNECTION_ID()  function within the session. 

Example: CONNECTION_ID="127" 

• CONNECTION_TYPE 

