AUDIT_LOG_FILTER_SET_FILTER

Purpose

This function (expression) is used to create a filter.

Syntax

AUDIT_LOG_FILTER_SET_FILTER('filter_name', 'definition_of_filters');

Considerations

Parameters

• filter_name: specifies the name of the filter.

  Note

  AUDIT_LOG_FILTER_SET_FILTER is a CREATE OR REPLACE statement. If an object exists, the DDL statement will overwrite it.

• definition_of_filters: specifies the configuration of the audit filter in JSON format. The current version of the filter is compatible with MySQL, but only supports filtering audit events. The following are several ways to write filter configurations:

  • Record all events.

    {
    "filter": {
        "log": true
    }
    }
    

  • Do not record all events.

    {
    "filter": {
        "log": false
    }
    }
    

  • Record only login and logout events.

    {
    "filter": {
        "log": true,
        "class": [
        { "name": "connection" }
        ]
    }
    }
    

  • Another way to record all events.

    {
    "filter": {
        "log": true,
        "class": [
        { "name": "connection" },
        { "name": "general" },
        { "name": "table_access" }
        ]
    }
    }
    

Audit events are classified as follows:

Return value

The input must be a string constant, and the output is a string.

• If the DDL statement is executed successfully, the expression returns OK.
• If the DDL statement fails, the SELECT statement still executes successfully, and the output of the expression is the error message.

Examples

• Create a filter log_all to record all events.

  SELECT AUDIT_LOG_FILTER_SET_FILTER('log_all', '{ "filter": { "log": true } }');
  

  The return result is as follows:

  +-------------------------------------------------------------------------+
  | AUDIT_LOG_FILTER_SET_FILTER('log_all', '{ "filter": { "log": true } }') |
  +-------------------------------------------------------------------------+
  | OK                                                                      |
  +-------------------------------------------------------------------------+
  1 row in set
  

• If the DDL statement fails, the SELECT statement still executes successfully, and the output of the expression is the error message.

  SELECT AUDIT_LOG_FILTER_SET_FILTER('log_err', '1');
  

  The return result is as follows:

  +---------------------------------------------+
  | AUDIT_LOG_FILTER_SET_FILTER('log_err', '1') |
  +---------------------------------------------+
  | ERROR: JSON parsing error.                  |
  +---------------------------------------------+
  1 row in set