# Create audit filter for only failed logins

**URL:** https://forums.percona.com/t/create-audit-filter-for-only-failed-logins/40387
**Category:** MySQL & MariaDB
**Created:** [March 21, 2026, 11:30am UTC](https://forums.percona.com/t/create-audit-filter-for-only-failed-logins/40387 "2026-03-21T11:30:48Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![pkm2112](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/pkm2112/32/21433_2.png) [@pkm2112](https://forums.percona.com/u/pkm2112)
#### Post date: [March 21, 2026, 11:30am UTC](https://forums.percona.com/t/create-audit-filter-for-only-failed-logins/40387/1 "2026-03-21T11:30:48Z")

</div>

Hello experts,

I created audit filter to audit failed logins for application user, isnt working as expected

SELECT audit\_log\_filter\_set\_filter(‘audit\_FL’, ‘{  
“filter”: {“class”: [{“name”: “connection”,“event”: [{ “name”: “failed\_login” }]}]}}’);  
1 row in set (0.01 sec)

select audit\_log\_filter\_set\_user(‘appsuser@%’,‘audit\_FL’);

1 row in set (0.00 sec)

Tested failed login for user appsuser, didnt find any audit logs for failed logins

Is the event name correct

---

<div class="post-metadata">

### Author: ![pkm2112](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/pkm2112/32/21433_2.png) [@pkm2112](https://forums.percona.com/u/pkm2112)
#### Post date: [March 23, 2026, 1:44am UTC](https://forums.percona.com/t/create-audit-filter-for-only-failed-logins/40387/2 "2026-03-23T01:44:34Z")

</div>

This did the trick :

SELECT audit\_log\_filter\_set\_filter(‘audit\_FL’,  
‘{“filter”:{“class”:{“name”:“connection”,“event”:{“log”:{“not”:{“field”:{“name”:“status”,“value”:“0”}}},“name”:“connect”}}}}’);

1 row in set (0.01 sec)

Able to log only failed logins

---

<div class="post-metadata">

### Author: ![yunus.uyanik](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/yunus.uyanik/32/19250_2.png) [@yunus.uyanik](https://forums.percona.com/u/yunus.uyanik)
#### Post date: [March 23, 2026, 9:10am UTC](https://forums.percona.com/t/create-audit-filter-for-only-failed-logins/40387/3 "2026-03-23T09:10:14Z")

</div>

Hi,

Glad to hear that, yes, `failed_login` is mot a valid event name, more details can be found here: [Write audit\_log\_filter definitons - Percona Server for MySQL](https://docs.percona.com/percona-server/8.4/write-filter-definitions.html#basic-structure)