For details about each format, see Section 6.4.5.4, “Audit Log File Formats” . 

If you change audit_log_format , it is recommended that you also change audit_log_file . For example, if you set audit_log_format  to JSON , set audit_log_file  to audit.json . Otherwise, newer log files will have a different format than older files, but they will all have the same base name with nothing to indicate when the format changed. 

## Compressing Audit Log Files 

Audit log file compression can be enabled for any logging format. 

To configure audit log file compression, set the audit_log_compression  system variable at server startup. Permitted values are NONE  (no compression; the default) and GZIP  (GNU Zip compression). 

If both compression and encryption are enabled, compression occurs before encryption. To recover the original file manually, first decrypt it, then uncompress it. See Manually Uncompressing and Decrypting Audit Log Files. 

## Encrypting Audit Log Files 

Audit log file encryption can be enabled for any logging format. Encryption is based on user-defined passwords (with the exception of the initial password that the audit log plugin generates). To use this feature, the MySQL keyring must be enabled because audit logging uses it for password storage. Any keyring component or plugin can be used; for instructions, see Section 6.4.4, “The MySQL Keyring” . 

To configure audit log file encryption, set the audit_log_encryption  system variable at server startup. Permitted values are NONE  (no encryption; the default) and AES  (AES-256-CBC cipher encryption). 

To set or get an encryption password at runtime, use these audit log functions: 

•To set the current encryption password, invoke audit_log_encryption_password_set() . This function stores the new password in the keyring. If encryption is enabled, it also performs a log file rotation operation that renames the current log file, and begins a new log file encrypted with the password. File renaming occurs according to the usual rules for automatic size-based log file rotation; see Manual Audit Log File Rotation. 

If the audit_log_password_history_keep_days  system variable is nonzero, invoking audit_log_encryption_password_set()  also causes expiration of old archived audit log encryption passwords. For information about audit log password history, including password archiving and expiration, see the description of that variable. 

•To get the current encryption password, invoke audit_log_encryption_password_get()  with no argument. To get a password by ID, pass an argument that specifies the keyring ID of the current password or an archived password. 

To determine which audit log keyring IDs exist, query the Performance Schema keyring_keys  table: 

mysql> SELECT KEY_ID FROM performance_schema.keyring_keys WHERE KEY_ID LIKE ’audit_log%’ ORDER BY KEY_ID; +-----------------------------+ | KEY_ID | +-----------------------------+ | audit_log-20190415T152248-1 | | audit_log-20190415T153507-1 | | audit_log-20190416T125122-1 | | audit_log-20190416T141608-1 | +-----------------------------+ 

