content_image/710116.jpg
Table access event (read, delete, insert, update): 

{ "timestamp": "2019-10-03 14:23:41", "id": 0, "class": "table_access", "event": "insert", "connection_id": 5, "account": { "user": "root", "host": "localhost" }, "login": { "user": "root", "os": "", "ip": "127.0.0.1", "proxy": "" }, "table_access_data": { "db": "test", "table": "t1", "query": "INSERT INTO t1 (i) VALUES(1),(2),(3)", "sql_command": "insert" } } 

"status": 0 } } 

The items in the following list appear at the top level of JSON-format audit records: Each item value is either a scalar or a JSON  hash. For items that have a hash value, the description lists only the item names within that hash. For more complete descriptions of second-level hash items, see later in this section. 

• account 

The MySQL account associated with the event. The value is a hash containing these items equivalent to the value of the CURRENT_USER()  function within the section: user , host . 

Example: 

"account": { "user": "root", "host": "localhost" } 

• class 

A string representing the event class. The class defines the type of event, when taken together with the event  item that specifies the event subclass. 

Example: 

"class": "connection" 

The following table shows the permitted combinations of class  and event  values. 

<img src='content_image/710116.jpg'>

• connection_data 

Information about a client connection. The value is a hash containing these items: connection_type , status , db , and possibly connection_attributes . This item occurs only for audit records with a class  value of connection . 

Example: 

"connection_data": { "connection_type": "ssl", "status": 0, "db": "test" } 

