content_image/679020.jpg content_image/679019.jpg
from disabled to enabled. Log file renaming must be done externally to the server. Suppose that the log file name is audit.log  and you want to maintain the three most recent log files, cycling through the names audit.log.1  through audit.log.3 . On Unix, perform rotation manually like this: 

1. From the command line, rename the current log files: 

mv audit.log.2 audit.log.3 mv audit.log.1 audit.log.2 mv audit.log audit.log.1 

This strategy overwrites the current audit.log.3  contents, placing a bound on the number of archived log files and the space they use. 

2. At this point, the plugin is still writing to the current log file, which has been renamed to audit.log.1 . Connect to the server and flush the log file so the plugin closes it and reopens a new audit.log  file: 

SET GLOBAL audit_log_flush = ON; 

audit_log_flush  is special in that its value remains OFF  so that you need not disable it explicitly before enabling it again to perform another flush. 

## Automatic Audit Log File Rotation 

<img src='content_image/679020.jpg'>

<img src='content_image/679019.jpg'>

## Note 

If compression or encryption are enabled, log file names include suffixes that signify the enabled features, as well as a password ID if encryption is enabled. If file names include a password ID, be sure to retain the ID in the name of any files you rename manually so that the password to use for decryption operations can be determined. 

## Note 

For JSON-format logging, renaming audit log files manually makes them unavailable to the log-reading functions because the audit log plugin can no longer determine that they are part of the log file sequence (see Section 6.4.5.6, “Reading Audit Log Files” ). Consider setting audit_log_rotate_on_size  greater than 0 to use size-based rotation instead. 

If audit_log_rotate_on_size  is greater than 0, setting audit_log_flush  has no effect. Instead, whenever a write to the current log file causes its size to exceed the audit_log_rotate_on_size value, the audit log plugin automatically renames the current log file and opens a new current log file using the original name. 

Automatic size-based rotation also occurs under these conditions: 

•During plugin initialization, if a file with the audit log file name already exists (see Naming Conventions for Audit Log Files). 

•During plugin termination. 

•When the audit_log_encryption_password_set()  function is called to set the encryption password, if encryption is enabled. (Rotation does not occur if encryption is disabled.) 

The plugin renames the original file by inserting a timestamp just after its base name. For example, if the file name is audit.log , the plugin renames it to a value such as audit.20210115T140633.log . The timestamp is a UTC value in YYYYMMDD T hhmmss  format. For XML logging, the timestamp indicates rotation time. For JSON logging, the timestamp is that of the last event written to the file. 

