AUDIT_LOG_FILTER_SET_FILTER

Purpose

This function (expression) is used to create a filter.

Syntax

AUDIT_LOG_FILTER_SET_FILTER('filter_name', 'definition_of_filters');

Considerations

Parameters

• filter_name: specifies the name of the filter.

  Note

  AUDIT_LOG_FILTER_SET_FILTER has the CREATE OR REPLACE semantics. If an object already exists, executing a DDL operation on it will overwrite the existing object.

• definition_of_filters: specifies the configuration of the audit filter. The configuration is described in JSON format. The current version of the filter is compatible with MySQL, but only supports filtering audit events by type. Here are several ways to configure the filter:

  • Record all events.

    {
    "filter": {
        "log": true
    }
    }
    

  • Do not record any events.

    {
    "filter": {
        "log": false
    }
    }
    

  • Record only login and logout events.

    {
    "filter": {
        "log": true,
        "class": [
        { "name": "connection" }
        ]
    }
    }
    

  • Another way to record all events.

    {
    "filter": {
        "log": true,
        "class": [
        { "name": "connection" },
        { "name": "general" },
        { "name": "table_access" }
        ]
    }
    }
    

Audit events are classified as follows:

Return value

The input to the expression must be a string constant, and the output is of string type.

• If the DDL operation is successful, the expression returns OK.
• If the DDL operation fails, the SELECT statement still executes successfully, and the output of the expression is the error message.

Examples

• Create a filter log_all that records all events.

  SELECT AUDIT_LOG_FILTER_SET_FILTER('log_all', '{ "filter": { "log": true } }');
  

  The return result is as follows:

  +-------------------------------------------------------------------------+
  | AUDIT_LOG_FILTER_SET_FILTER('log_all', '{ "filter": { "log": true } }') |
  +-------------------------------------------------------------------------+
  | OK                                                                      |
  +-------------------------------------------------------------------------+
  1 row in set
  

• When the DDL operation fails, the SELECT statement still executes successfully, and the output of the expression is the error message.

  SELECT AUDIT_LOG_FILTER_SET_FILTER('log_err', '1');
  

  The return result is as follows:

  +---------------------------------------------+
  | AUDIT_LOG_FILTER_SET_FILTER('log_err', '1') |
  +---------------------------------------------+
  | ERROR: JSON parsing error.                  |
  +---------------------------------------------+
  1 row in set