# Audit Log Read not working despite audit.json being written properly **URL:** \ **Category:** MySQL & MariaDB\ **Tags:** mysql, percona\ **Created:** [November 22, 2025, 6:56am UTC](https://forums.percona.com/t/audit-log-read-not-working-despite-audit-json-being-written-properly/39769 "2025-11-22T06:56:46Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![richard1307](https://avatars.discourse-cdn.com/v4/letter/r/bb73d2/32.png) [@richard1307](https://forums.percona.com/u/richard1307)\ **Post date:** [November 22, 2025, 6:56am UTC](https://forums.percona.com/t/audit-log-read-not-working-despite-audit-json-being-written-properly/39769/1 "2025-11-22T06:56:46Z")
mysql\> SELECT audit\_log\_read(‘{“start”: {“timestamp”: “2025-11-21 00:00:00”}}’); ±------------------------------------------------------------------+ | audit\_log\_read(‘{“start”: {“timestamp”: “2025-11-21 00:00:00”}}’) | ±------------------------------------------------------------------+ | [ null ] | ±------------------------------------------------------------------+ mysql\> SHOW VARIABLES LIKE ‘audit\_log\_filter\_format’; ±------------------------±------+ | Variable\_name | Value | ±------------------------±------+ | audit\_log\_filter\_format | JSON | ±------------------------±------+ 1 row in set (0.01 sec) mysql\> SHOW VARIABLES LIKE ‘audit\_log\_filter\_file’; ±----------------------±-----------+ | Variable\_name | Value | ±----------------------±-----------+ | audit\_log\_filter\_file | audit.json | ±----------------------±-----------+ 1 row in set (0.01 sec) Even though the file is full of events , using timestamp and id from the file does not work . Percona MySQL 8.0.43-34 ---
**Author:** ![anil.joshi](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/anil.joshi/32/13100_2.png) [@anil.joshi](https://forums.percona.com/u/anil.joshi)\ **Post date:** [November 24, 2025, 5:24am UTC](https://forums.percona.com/t/audit-log-read-not-working-despite-audit-json-being-written-properly/39769/2 "2025-11-24T05:24:47Z")
@richard1307 The similar problem discussed over this [Jira](https://perconadev.atlassian.net/browse/PS-9773). Please refer to it for more information on the workaround. Can you please also confirm the below command output ? `ls -ltrh /var/lib/mysql/audit*` Regards, Anil ---
**Author:** ![richard1307](https://avatars.discourse-cdn.com/v4/letter/r/bb73d2/32.png) [@richard1307](https://forums.percona.com/u/richard1307)\ **Post date:** [November 24, 2025, 9:31am UTC](https://forums.percona.com/t/audit-log-read-not-working-despite-audit-json-being-written-properly/39769/3 "2025-11-24T09:31:13Z")
Hi @anil.joshi , Thanks for replying and sharing the Jira Ticket. Output of ls -lrth → > -rw-r----- 1 richard richard 13K Nov 21 17:34 audit.20251121T174305.json > -rw-r----- 1 richard richard 263K Nov 21 17:58 audit.20251121T175810.json > -rw-r----- 1 richard richard 17K Nov 21 18:09 audit.20251121T180958.json > -rw-r----- 1 richard richard 272K Nov 22 12:28 audit.20251122T122918.json > -rw-r----- 1 richard richard 11K Nov 22 12:33 audit.20251122T142623.json > -rw-r----- 1 richard richard 298K Nov 22 16:25 audit.20251122T162547.json > -rw-r----- 1 richard richard 37K Nov 24 14:50 audit.json I went through the Jira ticket and tried the workaround , I chose timestamp from audit.20251121T174305.json which is a valid json array . However , I still get null even after providing the exact timestamp and id. > mysql\> select audit\_log\_read(‘{“timestamp”:“2025-11-21 17:30:37”,“id”:34}’); > ±--------------------------------------------------------------+ > | audit\_log\_read(‘{“timestamp”:“2025-11-21 17:30:37”,“id”:34}’) | > ±--------------------------------------------------------------+ > | [ > null > ] > | > ±--------------------------------------------------------------+ Thanks & Regards