# Excluding events in the audit plugin log **URL:** \ **Category:** MySQL & MariaDB\ **Tags:** percona\ **Created:** [September 15, 2022, 2:44pm UTC](https://forums.percona.com/t/excluding-events-in-the-audit-plugin-log/17492 "2022-09-15T14:44:42Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![dla](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/dla/32/4859_2.png) [@dla](https://forums.percona.com/u/dla)\ **Post date:** [September 15, 2022, 2:44pm UTC](https://forums.percona.com/t/excluding-events-in-the-audit-plugin-log/17492/1 "2022-09-15T14:44:42Z")
Helllo, I am configuring the `audit_log` plugin and it is logging too many events and there seems to be no way to exclude them. I have configured the plugin with `audit_log_exclude_commands` to not log any common commands, so that only “unusual” activity is logged. The problem is that the log file is swamped by lines like ```auto {"audit_record":{"name":"Connect","record":"3268525_2022-09-15T13:51:06","timestamp":"2022-09-15T14:36:54Z","connection_id":"10","status":0,"user":"xxx","priv_user":"xxx","os_login":"","proxy_user":"","host":"","ip":"10.0.0.1","db":"mydb"}} {"audit_record":{"name":"Close stmt","record":"3268526_2022-09-15T13:51:06","timestamp":"2022-09-15T14:36:54Z","command_class":"close stmt","connection_id":"11","status":0,"sqltext":"","user":"xxx[xxx] @ [10.0.0.1]","host":"","os_user":"","ip":"10.0.0.1","db":"mydb"}} {"audit_record":{"name":"Quit","record":"3268532_2022-09-15T13:51:06","timestamp":"2022-09-15T14:36:54Z","connection_id":"12","status":0,"user":"xxx","priv_user":"xxx","os_login":"","proxy_user":"","host":"","ip":"10.0.0.1","db":"mydb"}} ``` The second line above contains a `"command_class":"close stmt"` (this is JSON output), but I have tried adding “close stmt”, “Close stmt”, “close” and a few other things to `audit_log_exclude_commands` but cannot suppress the output. Similarly, the configuration options appear to offer no way of excluding different event types (namely, “Connect” and “Quit”). Given that this server has several thousand connections per second, the amount of logs written to the file is not viable. Does anyone have an idea how to do this? ---
**Author:** ![dla](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/dla/32/4859_2.png) [@dla](https://forums.percona.com/u/dla)\ **Post date:** [September 15, 2022, 4:03pm UTC](https://forums.percona.com/t/excluding-events-in-the-audit-plugin-log/17492/2 "2022-09-15T16:03:12Z")
I should also point out that I tried reversing the configuration of `audit_log_exclude_commands` in terms of `audit_log_include_commands` but the Connect and Quit events are still logged. As a result, the plugin logs 1 GiB of useless data in 8-9 minutes. ---
**Author:** ![matthewb](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/matthewb/32/34_2.png) [@matthewb](https://forums.percona.com/u/matthewb)\ **Post date:** [September 15, 2022, 6:50pm UTC](https://forums.percona.com/t/excluding-events-in-the-audit-plugin-log/17492/3 "2022-09-15T18:50:36Z")
Check out the documentation for the values of commands you can exclude: [https://docs.percona.com/percona-server/8.0/management/audit\_log\_plugin.html#id4](https://docs.percona.com/percona-server/8.0/management/audit_log_plugin.html#id4) If \_execlude\_commands has values, then \_include\_commands must be NULL and vice versa. ---
**Author:** ![dla](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/dla/32/4859_2.png) [@dla](https://forums.percona.com/u/dla)\ **Post date:** [September 16, 2022, 2:42pm UTC](https://forums.percona.com/t/excluding-events-in-the-audit-plugin-log/17492/4 "2022-09-16T14:42:42Z")
I read the documentation. I understand the meaning of excluded or included, and that one of `exclude` and `include` must be null. What I am pointing out is that `Connect` and `Quit` events are always logged and, apparently, cannot be turned off. Note that these events are not defined as a `statement/sql/something` in `setup_instruments`. This makes sense: when a connect or quit occurs, no statement is being executed. Unless I am missing something, this makes the plugin unusable on a busy server. ---
**Author:** ![matthewb](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/matthewb/32/34_2.png) [@matthewb](https://forums.percona.com/u/matthewb)\ **Post date:** [September 16, 2022, 2:58pm UTC](https://forums.percona.com/t/excluding-events-in-the-audit-plugin-log/17492/5 "2022-09-16T14:58:11Z")
Ok. If you then have a repeatable test case, please open a bug report at [https://jira.percona.com/](https://jira.percona.com/) so that our engineers can take a look. Be sure to note in the bug report the specific version of percona server you are running. ---
**Author:** ![dla](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/dla/32/4859_2.png) [@dla](https://forums.percona.com/u/dla)\ **Post date:** [September 16, 2022, 3:31pm UTC](https://forums.percona.com/t/excluding-events-in-the-audit-plugin-log/17492/6 "2022-09-16T15:31:13Z")
I figured out what I was doing wrong. I had `audit_log_policy` set to `ALL`. Changing it to `QUERIES` eliminates all the Connect/Traffic. The documentation does not show clearly how these parameters are related. I will file a bug report though, because as far as I can tell, when using `audit_log_exclude_commands` there is no way to exclude `command_class: close stmt` events, so I am forced to deal with a very unwieldy `audit_log_include_commands` setting (the value is 2194 characters long) ---
**Author:** ![dla](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/dla/32/4859_2.png) [@dla](https://forums.percona.com/u/dla)\ **Post date:** [September 19, 2022, 8:43am UTC](https://forums.percona.com/t/excluding-events-in-the-audit-plugin-log/17492/7 "2022-09-19T08:43:03Z")
I filed a bug report [[PS-8404] audit\_log plugin cannot exclude "close stmt" command - Percona JIRA](https://jira.percona.com/browse/PS-8404)