# Getting null when running audit\_log\_read

**URL:** <https://forums.percona.com/t/getting-null-when-running-audit-log-read/40117>\
**Category:** Percona Distribution for MySQL\
**Created:** [January 28, 2026, 5:52pm UTC](https://forums.percona.com/t/getting-null-when-running-audit-log-read/40117 "2026-01-28T17:52:19Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![ipcmlr](https://avatars.discourse-cdn.com/v4/letter/i/df705f/32.png) [@ipcmlr](https://forums.percona.com/u/ipcmlr)\
**Post date:** [January 28, 2026, 5:52pm UTC](https://forums.percona.com/t/getting-null-when-running-audit-log-read/40117/1 "2026-01-28T17:52:19Z")

</div>

I have audit filter running ( logging connections and drop/create/alter user) in the json format.

It have tested that it is logging correctly in the json format.

root@localhost (none)\> SHOW VARIABLES LIKE ‘audit\_log\_filter\_format’;  
±------------------------±------+  
| Variable\_name | Value |  
±------------------------±------+  
| audit\_log\_filter.format | JSON |  
±------------------------±------+  
1 row in set (0.01 sec)

root@localhost (none)\> SHOW VARIABLES LIKE ‘audit\_log\_filter\_file’;  
±----------------------±-----------------+  
| Variable\_name | Value |  
±----------------------±-----------------+  
| audit\_log\_filter.file | audit\_filter.log |  
±----------------------±-----------------+  
1 row in set (0.01 sec)

I am trying to run audit log read but I am not getting anything. I see the audit\_filter log getting populated every few seconds in the json format. My database version is 8.4.5

root@localhost (none)\> SELECT audit\_log\_read(audit\_log\_read\_bookmark());  
±------------------------------------------+  
| audit\_log\_read(audit\_log\_read\_bookmark()) |  
±------------------------------------------+  
| [  
null  
]  
|  
±------------------------------------------+  
1 row in set (0.61 sec)

root@localhost (none)\> SELECT audit\_log\_read();  
ERROR 3200 (HY000): audit\_log\_read UDF failed; Wrong argument format

---

<div class="post-metadata">

**Author:** ![ipcmlr](https://avatars.discourse-cdn.com/v4/letter/i/df705f/32.png) [@ipcmlr](https://forums.percona.com/u/ipcmlr)\
**Post date:** [February 3, 2026, 10:26pm UTC](https://forums.percona.com/t/getting-null-when-running-audit-log-read/40117/2 "2026-02-03T22:26:04Z")

</div>

> [@ipcmlr](#):
>
> SELECT audit\_log\_read(audit\_log\_read\_bookmark());

I tried the documentation in [https://dev.mysql.com/blog-archive/audit-logs-json-format-logging/](https://dev.mysql.com/blog-archive/audit-logs-json-format-logging/)

Still no luck,

root@localhost (none)\> SELECT audit\_log\_read\_bookmark();  
±---------------------------------------------------+  
| audit\_log\_read\_bookmark() |  
±---------------------------------------------------+  
| {“timestamp”: “2026-02-03 17:24:11”, “id”: 362018} |  
±---------------------------------------------------+  
1 row in set (0.00 sec)

root@localhost (none)\> select audit\_log\_read(‘{ “timestamp”: “2026-02-03 17:24:11”, “id”: 362018}’);  
±----------------------------------------------------------------------+  
| audit\_log\_read(‘{ “timestamp”: “2026-02-03 17:24:11”, “id”: 362018}’) |  
±----------------------------------------------------------------------+  
| [  
null  
]  
|  
±----------------------------------------------------------------------+  
1 row in set (0.00 sec)

root@localhost (none)\> SELECT audit\_log\_read();  
ERROR 3200 (HY000): audit\_log\_read UDF failed; Wrong argument format

---

<div class="post-metadata">

**Author:** ![Abhinav\_Gupta](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/abhinav_gupta/32/6262_2.png) [@Abhinav\_Gupta](https://forums.percona.com/u/Abhinav_Gupta)\
**Post date:** [February 4, 2026, 1:47pm UTC](https://forums.percona.com/t/getting-null-when-running-audit-log-read/40117/3 "2026-02-04T13:47:03Z")

</div>

Can you try to manually read the audit log file content in a pretty format like below?

`cat audit_filter.log | jq '.' | less`

---

<div class="post-metadata">

**Author:** ![ipcmlr](https://avatars.discourse-cdn.com/v4/letter/i/df705f/32.png) [@ipcmlr](https://forums.percona.com/u/ipcmlr)\
**Post date:** [February 5, 2026, 2:44pm UTC](https://forums.percona.com/t/getting-null-when-running-audit-log-read/40117/4 "2026-02-05T14:44:25Z")

</div>

> [@Abhinav\_Gupta](#):
>
> cat audit\_filter.log | jq ‘.’ | less

it gives a parse error because the audit filter log doesnt have a closing bracket when it is being written to.

“parse error: Unfinished JSON term at EOF at line 1709585, column 3  
(END)”

thats why I am trying to run the audit\_log\_read because that is the only way to easily get alerts according to the percona documentation.

> **[Functions used for reading the files - Percona Server for MySQL - Reading Audit...](https://docs.percona.com/percona-server/8.0/reading-audit-log-filter-files.html#functions-used-for-reading-the-files)**
>
> The Audit Log Filter functions can provide a SQL interface to read JSON-format audit log files. The functions cannot read log files in other formats. Configuring the plugin for JSON logging lets the functions use the directory that contains the...

---

<div class="post-metadata">

**Author:** ![ipcmlr](https://avatars.discourse-cdn.com/v4/letter/i/df705f/32.png) [@ipcmlr](https://forums.percona.com/u/ipcmlr)\
**Post date:** [February 5, 2026, 2:46pm UTC](https://forums.percona.com/t/getting-null-when-running-audit-log-read/40117/5 "2026-02-05T14:46:56Z")

</div>

is there a workaround for this that does not involve closing the audit filter log and creating a new one?

I see this ticket and it i’m not sure if this is fixed yet.

> **[Jira](https://perconadev.atlassian.net/browse/PS-9773)**

---

<div class="post-metadata">

**Author:** ![anderson.nogueira](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/anderson.nogueira/32/23141_2.png) [@anderson.nogueira](https://forums.percona.com/u/anderson.nogueira)\
**Post date:** [February 20, 2026, 10:06am UTC](https://forums.percona.com/t/getting-null-when-running-audit-log-read/40117/6 "2026-02-20T10:06:29Z")

</div>

Hi @ipcmlr,

The `jq` parse error you’re seeing is expected. The active log file (`audit_filter.log`) is an open JSON array while the server writes to it. It starts with `[` but has no closing `]`. As @Abhinav_Gupta suggested, reading the file directly is the right approach, you just need to append the missing bracket:

```bash
# Active file - append closing ] for valid JSON
sed '$ a ]' /var/lib/mysql/audit_filter.log | jq '.'

# Rotated files are already complete JSON
jq '.' /var/lib/mysql/audit_filter.*.log

```

No need to rotate or create a new file. `sed` streams the content and appends `]` without modifying the original. We verified this is safe under concurrent writes.

As for `audit_log_read()` itself, this is a confirmed bug affecting all `8.4` releases through `8.4.7-7` (including your `8.4.5`). There are three issues in `component_audit_log_filter`:

1. **Active file excluded from reader.** The reader builds its file index by DOM-parsing each log file. The active file fails the parse (incomplete JSON array), so it’s silently skipped. Your bookmark from `audit_log_read_bookmark()` points to the most recent event, which is in the active file the reader can’t see.

2. **Exact timestamp matching.** The reader’s start-position check uses `==` instead of `>=` for timestamp comparison. So `"2026-02-03 17:24:11"` only matches an event with that _exact_ timestamp, not “from this point forward.”

3. **Malformed JSON output.** Even when `audit_log_read()` does return data (using an exact first-event timestamp from a rotated file), the output has missing commas between sibling objects, making it invalid JSON.

[PR #5803](https://github.com/percona/percona-server/pull/5803) (expected in `8.4.8`) fixes the malformed JSON ([PS-10347](https://perconadev.atlassian.net/browse/PS-10347)) and pagination ([PS-10387](https://perconadev.atlassian.net/browse/PS-10387)); bugs 1 and 2 are known issues not yet resolved, so the `sed` + `jq` approach above remains the recommended workaround.

For your security reports, the `sed` + `jq` approach above is the most reliable path. If you want to automate it (daily job, alerting), a cron script that rotates and parses closed files works well. No events are lost during rotation:

```bash
#!/bin/bash
# Rotate, then process all properly-closed files
mysql -e "SELECT audit_log_rotate();"
for f in /var/lib/mysql/audit_filter.2*.log; do
    # Skip XML transition files (from format change)
    head -1 "$f" | grep -q '<?xml' && continue
    # Skip files missing closing ] (rare edge case)
    tail -c 2 "$f" | grep -q ']' || continue
    jq '.' "$f"
done # pipe to your reporting tool or SIEM

```

References:

- Docs: [Reading Audit Log Filter files](https://docs.percona.com/percona-server/8.4/reading-audit-log-filter-files.html)
- Docs: [Audit Log Filter variables](https://docs.percona.com/percona-server/8.4/audit-log-filter-variables.html)
- Fix PR: [PS-10347 [8.4]: Ensure strict JSON compliance and robust field separation in audit\_log\_read()/AuditJsonHandler by inikep · Pull Request #5803 · percona/percona-server · GitHub](https://github.com/percona/percona-server/pull/5803)
- [PS-10347](https://perconadev.atlassian.net/browse/PS-10347)
- [PS-10387](https://perconadev.atlassian.net/browse/PS-10387)