AUDIT_LOG_FILTER_SET_FILTER

Purpose

This function (expression) is used to create a filter.

Syntax

AUDIT_LOG_FILTER_SET_FILTER('filter_name', 'definition_of_filters');

Considerations

Parameters

• filter_name: specifies the name of the filter.

  Note

  AUDIT_LOG_FILTER_SET_FILTER has the CREATE OR REPLACE semantics. If an object already exists, the DDL operation will overwrite it.

• definition_of_filters: specifies the configuration of the audit filter in JSON format. The current version of the filter is compatible with MySQL, but only supports filtering audit events by type. Here are several ways to write the filter configurations:

  • Record all events.

    {
    "filter": {
        "log": true
    }
    }
    

  • Do not record any events.

    {
    "filter": {
        "log": false
    }
    }
    

  • Record only login and logout events.

    {
    "filter": {
        "log": true,
        "class": [
        { "name": "connection" }
        ]
    }
    }
    

  • Another way to record all events.

    {
    "filter": {
        "log": true,
        "class": [
        { "name": "connection" },
        { "name": "general" },
        { "name": "table_access" }
        ]
    }
    }
    

The audit events are classified as follows:

Return value

The input must be a string constant, and the output is a string.

• If the DDL operation is successful, the expression returns OK.
• If the DDL operation fails, the SELECT statement still executes successfully, and the output of the expression is an error message.

Examples

• Create a filter named log_all that records all events.

  SELECT AUDIT_LOG_FILTER_SET_FILTER('log_all', '{ "filter": { "log": true } }');
  

  The return result is as follows:

  +-------------------------------------------------------------------------+
  | AUDIT_LOG_FILTER_SET_FILTER('log_all', '{ "filter": { "log": true } }') |
  +-------------------------------------------------------------------------+
  | OK                                                                      |
  +-------------------------------------------------------------------------+
  1 row in set
  

• If the DDL operation fails, the SELECT statement still executes successfully, and the output of the expression is an error message.

  SELECT AUDIT_LOG_FILTER_SET_FILTER('log_err', '1');
  

  The return result is as follows:

  +---------------------------------------------+
  | AUDIT_LOG_FILTER_SET_FILTER('log_err', '1') |
  +---------------------------------------------+
  | ERROR: JSON parsing error.                  |
  +---------------------------------------------+
  1 row in set