-- Apply simple filter: log only failed logins + DROP/ALTER SET GLOBAL audit_log_filter = ' "filter": "class": "general", "event": "status", "log": false , "rule": [

/var/log/mysql/audit.log daily rotate 30 compress delaycompress postrotate mysql -e "SET GLOBAL audit_log_rotate = ON;" endscript

"class": "table_access", "command": ["DROP", "ALTER", "TRUNCATE"], "log": true

SET GLOBAL audit_log_logging_events = 'connect,query,table_access'; :

SELECT VARIABLE_VALUE FROM performance_schema.global_status WHERE VARIABLE_NAME = 'audit_log_lost_events'; If > 0, increase audit_log_buffer_size (default 1MB → set to 4–8MB).