# Audit plugin include/exclude accounts doesn't seem to work **URL:** \ **Category:** Percona Monitoring Plugins\ **Created:** [November 23, 2020, 4:36pm UTC](https://forums.percona.com/t/audit-plugin-include-exclude-accounts-doesnt-seem-to-work/8298 "2020-11-23T16:36:25Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![hspinks](https://avatars.discourse-cdn.com/v4/letter/h/a87d85/32.png) [@hspinks](https://forums.percona.com/u/hspinks)\ **Post date:** [November 23, 2020, 4:36pm UTC](https://forums.percona.com/t/audit-plugin-include-exclude-accounts-doesnt-seem-to-work/8298/1 "2020-11-23T16:36:25Z")
I have tried to configure my audit plugin to exclude application users but to include all other users. This is the output from MySQL show variables like ‘%audit%’; Welcome to the MySQL monitor. Commands end with ; or \g. Your MySQL connection id is 2160760 Server version: 5.7.31-34 Percona Server (GPL), Release 34, Revision 2e68637 Copyright (c) 2009-2020 Percona LLC and/or its affiliates Copyright (c) 2000, 2020, Oracle and/or its affiliates. All rights reserved. Oracle is a registered trademark of Oracle Corporation and/or its affiliates. Other names may be trademarks of their respective owners. Type ‘help;’ or ‘\h’ for help. Type ‘\c’ to clear the current input statement. mysql\> show variables like ‘%audit%’ ; ±----------------------------±---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | Variable\_name | Value | ±----------------------------±---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | audit\_log\_buffer\_size | 1048576 | | audit\_log\_exclude\_accounts | | | audit\_log\_exclude\_commands | | | audit\_log\_exclude\_databases | | | audit\_log\_file | audit.log | | audit\_log\_flush | OFF | | audit\_log\_format | JSON | | audit\_log\_handler | FILE | | audit\_log\_include\_accounts | users1@localhost,user2@localhost | | audit\_log\_include\_commands | delete,delete\_multi,execute\_sql,insert,load,truncate,update,update\_multi,select,replace\_select,insert\_select | | audit\_log\_include\_databases | talksoft\_qa | | audit\_log\_policy | QUERIES | | audit\_log\_rotate\_on\_size | 1073741824 | | audit\_log\_rotations | 5 | | audit\_log\_strategy | PERFORMANCE | | audit\_log\_syslog\_facility | LOG\_USER | | audit\_log\_syslog\_ident | percona-audit | | audit\_log\_syslog\_priority | LOG\_INFO | ±----------------------------±---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ 18 rows in set (0.00 sec) I am still getting log entries from users NOT on this list. Is this a known bug or is there a fix for this? ---
**Author:** ![Ivan\_Groenewold](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/ivan_groenewold/32/6299_2.png) [@Ivan\_Groenewold](https://forums.percona.com/u/Ivan_Groenewold)\ **Post date:** [November 24, 2020, 6:01am UTC](https://forums.percona.com/t/audit-plugin-include-exclude-accounts-doesnt-seem-to-work/8298/2 "2020-11-24T06:01:28Z")
Hi, did you restart the server after making the changes? changes to filtering rules do not apply to existing server connections. ---
**Author:** ![hspinks](https://avatars.discourse-cdn.com/v4/letter/h/a87d85/32.png) [@hspinks](https://forums.percona.com/u/hspinks)\ **Post date:** [November 24, 2020, 8:49am UTC](https://forums.percona.com/t/audit-plugin-include-exclude-accounts-doesnt-seem-to-work/8298/3 "2020-11-24T08:49:45Z")
@igroene , thanks for that answer! So with that logic, any change to the audit plugin filter, like adding or removing a user requires an outage / restart of MySQL? If that is the case, the documentation does not suggest that, unless “existing connections” in the documentation means any running database instance. I will try that, but if this is the case, an update to the documentation should be considered. Thanks though for your help and I will try making changes to the configuration file and restarting MySQL at my first opportunity. ---
**Author:** ![Ivan\_Groenewold](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/ivan_groenewold/32/6299_2.png) [@Ivan\_Groenewold](https://forums.percona.com/u/Ivan_Groenewold)\ **Post date:** [November 24, 2020, 8:56am UTC](https://forums.percona.com/t/audit-plugin-include-exclude-accounts-doesnt-seem-to-work/8298/4 "2020-11-24T08:56:15Z")
Hi, you don’t need to restart the database. Eventually as app/user connections are dropped and established, the new ones will start being audited as expected. Also this fact is mentioned here as a note: [https://www.percona.com/doc/percona-server/8.0/management/audit\_log\_plugin.html#filtering-by-user](https://www.percona.com/doc/percona-server/8.0/management/audit_log_plugin.html#filtering-by-user) hope that helps ---
**Author:** ![hspinks](https://avatars.discourse-cdn.com/v4/letter/h/a87d85/32.png) [@hspinks](https://forums.percona.com/u/hspinks)\ **Post date:** [November 24, 2020, 9:06am UTC](https://forums.percona.com/t/audit-plugin-include-exclude-accounts-doesnt-seem-to-work/8298/5 "2020-11-24T09:06:02Z")
If I am to conclude that each line in the audit.log file is a new connection, then there are many newly created connections from a user that should be excluded from logging in my log file now. I made my changes about a day ago now and I am still seeing users that have not been included in my configuration. Without a restart, how will I know when the configuration changes to these dynamic settings have taken affect? ---
**Author:** ![Ivan\_Groenewold](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/ivan_groenewold/32/6299_2.png) [@Ivan\_Groenewold](https://forums.percona.com/u/Ivan_Groenewold)\ **Post date:** [November 24, 2020, 9:16am UTC](https://forums.percona.com/t/audit-plugin-include-exclude-accounts-doesnt-seem-to-work/8298/6 "2020-11-24T09:16:55Z")
As I mentioned, the dynamic change is immediate for new user/app connections. Existing connections will continue to be logged until they disconnect gracefully, or they are killed (or server restarts). ---
**Author:** ![hspinks](https://avatars.discourse-cdn.com/v4/letter/h/a87d85/32.png) [@hspinks](https://forums.percona.com/u/hspinks)\ **Post date:** [December 10, 2020, 9:37am UTC](https://forums.percona.com/t/audit-plugin-include-exclude-accounts-doesnt-seem-to-work/8298/7 "2020-12-10T09:37:53Z")
I am still having a problem EXCLUDING users. I have been able to INCLUDE users to be logged with the following syntax; audit\_log\_include\_accounts=user1@localhost,user2@localhost… What I really need to do is to EXCLUDE users, but the usernames in the log files comes in the following format; user1[databasename] @ [hostname.domanainname.com](http://hostname.domanainname.com) [ip address] This is the format of what I want to exclude, but there are many users with many usernames, database names and hostnames. How to I use wild cards in the exclude entry in the config file to exclude common usernames from ANY systems that contains spaces and special characters? ---
**Author:** ![Ivan\_Groenewold](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/ivan_groenewold/32/6299_2.png) [@Ivan\_Groenewold](https://forums.percona.com/u/Ivan_Groenewold)\ **Post date:** [December 11, 2020, 7:11am UTC](https://forums.percona.com/t/audit-plugin-include-exclude-accounts-doesnt-seem-to-work/8298/8 "2020-12-11T07:11:48Z")
Unfortunately you cannot combine both include and exclude accounts functionality. You need to use the same user/host combination as they exist in mysql.user table. [https://www.percona.com/doc/percona-server/8.0/management/audit\_log\_plugin.html#filtering-by-user](https://www.percona.com/doc/percona-server/8.0/management/audit_log_plugin.html#filtering-by-user) for more info and some examples ---
**Author:** ![hspinks](https://avatars.discourse-cdn.com/v4/letter/h/a87d85/32.png) [@hspinks](https://forums.percona.com/u/hspinks)\ **Post date:** [December 11, 2020, 8:44am UTC](https://forums.percona.com/t/audit-plugin-include-exclude-accounts-doesnt-seem-to-work/8298/9 "2020-12-11T08:44:12Z")
@igroene Thanks for that answer, but can I use a wild card for a user name. for instance, can I exclude “user1@%”? Meaning “user1”’ from any host.