> For the complete documentation index, see [llms.txt](https://mariadb.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://mariadb.com/docs/server/reference/plugins/mariadb-enterprise-audit/mariadb-enterprise-audit-filters.md).
# Enterprise Audit Filters
Create, assign, query, and reload the Default and Named Audit Filters that control what MariaDB Enterprise Audit writes to the audit log.
Filters are JSON objects that specify what you want MariaDB Enterprise Audit to monitor.
There are two types of filters:
| Audit Filter Type | Description |
| --------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| [Default Audit Filter](#default-audit-filter) | The Default Audit Filter is used for all user accounts that are not assigned a Named Audit Filter. Only a single Default Audit Filter can be defined in the `mysql.server_audit_filters` system table, and it must be defined with the name default. |
| [Named Audit Filters](#named-audit-filters) | Named Audit Filters must be assigned to specific user accounts. Many Named Audit Filters can be defined in the `mysql.server_audit_filters` system table, and they must be defined with unique names. A Named Audit Filter can be assigned to a user account by inserting the user account details and the filter name into the `mysql.server_audit_users` system table. |
## Default Audit Filter
The Default Audit Filter applies to all user accounts that do not have a specific Named Audit Filter assigned. Only one Default Audit Filter is allowed in the `mysql.server_audit_filters` system table, and it must be named `default`.
### Create a Default Audit Filter
If you want to create a Default Audit Filter, you need to insert the details into the `mysql.server_audit_filters` system table. The name for the Default Audit Filter must be default and the rule should be designed to meet your audit logging requirements.
To create a Default Audit Filter:
1. Confirm that a Default Audit Filter does not already exist:
```sql
SELECT * FROM mysql.server_audit_filters
WHERE filtername = 'default';
```
2. If a Default Audit Filter already exists, remove it:
```sql
DELETE FROM mysql.server_audit_filters
WHERE filtername = 'default';
```
3. Insert the details for the new Default Audit Filter into the mysql.server\_audit\_filters system table:
```sql
INSERT INTO mysql.server_audit_filters (filtername, rule)
VALUES ('default',
JSON_COMPACT(
'{
"connect_event":"ALL",
"table_event":"WRITE"
}'
));
```
This example Audit Filter configures audit logging for all Connection Events and Write Table Events.
The example passes the JSON object to the [JSON\_COMPACT()](/docs/server/reference/sql-functions/special-functions/json-functions/json_compact.md) function, so that the JSON object is compacted prior to being inserted into the system table. This step is recommended, but not required.
4. Reload the Audit Filters by setting the server\_audit\_reload\_filters system variable to `ON`:
```sql
SET GLOBAL server_audit_reload_filters=ON;
```
### Disable Logging with the Default Filter
It is recommended to use the default filter to assure that any user is audited, also if not defined in the `mysql.server_audit_users` system table.
In some special cases you might want audits only to be enabled for the users in `mysql.server_audit_users`. In this case you should use the following default filter to disable logging for all other users.
```sql
INSERT INTO mysql.server_audit_filters (filtername, rule)
VALUES ('default',
JSON_COMPACT(
'{
"logging": "OFF"
}'
));
```
## Named Audit Filters
Named Audit Filters must be assigned to specific user accounts.
Multiple Named Audit Filters can be defined in the mysql.server\_audit\_filters system table, and they must be defined with unique names. A Named Audit Filter can be assigned to a user account by inserting the user account details and the filter name into the mysql.server\_audit\_users system table.
### Create a Named Audit Filter
To create a Named Audit Filter, insert a row with the Audit Filter's name and the rule into the `mysql.server_audit_filters` system table:
```sql
INSERT INTO mysql.server_audit_filters (filtername, rule)
VALUES ('reporting',
JSON_COMPACT(
'{
"connect_event": [
"CONNECT",
"DISCONNECT"
],
"table_event":[
"WRITE",
"CREATE",
"DROP",
"RENAME",
"ALTER"
]
}'
));
```
This example Audit Filter is defined with the name reporting, and it configures audit logging for Connection Events and Disconnection Events and for several types of Table Events. This example Audit Filter can be useful for read-only users since it does not log table reads, but it does log table writes and schema changes which are illegitimate activities for a read-only user.
The example passes the JSON object to the `JSON_COMPACT`() function, so that the JSON object is compacted prior to being inserted into the system table. This step is recommended, but not required.
For additional information on how to assign the Audit Filter to a user account, see "[Assign a Named Audit Filter](#assign-a-named-audit-filter)".
### Assign a Named Audit Filter
Named Audit Filters are only active when they are assigned to a specific user account.
To assign a Named Audit Filter to a user account:
1. Insert a row with the user account details and the Audit Filter's name into the `mysql.server_audit_users` system table:
```sql
INSERT INTO mysql.server_audit_users (host, user, filtername)
VALUES ("%", "reader", "reporting");
```
This example statement assigns the reporting Audit Filter created in "[Create a Named Audit Filter](#create-a-named-audit-filter)" to the `reader@%` user account.
2. Reload the Audit Filters by setting the server\_audit\_reload\_filters system variable to `ON`:
```sql
SET GLOBAL server_audit_reload_filters=ON;
```
MariaDB Enterprise Audit does not track changes to user accounts. If you delete or rename a user account, the change doesn't cascade to the Audit Filter. The Audit Filters must be updated manually.
## System Tables for Audit Filters
There are two system tables for Audit Filters:
System Table
Description
mysql.server_audit_filters
Audit Filter definitions with MariaDB Enterprise Audit
mysql.server_audit_users
Audit Filter assignments for user accounts with MariaDB Enterprise Audit.