Audit log component - sql_command_id in log filtering
General
Escalation
General
Escalation
Description
Log filtering can be done like this, but it was really hard to find the field name sql_command_id anywhere. Since the logs show and the documentation does not explain it very well, we might consider to this into sql_command
Medium
Log filtering can be done like this, but it was really hard to find the field name
sql_command_idanywhere. Since the logs show and the documentation does not explain it very well, we might consider to this intosql_commandhttps://github.com/percona/percona-server/blob/f0b840627f8004af53ffddff5348a881bbcf667b/plugin/audit_log_filter/audit_record.cc#L544
Alternatively, how upstream use is:
general_sql_command.strhttps://dev.mysql.com/doc/refman/8.4/en/audit-log-filter-definitions.html
SELECT audit_log_filter_remove_filter('log_ddl_commands'); SELECT audit_log_filter_set_filter( 'log_ddl_commands', '{ "filter": { "class": [ { "name": "query", "event": { "name": ["start", "status_end"], "log": { "or": [ { "field": { "name": "sql_command_id", "value": "create_db"} }, { "field": { "name": "sql_command_id", "value": "drop_db"} } ] } } } ] } }' ); SELECT audit_log_filter_set_user('uns@localhost', 'log_ddl_commands'); SELECT audit_log_filter_flush();Log output (JSON format)
{ "timestamp": "2025-03-27 12:15:35", "id": 50, "class": "query", "event": "query_start", "connection_id": 341, "query_data": { "query": "create database testv4", "status": 0, "sql_command": "create_db"} }, { "timestamp": "2025-03-27 12:15:35", "id": 51, "class": "query", "event": "query_status_end", "connection_id": 341, "query_data": { "query": "create database testv4", "status": 0, "sql_command": "create_db"} }