# Audit plugin include/exclude accounts doesn't seem to work **URL:** \ **Category:** Percona Monitoring Plugins\ **Created:** [November 26, 2018, 8:04am UTC](https://forums.percona.com/t/audit-plugin-include-exclude-accounts-doesnt-seem-to-work/6704 "2018-11-26T08:04:49Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![oniv](https://avatars.discourse-cdn.com/v4/letter/o/3be4f8/32.png) [@oniv](https://forums.percona.com/u/oniv)\ **Post date:** [November 26, 2018, 8:04am UTC](https://forums.percona.com/t/audit-plugin-include-exclude-accounts-doesnt-seem-to-work/6704/1 "2018-11-26T08:04:49Z")
Hi, I’m testing the audit plugin on percona-server 5.7.22 and i want to exclude a user from the logs, however audit\_log\_exclude\_accounts/audit\_log\_include\_accounts parameters doesn’t seem to change the logging. log example: {“audit\_record”:{“name”:“Query”,“record”:“703416\_2018-11-26T13:16:09”,“timestamp”:“2018-11-26T13:18:28 UTC”,“command\_class”:“create\_procedure”,“connection\_id”:“96794”,“status”:0,“sqltext”:“insert into schema.table (id, master\_ts, update\_by) values (1, NOW(), ‘event\_scheduler’) on duplicate key update master\_ts=NOW(), update\_by=VALUES(update\_by)”,“user”:“user\_test[user\_test] @ localhost [localhost]”,“host”:“localhost”,“os\_user”:“”,“ip”:“localhost”,“db”:“”}} i tried several variations on “user\_test[user\_test] @ localhost [localhost]” then i tried to do audit\_log\_include\_accounts = “my\_admin@localhost” to log only queries from my\_admin user, also without effect configuration: audit\_log\_format = JSON audit\_log\_file = /var/mysql/prod/audit.log audit\_log\_exclude\_databases = test\_db audit\_log\_exclude\_accounts = user\_test@localhost audit\_log\_policy = QUERIES Anyone managed to filter by user? Thanks ---
**Author:** ![grosenthal](https://avatars.discourse-cdn.com/v4/letter/g/e47c2d/32.png) [@grosenthal](https://forums.percona.com/u/grosenthal)\ **Post date:** [February 13, 2019, 2:55pm UTC](https://forums.percona.com/t/audit-plugin-include-exclude-accounts-doesnt-seem-to-work/6704/2 "2019-02-13T14:55:03Z")
Hello, I’m seeing this same issue with version 5.7.24-27. Any feedback on this yet? ---
**Author:** ![svetasmirnova](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/svetasmirnova/32/21_2.png) [@svetasmirnova](https://forums.percona.com/u/svetasmirnova)\ **Post date:** [February 21, 2019, 9:14am UTC](https://forums.percona.com/t/audit-plugin-include-exclude-accounts-doesnt-seem-to-work/6704/3 "2019-02-21T09:14:07Z")
Could you please send output of SHOW VARIABLES LIKE ‘%audit%’? I want to check if settings from the configuration file applied to the variables. ---
**Author:** ![grosenthal](https://avatars.discourse-cdn.com/v4/letter/g/e47c2d/32.png) [@grosenthal](https://forums.percona.com/u/grosenthal)\ **Post date:** [February 22, 2019, 9:29am UTC](https://forums.percona.com/t/audit-plugin-include-exclude-accounts-doesnt-seem-to-work/6704/4 "2019-02-22T09:29:40Z")
mysql\> show variables like ‘%audit%’; ±----------------------------±---------------------------------------------+ | Variable\_name | Value | ±----------------------------±---------------------------------------------+ | audit\_log\_buffer\_size | 1048576 | | audit\_log\_exclude\_accounts | someuser@ | | audit\_log\_exclude\_commands | | | audit\_log\_exclude\_databases | | | audit\_log\_file | /opt/sw/dbinstall/mysql/mysql-logs/audit.log | | audit\_log\_flush | OFF | | audit\_log\_format | OLD | | audit\_log\_handler | FILE | | audit\_log\_include\_accounts | | | audit\_log\_include\_commands | | | audit\_log\_include\_databases | | | audit\_log\_policy | ALL | | audit\_log\_rotate\_on\_size | 0 | | audit\_log\_rotations | 0 | | audit\_log\_strategy | ASYNCHRONOUS | | audit\_log\_syslog\_facility | LOG\_USER | | audit\_log\_syslog\_ident | percona-audit | | audit\_log\_syslog\_priority | LOG\_INFO | ±----------------------------±---------------------------------------------+ 18 rows in set (0.03 sec) ---
**Author:** ![hspinks](https://avatars.discourse-cdn.com/v4/letter/h/a87d85/32.png) [@hspinks](https://forums.percona.com/u/hspinks)\ **Post date:** [November 23, 2020, 12:31pm UTC](https://forums.percona.com/t/audit-plugin-include-exclude-accounts-doesnt-seem-to-work/6704/5 "2020-11-23T12:31:24Z")
I am having the same problem, Does this feature wok or is this a known bug? ---
**Author:** ![mosad](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/mosad/32/2871_2.png) [@mosad](https://forums.percona.com/u/mosad)\ **Post date:** [December 3, 2020, 11:37am UTC](https://forums.percona.com/t/audit-plugin-include-exclude-accounts-doesnt-seem-to-work/6704/6 "2020-12-03T11:37:41Z")
Hello, I have the same problem. Have someone any solution or it is permanently bug? ---
**Author:** ![hspinks](https://avatars.discourse-cdn.com/v4/letter/h/a87d85/32.png) [@hspinks](https://forums.percona.com/u/hspinks)\ **Post date:** [December 3, 2020, 2:55pm UTC](https://forums.percona.com/t/audit-plugin-include-exclude-accounts-doesnt-seem-to-work/6704/7 "2020-12-03T14:55:55Z")
For me, making the change to the configuration file and restarting MySQL worked. ---
**Author:** ![svetasmirnova](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/svetasmirnova/32/21_2.png) [@svetasmirnova](https://forums.percona.com/u/svetasmirnova)\ **Post date:** [December 5, 2020, 9:10am UTC](https://forums.percona.com/t/audit-plugin-include-exclude-accounts-doesnt-seem-to-work/6704/8 "2020-12-05T09:10:28Z")
@[grosenthal](https://forums.percona.com/profile/grosenthal) I am sorry: missed your reply. But in your case configuration changes were not applied to the plugin variables. Please check if you restarted the server after changing configuration file and if yes: if the configuration file located in the location which mysqld reads at the startup. Others who experience the same problem, please, make same checks: what the query “show variables like ‘%audit%’;” outputs and if it is the same as you expect. ---
**Author:** ![hspinks](https://avatars.discourse-cdn.com/v4/letter/h/a87d85/32.png) [@hspinks](https://forums.percona.com/u/hspinks)\ **Post date:** [December 10, 2020, 9:32am UTC](https://forums.percona.com/t/audit-plugin-include-exclude-accounts-doesnt-seem-to-work/6704/9 "2020-12-10T09:32:27Z")
I am still having a problem EXCLUDING users. I have been able to INCLUDE users to be logged with the following syntax; audit\_log\_include\_accounts=user1@localhost,user2@localhost… What I really need to do is to EXCLUDE users, but the usernames in the log files comes in the following format; user1[databasename] @ [hostname.domanainname.com](http://hostname.domanainname.com) [ip address] This is the format of what I want to exclude, but there are many users with many usernames, database names and hostnames. How to I use wild cards in the exclude entry in the config file to exclude common usernames from ANY systems that contains spaces and special characters? ---
**Author:** ![svetasmirnova](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/svetasmirnova/32/21_2.png) [@svetasmirnova](https://forums.percona.com/u/svetasmirnova)\ **Post date:** [December 10, 2020, 12:45pm UTC](https://forums.percona.com/t/audit-plugin-include-exclude-accounts-doesnt-seem-to-work/6704/10 "2020-12-10T12:45:03Z")
@hspinks first, you cannot use both audit\_log\_include\_accounts and audit\_log\_exclude\_accounts: they are mutually exclusive. Second, you can use wildcards in usernames, but only if they match records in the mysql.user table. See also [https://www.percona.com/doc/percona-server/8.0/management/audit\_log\_plugin.html#filtering-by-user](https://www.percona.com/doc/percona-server/8.0/management/audit_log_plugin.html#filtering-by-user) If you need more smart filtering: file a feature request at [https://jira.percona.com](https://jira.percona.com)