SET GLOBAL audit_log_logging_events = 'connect,query,table_access'; :
status: 1 = failure. "rule": "class": "table_access", "table": "payments", "command": ["DROP", "TRUNCATE", "DELETE", "UPDATE"], "log": true
SELECT VARIABLE_VALUE FROM performance_schema.global_status WHERE VARIABLE_NAME = 'audit_log_lost_events'; If > 0, increase audit_log_buffer_size (default 1MB → set to 4–8MB). percona audit plugin
"class": "table_access", "command": ["DROP", "ALTER", "TRUNCATE"], "log": true
"class": "connection", "event": "connect", "status": 1, "log": true , SET GLOBAL audit_log_logging_events = 'connect
[mysqld] audit_log_rotate_on_size = 104857600 audit_log_rotations = 9 Old files: audit.log.1 , audit.log.2 , ...
(if using syslog or custom paths):
SHOW STATUS LIKE 'audit_log%'; -- e.g., audit_log_current_size, audit_log_buffer_size, audit_log_lost_events (critical):