# How to skip select or all read operation in audit\_log\_filter in percona 8.4 **URL:** \ **Category:** Uncategorized\ **Tags:** percona\ **Created:** [May 15, 2025, 8:27am UTC](https://forums.percona.com/t/how-to-skip-select-or-all-read-operation-in-audit-log-filter-in-percona-8-4/37956 "2025-05-15T08:27:40Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![redssr](https://avatars.discourse-cdn.com/v4/letter/r/a9a28c/32.png) [@redssr](https://forums.percona.com/u/redssr)\ **Post date:** [May 15, 2025, 8:27am UTC](https://forums.percona.com/t/how-to-skip-select-or-all-read-operation-in-audit-log-filter-in-percona-8-4/37956/1 "2025-05-15T08:27:40Z")
Dear Friends, Hope you are all doing well, like as of always, i need some help from you experts. I am trying to create a filter in percona MySQL 8.4 to log only ddl and dml activities but somehow its logging all the events, kindly find the settings which are using filter creation SELECT audit\_log\_filter\_set\_filter(‘log’, ‘{ “filter”: { “class”: [ { “name”: [“connection”,“general”,“query”,“table\_access”], “event”:[“insert”,“update”, “delete”,“drop\_db”,“create\_db”,“alter\_table”,“alter\_user”,“drop\_user”,“create\_user”] } ] } }’ ); user assigning to filter SELECT audit\_log\_filter\_set\_user(‘%’,‘log’); mysql\> select \* from mysql.audit\_log\_filter; ±----------±-----±-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | filter\_id | name | filter | ±----------±-----±-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 1 | log | {“filter”: {“class”: [{“name”: [“connection”, “general”, “query”, “table\_access”], “events”: [“insert”, “update”, “delete”, “drop\_db”, “create\_db”, “alter\_table”, “alter\_user”, “drop\_user”, “create\_user”]}]}} | ±----------±-----±-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ 1 row in set (0.00 sec) mysql\> mysql\> mysql\> select \* from mysql.audit\_log\_user; ±---------±---------±-----------+ | username | userhost | filtername | ±---------±---------±-----------+ | % | % | log | ±---------±---------±-----------+ 1 row in set (0.00 sec) mysql\> select @@version; ±----------+ | @@version | ±----------+ | 8.4.4-4 | ±----------+ 1 row in set (0.00 sec) log output { “timestamp”: “2025-05-14 10:16:15”, “id”: 28, “class”: “query”, “event”: “query\_status\_end”, “connection\_id”: 11, “query\_data”: { “query”: “select user,host from mysql.user”, “status”: 0, “sql\_command”: “select”} }, { “timestamp”: “2025-05-14 10:16:15”, “id”: 29, “class”: “general”, “event”: “result”, “connection\_id”: 11, “account”: { “user”: “root[root] @ localhost ”, “host”: “localhost” }, “login”: { “user”: “root[root] @ localhost ”, “ip”: “”, “proxy”: “” }, “general\_data”: { “status”: 0 } }, Its still logging the all logs Where i am going wrong ---
**Author:** ![matthewb](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/matthewb/32/34_2.png) [@matthewb](https://forums.percona.com/u/matthewb)\ **Post date:** [May 15, 2025, 3:43pm UTC](https://forums.percona.com/t/how-to-skip-select-or-all-read-operation-in-audit-log-filter-in-percona-8-4/37956/2 "2025-05-15T15:43:36Z")
Hello @redssr, Have you searched this forums for similar issues? I seem to recall several posts earlier this year on this topic. If you can’t find anything, reply here and we can look more closely at your issue. ---
**Author:** ![redssr](https://avatars.discourse-cdn.com/v4/letter/r/a9a28c/32.png) [@redssr](https://forums.percona.com/u/redssr)\ **Post date:** [May 15, 2025, 5:55pm UTC](https://forums.percona.com/t/how-to-skip-select-or-all-read-operation-in-audit-log-filter-in-percona-8-4/37956/3 "2025-05-15T17:55:18Z")
Dear @matthewb , Thanks for your response. Basically before posting the thread i already gone through [Defining rules for audit log filter component (v8.0 / 8.4) - #2 by dba\_S4dscjz](https://forums.percona.com/t/defining-rules-for-audit-log-filter-component-v8-0-8-4/36276/2) [Write audit\_log\_filter definitons](https://forums.percona.com/t/write-audit-log-filter-definitons/37704) and [percona-server/mysql-test/suite/component\_audit\_log\_filter/t/filter\_definition\_function\_string\_find.test at 8.4 · percona/percona-server · GitHub](https://github.com/percona/percona-server/blob/8.4/mysql-test/suite/component_audit_log_filter/t/filter_definition_function_string_find.test#L59) threads, but no luck, hence tried my way If possible, can you please make it simpler for me, i want to achive below things, 1. should capture username who is firing the command 2. should print the command ( only ddl dcl dml queries) no select or show queries should be logged ---
**Author:** ![dba\_S4dscjz](https://avatars.discourse-cdn.com/v4/letter/d/65b543/32.png) [@dba\_S4dscjz](https://forums.percona.com/u/dba_S4dscjz)\ **Post date:** [May 16, 2025, 8:02am UTC](https://forums.percona.com/t/how-to-skip-select-or-all-read-operation-in-audit-log-filter-in-percona-8-4/37956/4 "2025-05-16T08:02:15Z")
Hello @redssr, The plugin component records log messages by “class” and the class that captures the queries doesn’t display the username who is running the queries but displays a connection identifier. You therefore need at least 2 classes in your filter definition to do what your’re looking for. May be you can test this filter : ```auto { "filter": { "class": [ { "name": "connection", "log": true }, { "name": "query", "event": { "name": ["start", "status_end"], "log": { "not": { "or": [ { "function": { "name": "string_find", "args": [{"string": {"field": "sql_command_id"}}, {"string": {"string": "show_"}}] }}, { "field": { "name": "sql_command_id", "value": "select"} } ] } } } } ] } } ``` ---
**Author:** ![redssr](https://avatars.discourse-cdn.com/v4/letter/r/a9a28c/32.png) [@redssr](https://forums.percona.com/u/redssr)\ **Post date:** [May 16, 2025, 5:51pm UTC](https://forums.percona.com/t/how-to-skip-select-or-all-read-operation-in-audit-log-filter-in-percona-8-4/37956/5 "2025-05-16T17:51:59Z")
Dear @dba_S4dscjz Thank you so much i really appreciate your help, it worked, To log username i did a trick, instead of connection i used general, it’s drawback it’s logging log for every event but fine as instead of only connection id username is imp for me, here is the output of log { “timestamp”: “2025-05-17 10:17:11”, “id”: 40, “class”: “general”, “event”: “log”, “connection\_id”: 11, “account”: { “user”: “root[root] @ localhost ”, “host”: “localhost” }, “login”: { “user”: “root[root] @ localhost ”, “ip”: “”, “proxy”: “” }, “general\_data”: { “status”: 0 } }, { “timestamp”: “2025-05-17 10:17:11”, “id”: 41, “class”: “query”, “event”: “query\_start”, “connection\_id”: 11, “query\_data”: { “query”: “create database ssr”, “status”: 0, “sql\_command”: “create\_db”} }, { “timestamp”: “2025-05-17 10:17:11”, “id”: 42, “class”: “query”, “event”: “query\_status\_end”, “connection\_id”: 11, “query\_data”: { “query”: “create database ssr”, “status”: 0, “sql\_command”: “create\_db”} }, ---
**Author:** ![redssr](https://avatars.discourse-cdn.com/v4/letter/r/a9a28c/32.png) [@redssr](https://forums.percona.com/u/redssr)\ **Post date:** [August 25, 2026, 3:29pm UTC](https://forums.percona.com/t/how-to-skip-select-or-all-read-operation-in-audit-log-filter-in-percona-8-4/37956/6 "2026-08-25T15:29:17Z")
Finally here is my updated filter and it’s really worth [code] SELECT audit\_log\_filter\_set\_filter(‘log’, ‘{ “filter”: { “class”: [ { “name”: “general”, “event”: { “name”: “status”, “log”: { “not”: { “or”: [ { “field”: { “name”: “general\_sql\_command.str”, “value”: “error” } }, { “and”: [ { “field”: { “name”: “general\_error\_code”, “value”: 0 } }, { “or”: [ { “field”: { “name”: “general\_command.str”, “value”: “Quit” } }, { “field”: { “name”: “general\_command.str”, “value”: “Init DB” } }, { “field”: { “name”: “general\_command.str”, “value”: “Ping” } }, { “field”: { “name”: “general\_sql\_command.str”, “value”: “set\_option” } }, { “field”: { “name”: “general\_sql\_command.str”, “value”: “select” } }, { “field”: { “name”: “general\_sql\_command.str”, “value”: “show\_variables” } }, { “field”: { “name”: “general\_sql\_command.str”, “value”: “show\_databases” } }, { “field”: { “name”: “general\_sql\_command.str”, “value”: “show\_tables” } }, { “field”: { “name”: “general\_sql\_command.str”, “value”: “show\_status” } }, { “field”: { “name”: “general\_sql\_command.str”, “value”: “show\_fields” } }, { “field”: { “name”: “general\_sql\_command.str”, “value”: “show\_create\_table” } }, { “field”: { “name”: “general\_sql\_command.str”, “value”: “show\_warnings” } }, { “field”: { “name”: “general\_sql\_command.str”, “value”: “show\_engine\_status” } }, { “field”: { “name”: “general\_sql\_command.str”, “value”: “show\_grants” } }, { “field”: { “name”: “general\_sql\_command.str”, “value”: “show\_binlogs” } }, { “field”: { “name”: “general\_sql\_command.str”, “value”: “show\_replica\_status” } }, { “field”: { “name”: “general\_sql\_command.str”, “value”: “show\_binary\_log\_status” } }, { “field”: { “name”: “general\_sql\_command.str”, “value”: “show\_processlist” } }, { “field”: { “name”: “general\_sql\_command.str”, “value”: “replica\_start” } }, { “field”: { “name”: “general\_sql\_command.str”, “value”: “replica\_stop” } }, { “field”: { “name”: “general\_sql\_command.str”, “value”: “show\_charsets” } }, { “field”: { “name”: “general\_sql\_command.str”, “value”: “change\_db” } }, { “field”: { “name”: “general\_sql\_command.str”, “value”: “show\_storage\_engines” } }, { “field”: { “name”: “general\_sql\_command.str”, “value”: “show\_collations” } }, { “field”: { “name”: “general\_sql\_command.str”, “value”: “show\_procedure\_status” } }, { “field”: { “name”: “general\_sql\_command.str”, “value”: “show\_function\_status” } }, { “field”: { “name”: “general\_sql\_command.str”, “value”: “show\_keys” } }, { “field”: { “name”: “general\_sql\_command.str”, “value”: “show\_create\_proc” } }, { “field”: { “name”: “general\_sql\_command.str”, “value”: “show\_triggers” } }, { “field”: { “name”: “general\_sql\_command.str”, “value”: “show\_events” } }, { “field”: { “name”: “general\_sql\_command.str”, “value”: “unlock\_tables” } }, { “field”: { “name”: “general\_sql\_command.str”, “value”: “savepoint” } }, { “field”: { “name”: “general\_sql\_command.str”, “value”: “show\_table\_status” } }, { “field”: { “name”: “general\_sql\_command.str”, “value”: “rollback\_to\_savepoint” } }, { “field”: { “name”: “general\_sql\_command.str”, “value”: “release\_savepoint” } }, { “field”: { “name”: “general\_sql\_command.str”, “value”: “show\_create\_event” } }, { “field”: { “name”: “general\_sql\_command.str”, “value”: “show\_create\_func” } }, { “field”: { “name”: “general\_sql\_command.str”, “value”: “begin” } }, { “field”: { “name”: “general\_sql\_command.str”, “value”: “commit” } }, { “field”: { “name”: “general\_sql\_command.str”, “value”: “show\_plugins” } }, { “field”: { “name”: “general\_sql\_command.str”, “value”: “kill” } } ] } ] } ] } } } }, { “name”: “connection”, “event”: { “name”: “connect”, “log”: { “not”: { “field”: { “name”: “status”, “value”: 0 } } } } } ] } }’); [/code] Sample Audit log file entry [code] \ 2026-08-25T20:29:15 \2\_2026-08-25T20:29:15\ Query \14\ 0 \0\ root[root] @ localhost \ localhost \drop\_db\ drop database ssr \ \ 2026-08-25T20:33:34 \3\_2026-08-25T20:33:34\ Query \15\ 0 \0\ root[root] @ localhost \ localhost \shutdown\ shutdown \ \ 2026-08-25T20:33:35 \4\_2026-08-25T20:33:35\ NoAudit \31\ \ [/code]