Audit Log Read not working despite audit.json being written properly

MySQL & MariaDB
,
1

mysql> SELECT audit_log_read(‘{“start”: {“timestamp”: “2025-11-21 00:00:00”}}’);
±------------------------------------------------------------------+
| audit_log_read(‘{“start”: {“timestamp”: “2025-11-21 00:00:00”}}’) |
±------------------------------------------------------------------+
| [
null
]
|
±------------------------------------------------------------------+

mysql> SHOW VARIABLES LIKE ‘audit_log_filter_format’;
±------------------------±------+
| Variable_name | Value |
±------------------------±------+
| audit_log_filter_format | JSON |
±------------------------±------+
1 row in set (0.01 sec)

mysql> SHOW VARIABLES LIKE ‘audit_log_filter_file’;
±----------------------±-----------+
| Variable_name | Value |
±----------------------±-----------+
| audit_log_filter_file | audit.json |
±----------------------±-----------+
1 row in set (0.01 sec)

Even though the file is full of events , using timestamp and id from the file does not work .
Percona MySQL 8.0.43-34

2

@richard1307 The similar problem discussed over this Jira. Please refer to it for more information on the workaround.

Can you please also confirm the below command output ?

ls -ltrh /var/lib/mysql/audit*

Regards,
Anil

3

Hi @anil.joshi , Thanks for replying and sharing the Jira Ticket.

Output of ls -lrth →

-rw-r----- 1 richard richard 13K Nov 21 17:34 audit.20251121T174305.json
-rw-r----- 1 richard richard 263K Nov 21 17:58 audit.20251121T175810.json
-rw-r----- 1 richard richard 17K Nov 21 18:09 audit.20251121T180958.json
-rw-r----- 1 richard richard 272K Nov 22 12:28 audit.20251122T122918.json
-rw-r----- 1 richard richard 11K Nov 22 12:33 audit.20251122T142623.json
-rw-r----- 1 richard richard 298K Nov 22 16:25 audit.20251122T162547.json
-rw-r----- 1 richard richard 37K Nov 24 14:50 audit.json

I went through the Jira ticket and tried the workaround , I chose timestamp from audit.20251121T174305.json which is a valid json array . However , I still get null even after providing the exact timestamp and id.

mysql> select audit_log_read(‘{“timestamp”:“2025-11-21 17:30:37”,“id”:34}’);
±--------------------------------------------------------------+
| audit_log_read(‘{“timestamp”:“2025-11-21 17:30:37”,“id”:34}’) |
±--------------------------------------------------------------+
| [
null
]
|
±--------------------------------------------------------------+

Thanks & Regards