<SQLTEXT>DROP TABLE IF EXISTS t</SQLTEXT>  </AUDIT_RECORD> ...  <AUDIT_RECORD> <TIMESTAMP>2019-10-03T14:09:39 UTC</TIMESTAMP> <RECORD_ID>8_2019-10-03T14:06:33</RECORD_ID> <NAME>Quit</NAME> <CONNECTION_ID>5</CONNECTION_ID> <STATUS>0</STATUS> <STATUS_CODE>0</STATUS_CODE> <USER>root</USER> <OS_LOGIN/> <HOST>localhost</HOST> <IP>127.0.0.1</IP> <COMMAND_CLASS>connect</COMMAND_CLASS> <CONNECTION_TYPE>SSL/TLS</CONNECTION_TYPE>  </AUDIT_RECORD> ...  <AUDIT_RECORD> <TIMESTAMP>2019-10-03T14:09:43 UTC</TIMESTAMP> <RECORD_ID>11_2019-10-03T14:06:33</RECORD_ID> <NAME>Quit</NAME> <CONNECTION_ID>6</CONNECTION_ID> <STATUS>0</STATUS> <STATUS_CODE>0</STATUS_CODE> <USER>root</USER> <OS_LOGIN/> <HOST>localhost</HOST> <IP>127.0.0.1</IP> <COMMAND_CLASS>connect</COMMAND_CLASS> <CONNECTION_TYPE>SSL/TLS</CONNECTION_TYPE>  </AUDIT_RECORD>  <AUDIT_RECORD> <TIMESTAMP>2019-10-03T14:09:45 UTC</TIMESTAMP> <RECORD_ID>12_2019-10-03T14:06:33</RECORD_ID> <NAME>NoAudit</NAME> <SERVER_ID>1</SERVER_ID>  </AUDIT_RECORD> </AUDIT> 

The audit log file is written as XML, using UTF-8 (up to 4 bytes per character). The root element is <AUDIT> . The root element contains <AUDIT_RECORD>  elements, each of which provides information about an audited event. When the audit log plugin begins writing a new log file, it writes the XML declaration and opening <AUDIT>  root element tag. When the plugin closes a log file, it writes the closing </AUDIT>  root element tag. The closing tag is not present while the file is open. 

Elements within <AUDIT_RECORD>  elements have these characteristics: 

•Some elements appear in every <AUDIT_RECORD>  element. Others are optional and may appear depending on the audit record type. 

•Order of elements within an <AUDIT_RECORD>  element is not guaranteed. 

•Element values are not fixed length. Long values may be truncated as indicated in the element descriptions given later. 

•The < , > , " , and &  characters are encoded as &lt; , &gt; , &quot; , and &amp; , respectively. NUL bytes (U+00) are encoded as the ?  character. 

