# Audit filter with query and user info in one record possible?

**URL:** <https://forums.percona.com/t/audit-filter-with-query-and-user-info-in-one-record-possible/40336>\
**Category:** Percona Distribution for MySQL\
**Created:** [March 5, 2026, 5:24pm UTC](https://forums.percona.com/t/audit-filter-with-query-and-user-info-in-one-record-possible/40336 "2026-03-05T17:24:55Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![ipcmlr](https://avatars.discourse-cdn.com/v4/letter/i/df705f/32.png) [@ipcmlr](https://forums.percona.com/u/ipcmlr)\
**Post date:** [March 5, 2026, 5:24pm UTC](https://forums.percona.com/t/audit-filter-with-query-and-user-info-in-one-record-possible/40336/1 "2026-03-05T17:24:55Z")

</div>

I have an audit filter which checks which users have created/dropped/altered users in the database.

I need user and host in the info however I cannot seem to find a way to include it in one record.

What I get in the audit filter log is something like :

“timestamp”: “2026-03-05 10:52:11”,  
“id”: 349074,  
“class”: “query”,  
“event”: “query\_start”,  
“connection\_id”: 174655,  
“query\_data”: {  
“query”: “ALTER USER ‘test\_user’@‘%’ IDENTIFIED BY ”,  
“status”: 0,  
“sql\_command”: “alter\_user”}

My current filter is:

SELECT audit\_log\_filter\_set\_filter(‘capture\_required\_events’, '{

“filter”: {

```
"class": \[

  {

    "name": "connection",

    "event": \[

      { "name": "connect" },

      { "name": "disconnect" },

      { "name": "failed_login" }

    \]

  },

  {

    "name": "query",

    "event": \[

      {

        "name": "start",

        "log": {

          "or": \[

            { "field": { "name": "sql_command_id", "value": "create_user" } },

            { "field": { "name": "sql_command_id", "value": "alter_user" } },

            { "field": { "name": "sql_command_id", "value": "drop_user" } }

          \]

        }

      }

    \]

  }

\]

```

}

}');

---

<div class="post-metadata">

**Author:** ![jrivera](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/jrivera/32/13_2.png) [@jrivera](https://forums.percona.com/u/jrivera)\
**Post date:** [March 6, 2026, 1:00am UTC](https://forums.percona.com/t/audit-filter-with-query-and-user-info-in-one-record-possible/40336/2 "2026-03-06T01:00:18Z")

</div>

Please try this filter:

```json
{
  "filter": {
    "class": {
      "name": "general",
      "event": {
        "name": "status",
        "log": {
          "or": [{
            "field": { 
              "name": "general_sql_command.str",
              "value": "create_user" 
            }
          },
          {
            "field": {
              "name": "general_sql_command.str",
              "value": "alter_user"
            }
          },
          {
            "field": {
              "name": "general_sql_command.str",
              "value": "drop_user"
            }
          }]
        }
      }
    }
  }
}

```

Here’s a sample from the audit log in XML format:

```auto
  <AUDIT_RECORD>
    <NAME>Status</NAME>
    <RECORD_ID>2_2026-03-06T00:43:31</RECORD_ID>
    <TIMESTAMP>2026-03-06T00:43:31</TIMESTAMP>
    <COMMAND_CLASS>General</COMMAND_CLASS>
    <CONNECTION_ID>52</CONNECTION_ID>
    <HOST>localhost</HOST>
    <IP></IP>
    <USER>root[root] @ localhost []</USER>
    <STATUS>0</STATUS>
    <SQLTEXT>ALTER USER 'test'@'localhost' IDENTIFIED BY &lt;secret&gt;</SQLTEXT>
  </AUDIT_RECORD>

```

---

<div class="post-metadata">

**Author:** ![ipcmlr](https://avatars.discourse-cdn.com/v4/letter/i/df705f/32.png) [@ipcmlr](https://forums.percona.com/u/ipcmlr)\
**Post date:** [March 9, 2026, 3:06pm UTC](https://forums.percona.com/t/audit-filter-with-query-and-user-info-in-one-record-possible/40336/3 "2026-03-09T15:06:52Z")

</div>

Thanks.

Not sure why this is not working for me.

It is not logging anything in the audit\_filter\_log

mysql\> SELECT \* FROM mysql.audit\_log\_filter;  
±----------±------------------------±--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+  
| filter\_id | name | filter |  
±----------±------------------------±--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+  
| 1 | capture\_required\_events | {“filter”: {“class”: {“name”: “general”, “event”: {“log”: {“or”: [{“field”: {“name”: “general\_sql\_command.str”, “value”: “create\_user”}}, {“field”: {“name”: “general\_sql\_command.str”, “value”: “alter\_user”}}, {“field”: {“name”: “general\_sql\_command.str”, “value”: “drop\_user”}}]}, “name”: “status”}}}} |  
±----------±------------------------±--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+  
1 row in set (0.00 sec)

mysql\> SELECT \* FROM mysql.audit\_log\_user;  
±---------±---------±------------------------+  
| username | userhost | filtername |  
±---------±---------±------------------------+  
| % | % | capture\_required\_events |  
±---------±---------±------------------------+  
1 row in set (0.00 sec)

SELECT audit\_log\_filter\_set\_filter(‘capture\_required\_events’, ‘{  
“filter”: {  
“class”: {  
“name”: “general”,  
“event”: {  
“name”: “status”,  
“log”: {  
“or”: [{  
“field”: {  
“name”: “general\_sql\_command.str”,  
“value”: “create\_user”  
}  
},  
{  
“field”: {  
“name”: “general\_sql\_command.str”,  
“value”: “alter\_user”  
}  
},  
{  
“field”: {  
“name”: “general\_sql\_command.str”,  
“value”: “drop\_user”  
}  
}]  
}  
}  
}  
}  
}’);

---

<div class="post-metadata">

**Author:** ![ipcmlr](https://avatars.discourse-cdn.com/v4/letter/i/df705f/32.png) [@ipcmlr](https://forums.percona.com/u/ipcmlr)\
**Post date:** [March 9, 2026, 7:43pm UTC](https://forums.percona.com/t/audit-filter-with-query-and-user-info-in-one-record-possible/40336/4 "2026-03-09T19:43:21Z")

</div>

```auto
I also tried simply using the filter you sent and nothing is getting logged. Not sure what I’m doing incorrectly.
SET @f = '{
  "filter": {
    "class": {
      "name": "general",
      "event": {
        "name": "status",
        "log": {
          "or": [{
            "field": { 
              "name": "general_sql_command.str",
              "value": "create_user" 
            }
          },
          {
            "field": {
              "name": "general_sql_command.str",
              "value": "alter_user"
            }
          },
          {
            "field": {
              "name": "general_sql_command.str",
              "value": "drop_user"
            }
          }]
        }
      }
    }
  }
}' ;

SELECT audit_log_filter_set_filter('capture_required_events', @f);
SELECT audit_log_filter_set_user('%', 'capture_required_events');

```

---

<div class="post-metadata">

**Author:** ![Abhinav\_Gupta](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/abhinav_gupta/32/6262_2.png) [@Abhinav\_Gupta](https://forums.percona.com/u/Abhinav_Gupta)\
**Post date:** [March 10, 2026, 3:59pm UTC](https://forums.percona.com/t/audit-filter-with-query-and-user-info-in-one-record-possible/40336/5 "2026-03-10T15:59:19Z")

</div>

Could you please confirm your database version? Also, are you using **Percona Server for MySQL**?

---

<div class="post-metadata">

**Author:** ![ipcmlr](https://avatars.discourse-cdn.com/v4/letter/i/df705f/32.png) [@ipcmlr](https://forums.percona.com/u/ipcmlr)\
**Post date:** [March 10, 2026, 8:42pm UTC](https://forums.percona.com/t/audit-filter-with-query-and-user-info-in-one-record-possible/40336/6 "2026-03-10T20:42:42Z")

</div>

Im using percona 8.4.5. thanks

---

<div class="post-metadata">

**Author:** ![jrivera](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/jrivera/32/13_2.png) [@jrivera](https://forums.percona.com/u/jrivera)\
**Post date:** [March 16, 2026, 4:46am UTC](https://forums.percona.com/t/audit-filter-with-query-and-user-info-in-one-record-possible/40336/7 "2026-03-16T04:46:41Z")

</div>

So, unfortunately, this is not possible in v8.4.5. What you can do in your current version is to collect the query events + general status events:

```auto
  SELECT audit_log_filter_set_filter(
    'log_user_mgmt_with_executor_845',
    '{
      "filter": {
        "class": [
          {
            "name": "query",
            "event": {
              "name": "status_end",
              "log": {
                "or": [
                  { "field": { "name": "sql_command_id", "value": "create_user" } },
                  { "field": { "name": "sql_command_id", "value": "alter_user" } },
                  { "field": { "name": "sql_command_id", "value": "drop_user" } }
                ]
              }
            }
          },
          {
            "name": "general",
            "event": {
              "name": "status",
              "log": true
            }
          }
        ]
      }
    }'
  );

```

The sample output would be:

```auto
  {
    "timestamp": "2026-03-16 12:36:18",
    "id": 8,
    "class": "general",
    "event": "status",
    "connection_id": 75,
    "account": { "user": "root[root] @ localhost []", "host": "localhost" },
    "login": { "user": "root[root] @ localhost []", "ip": "", "proxy": "" },
    "general_data": { "status": 0 }
  },
  {
    "timestamp": "2026-03-16 12:36:18",
    "id": 9,
    "class": "general",
    "event": "status",
    "connection_id": 75,
    "account": { "user": "root[root] @ localhost []", "host": "localhost" },
    "login": { "user": "root[root] @ localhost []", "ip": "", "proxy": "" },
    "general_data": { "status": 1064 }
  },
  {
    "timestamp": "2026-03-16 12:36:23",
    "id": 10,
    "class": "query",
    "event": "query_status_end",
    "connection_id": 75,
    "query_data": {
      "query": "drop user 'test01'@'localhost'",
      "status": 0,
      "sql_command": "drop_user"}
  },
  {
    "timestamp": "2026-03-16 12:36:23",
    "id": 11,
    "class": "general",
    "event": "status",
    "connection_id": 75,
    "account": { "user": "root[root] @ localhost []", "host": "localhost" },
    "login": { "user": "root[root] @ localhost []", "ip": "", "proxy": "" },
    "general_data": { "status": 0 }
  }

```

You correlate each event by their connection\_id as we see above.

---

<div class="post-metadata">

**Author:** ![ipcmlr](https://avatars.discourse-cdn.com/v4/letter/i/df705f/32.png) [@ipcmlr](https://forums.percona.com/u/ipcmlr)\
**Post date:** [March 16, 2026, 1:26pm UTC](https://forums.percona.com/t/audit-filter-with-query-and-user-info-in-one-record-possible/40336/8 "2026-03-16T13:26:24Z")

</div>

Thanks. What version can do I get the audit log to have the combined information in one audit record? Thanks.

---

<div class="post-metadata">

**Author:** ![jrivera](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/jrivera/32/13_2.png) [@jrivera](https://forums.percona.com/u/jrivera)\
**Post date:** [March 17, 2026, 12:47am UTC](https://forums.percona.com/t/audit-filter-with-query-and-user-info-in-one-record-possible/40336/9 "2026-03-17T00:47:08Z")

</div>

I suggest testing version 8.4.7 first on your test or staging environment before upgrading production servers.