content_image/835904.jpg
•Characters not valid as XML characters are encoded using numeric character references. Valid XML characters are: 

#x9 | #xA | #xD | [#x20-#xD7FF] | [#xE000-#xFFFD] | [#x10000-#x10FFFF] 

The following elements are mandatory in every <AUDIT_RECORD>  element: 

• <NAME> 

A string representing the type of instruction that generated the audit event, such as a command that the server received from a client. 

## Example: 

<NAME>Query</NAME> 

Some common <NAME>  values: 

<img src='content_image/835904.jpg'>

The possible values are Audit , Binlog Dump , Change user , Close stmt , Connect Out , Connect , Create DB , Daemon , Debug , Delayed insert , Drop DB , Execute , Fetch , Field List , Init DB , Kill , Long Data , NoAudit , Ping , Prepare , Processlist , Query , Quit , Refresh , Register Slave , Reset stmt , Set option , Shutdown , Sleep , Statistics , Table Dump , TableDelete , TableInsert , TableRead , TableUpdate , Time . 

Many of these values correspond to the COM_ xxx  command values listed in the my_command.h header file. For example, Create DB  and Change user  correspond to COM_CREATE_DB  and COM_CHANGE_USER , respectively. 

Events having <NAME>  values of Table XXX  accompany Query  events. For example, the following statement generates one Query  event, two TableRead  events, and a TableInsert  events: 

INSERT INTO t3 SELECT t1.* FROM t1 JOIN t2; 

Each Table XXX  event contains <DB>  and <TABLE>  elements to identify the table to which the event refers. 

• <RECORD_ID> 

A unique identifier for the audit record. The value is composed from a sequence number and timestamp, in the format SEQ_TIMESTAMP . When the audit log plugin opens the audit log file, it initializes the sequence number to the size of the audit log file, then increments the sequence by 1 for each record logged. The timestamp is a UTC value in YYYY-MM-DD T hh:mm:ss  format indicating the date and time when the audit log plugin opened the file. 

## Example: 

<RECORD_ID>12_2019-10-03T14:06:33</RECORD_ID> 

• <TIMESTAMP> 

