Double entry about disconnection audit_log_filter Mysql 8.4.10

MySQL & MariaDB Percona Server for MySQL 8.0
1

I have next settings:
SELECT audit_log_filter_set_filter('only_logins', '{"filter": {"class": [{"name": "connection", "event": [{"name": "connect"}, {"name": "disconnect"}]}]}}');
SELECT audit_log_filter_set_user('%', 'only_logins');

And what I get on every connection/disconnection:

  {
    "timestamp": "2026-08-19 11:14:26",
    "id": 14487,
    "class": "connection",
    "event": "connect",
    "connection_id": 4955,
    "account": { "user": "root", "host": "localhost" },
    "login": { "user": "root", "os": "", "ip": "", "proxy": "" },
    "connection_data": {
      "connection_type": "socket",
      "status": 0,
      "db": "",
      "connection_attributes": {
        "_pid": "3253441",
        "_platform": "x86_64",
        "_os": "Linux",
        "_client_name": "libmysql",
        "os_user": "root",
        "_client_version": "8.4.10-10",
        "program_name": "mysql"
      }
    }
  },
  {
    "timestamp": "2026-08-19 11:14:26",
    "id": 14488,
    "class": "connection",
    "event": "disconnect",
    "connection_id": 4955,
    "account": { "user": "root", "host": "localhost" },
    "login": { "user": "root", "os": "", "ip": "", "proxy": "" },
    "connection_data": {
      "connection_type": "socket"
    }
  },
  {
    "timestamp": "2026-08-19 11:14:26",
    "id": 14489,
    "class": "connection",
    "event": "disconnect",
    "connection_id": 4955,
    "account": { "user": "root", "host": "localhost" },
    "login": { "user": "root", "os": "", "ip": "", "proxy": "" },
    "connection_data": {
      "connection_type": "socket"
    }
  }

it does not depend how I connect to a server via socket or tcp.

Could you help me to create audit filter only for connection/disconnection?
Thank you.

2

This should do what your looking for:

SELECT audit_log_filter_set_filter(
  'only_logins',
  '{
    "filter": {
      "log": false,
      "class": {
        "name": "connection",
        "event": [
          { "name": "connect", "log": true },
          { "name": "disconnect", "log": true }
        ]
      }
    }
  }'
);

SELECT audit_log_filter_set_user('%', 'only_logins');
3

Thanks for the answer.
I’ve replaced my queries by yours and have the same effect.
Maybe this is normal behavior in Mysql 8. I haven’t configured audit on this version before. In 5.7, the old plugin only had one pair of connection and disconnection.

4

Here is what I have in my audit log:

  {
    "timestamp": "2026-08-19 10:14:19",
    "id": 3,
    "class": "connection",
    "event": "connect",
    "connection_id": 10,
    "account": { "user": "wayne", "host": "" },
    "login": { "user": "wayne", "os": "", "ip": "", "proxy": "" },
    "connection_data": {
      "connection_type": "ssl",
      "status": 0,
      "db": "",
      "connection_attributes": {
        "_os": "macos26.4",
        "_platform": "arm64",
        "_client_version": "8.4.10",
        "_client_name": "libmysql",
        "_pid": "94955",
        "os_user": "wayne",
        "program_name": "mysql"
      }
    }
  },
  {
    "timestamp": "2026-08-19 10:14:51",
    "id": 4,
    "class": "connection",
    "event": "disconnect",
    "connection_id": 10,
    "account": { "user": "wayne", "host": "" },
    "login": { "user": "wayne", "os": "", "ip": "", "proxy": "" },
    "connection_data": {
      "connection_type": "ssl"
    }
  }

Do you happen to have any other filter defined that could be adding the duplicate?

5

Nothing special.

mysql> SELECT * FROM mysql.audit_log_user;
+----------+----------+-------------+
| username | userhost | filtername  |
+----------+----------+-------------+
| %        | %        | only_logins |
+----------+----------+-------------+
1 row in set (0.00 sec)

mysql> SELECT * FROM mysql.audit_log_filter;
+-----------+-------------+-----------------------------------------------------------------------------------------------------------------------------------------------+
| filter_id | name        | filter                                                                                                                                        |
+-----------+-------------+-----------------------------------------------------------------------------------------------------------------------------------------------+
|         1 | only_logins | {"filter": {"log": false, "class": {"name": "connection", "event": [{"log": true, "name": "connect"}, {"log": true, "name": "disconnect"}]}}} |
+-----------+-------------+-----------------------------------------------------------------------------------------------------------------------------------------------+
1 row in set (0.00 sec)

mysql> SHOW GLOBAL VARIABLES LIKE 'audit_log_filter%';
+-------------------------------------------------------+--------------------------+
| Variable_name                                         | Value                    |
+-------------------------------------------------------+--------------------------+
| audit_log_filter.buffer_size                          | 1048576                  |
| audit_log_filter.compression                          | NONE                     |
| audit_log_filter.database                             | mysql                    |
| audit_log_filter.direct_io                            | OFF                      |
| audit_log_filter.disable                              | OFF                      |
| audit_log_filter.encryption                           | NONE                     |
| audit_log_filter.event_mode                           | REDUCED                  |
| audit_log_filter.file                                 | /var/log/mysql/audit.log |
| audit_log_filter.format                               | JSON                     |
| audit_log_filter.format_unix_timestamp                | OFF                      |
| audit_log_filter.handler                              | FILE                     |
| audit_log_filter.key_derivation_iterations_count_mean | 600000                   |
| audit_log_filter.max_size                             | 209715200                |
| audit_log_filter.password_history_keep_days           | 0                        |
| audit_log_filter.prune_seconds                        | 0                        |
| audit_log_filter.read_buffer_size                     | 32768                    |
| audit_log_filter.rotate_on_size                       | 104857600                |
| audit_log_filter.strategy                             | ASYNCHRONOUS             |
| audit_log_filter.syslog_facility                      | LOG_USER                 |
| audit_log_filter.syslog_priority                      | LOG_INFO                 |
| audit_log_filter.syslog_tag                           | audit-filter             |
+-------------------------

I also tried it on 8.4.8 with the same result.

6

Hi @Kobold

Are you using thread pool? I tested and when thread pool is enabled, the disconnect event gets logged twice. I reported the bug here - https://perconadev.atlassian.net/browse/PS-11498

7

Yes. This is my case. Thank you.

8

You can subscribe to the bug (click “start watching”) to track its progress.