content_image/748021.jpg content_image/748022.jpg
"filter": { "class": { "name": "general", "event" : { "name": "status", "filter": { "ref": "main" } } }, "activate": { "or": [ { "field": { "name": "table_name.str", "value": "temp_1" } }, { "field": { "name": "table_name.str", "value": "temp_2" } } ] } } } } } } 

A new filter is activated when the activate  element within a subfilter evaluates to true . Using activate  in a top-level filter  is not permitted. 

A new filter can be replaced with the original one by using a ref  item inside the subfilter to refer to the original filter id . 

The filter shown operates like this: 

•The main  filter waits for table_access  events, either update  or delete . 

•If the update  or delete table_access  event occurs on the temp_1  or temp_2  table, the filter is replaced with the internal one (without an id , since there is no need to refer to it explicitly). 

•If the end of the command is signalled ( general  / status  event), an entry is written to the audit log file and the filter is replaced with the main  filter. 

The filter is useful to log statements that update or delete anything from the temp_1  or temp_2  tables, such as this one: 

UPDATE temp_1, temp_3 SET temp_1.a=21, temp_3.a=23; 

The statement generates multiple table_access  events, but the audit log file contains only general  / status  entries. 

## 6.4.5.9 Legacy Mode Audit Log Filtering 

<img src='content_image/748021.jpg'>

<img src='content_image/748022.jpg'>

## Note 

Any id  values used in the definition are evaluated with respect only to that definition. They have nothing to do with the value of the audit_log_filter_id system variable. 

## Note 

This section describes legacy audit log filtering, which applies if the audit_log plugin is installed but not the accompanying audit tables and functions needed for rule-based filtering. 

The audit log plugin can filter audited events. This enables you to control whether audited events are written to the audit log file based on the account from which events originate or event status. Status filtering occurs separately for connection events and statement events. 

