# Audit\_log\_filter, Bug or no Bug?

**URL:** <https://forums.percona.com/t/audit-log-filter-bug-or-no-bug/40628>\
**Category:** Other MySQL® Questions\
**Created:** [April 14, 2026, 9:41am UTC](https://forums.percona.com/t/audit-log-filter-bug-or-no-bug/40628 "2026-04-14T09:41:21Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![IGGt](https://avatars.discourse-cdn.com/v4/letter/i/67e7ee/32.png) [@IGGt](https://forums.percona.com/u/IGGt)\
**Post date:** [April 14, 2026, 9:41am UTC](https://forums.percona.com/t/audit-log-filter-bug-or-no-bug/40628/1 "2026-04-14T09:41:21Z")

</div>

interesting problem with the audit\_log\_filter, that may or may not be a bug, what do people think?

I have two databases set up as a source and a replica. I am using Row Based Replication.

If I run a DDL or DCL query on the Source database, it appears in the audit log for both the source and the replica, even though I only ran the query on the Source. So to all extents and purposes, it appears that someone has run the DDL/DCL query on all replica databases.

I’m assuming that because all DDL queries are replicated as statement based replication the audit log is seeing the statement being executed, even though it wasn’t really executed.

Is this a BUG, or just a rather annoying feature?

---

<div class="post-metadata">

**Author:** ![hai.nguyen](https://avatars.discourse-cdn.com/v4/letter/h/41988e/32.png) [@hai.nguyen](https://forums.percona.com/u/hai.nguyen)\
**Post date:** [April 15, 2026, 1:18am UTC](https://forums.percona.com/t/audit-log-filter-bug-or-no-bug/40628/2 "2026-04-15T01:18:31Z")

</div>

Hi. This is currently the behavior of audit log filter. It has also been reported here - [Jira](https://perconadev.atlassian.net/browse/PS-10155).

A workaround is to exclude the “skip-grants user@skip-grants host” internal user from auditing:

```auto
SELECT audit_log_filter_set_filter('log_disable', '{"filter": {"log": false}}');

SELECT audit_log_filter_set_user('skip-grants user@skip-grants host', 'log_disable');

```