Description\n-----------\n\nThe audit plugin logs user access to MariaDB and its objects. The audit trail (that is, the audit log) is a set of records, written as a list of fields to a file in a plain‐text format. The fields in the log are separated by commas. The format used for the plugin's own log file is slightly different from the format used if it logs to the system log because it has its own standard format.&#x20;\n\nFormal Specification\n\nWhen the MariaDB Audit Plugin (v1) writes to a dedicated file, it uses a comma-separated (CSV) format. For tool developers, it is essential to map the connectionid to the server's global connection identifier to enable cross-log analysis.\n\nTemplate: <timestamp>,<serverhost>,<username>,<host>,<connectionid>,<queryid>,<operation>,<database>,<object>,<retcode>\n\n| Field | Component      | Data Type      | Standardized Name / Description                                                                                                              |\n| ----- | -------------- | -------------- | -------------------------------------------------------------------------------------------------------------------------------------------- |\n| 1     | timestamp    | DateTime     | Formatted as %Y%m%d %H:%i:%s (the default), or as specified in server_audit_timestamp_format. |\n| 2     | serverhost   | String       | Hostname of the originating server.                                                                                                          |\n| 5     | connectionid | Unsigned Int | Standardized: Thread ID. Matches the Thread ID in Error, General, and Slow logs.                                                           |\n| 6     | queryid      | Unsigned Int | A unique identifier for the specific query, used to correlate QUERY and TABLE events.                                                    |\n| 7     | operation    | String       | Action type (e.g., CONNECT, QUERY, READ, WRITE).                                                                                     |\n| 10    | retcode      | Integer      | Result code (0 for success).                                                                                                               |\n\nAudit Log Format with Syslog\n\nIf server_audit_output_type is set to SYSLOG, the standard CSV line is prefixed with syslog metadata: <timestamp> <syslog_host> <syslog_ident>: <syslog_info> [Standard CSV Fields]\n\nVarious events result in different audit records. Some events do not return a value for some fields (for instance, when the active database is not set when connecting to the server).\n\nBelow is a generic example of the output for connect events, with placeholders representing data. These are events in which a user connected, disconnected, or tried unsuccessfully to connect to the server.\n\n``ini\n[timestamp],[serverhost],[username],[host],[connectionid],0,CONNECT,[database],,0 \n[timestamp],[serverhost],[username],[host],[connectionid],0,DISCONNECT,,,0 \n[timestamp],[serverhost],[username],[host],[connectionid],0,FAILED_CONNECT,,,[retcode]\n`\n\nHere is the one audit record generated for each query event:\n\n`ini\n[timestamp],[serverhost],[username],[host],[connectionid],[queryid],QUERY,[database],[object], [retcode]\n`\n\nBelow are generic examples of records that are entered in the audit log for each type of table event:\n\n`ini\n[timestamp],[serverhost],[username],[host],[connectionid],[queryid],CREATE,[database],[object], \n[timestamp],[serverhost],[username],[host],[connectionid],[queryid],READ,[database],[object], \n[timestamp],[serverhost],[username],[host],[connectionid],[queryid],WRITE,[database],[object], \n[timestamp],[serverhost],[username],[host],[connectionid],[queryid],ALTER,[database],[object], \n[timestamp],[serverhost],[username],[host],[connectionid],[queryid],RENAME,[database], \n[object_old]|[database_new].[object_new], \n[timestamp],[serverhost],[username],[host],[connectionid],[queryid],DROP,[database],[object],\n`\n\nPasswords are hidden in the log for certain types of queries. They are replaced with asterisks for GRANT, CREATE USER, CREATE MASTER, CREATE SERVER, and ALTER SERVER statements. Passwords, however, are not replaced for the PASSWORD() and OLD_PASSWORD() functions when they are used inside other SQL statements (i.e., SET PASSWORD).\n\nFor Galera Cluster replication applier operations, audit log plugin logs events with a generic name of <wsrep_applier>` .\n\nThis addresses an issue where the user was logged on the primary node, but stripped from other cluster nodes. See MDEV-35511 for details.\n\nFor Galera Cluster replication applier operations, audit log plugin logs events without indicating what user initiates them.\n\nURL: https://mariadb.com/docs/server/reference/plugins/mariadb-audit-plugin/mariadb-audit-plugin-log-format