Enterprise Audit Log Destinations and Format
Send MariaDB Enterprise Audit output to a file or to syslog, configure log path and rotation, and parse the audit log record format.
Audit Log Destinations
MariaDB Enterprise Audit writes audit log messages either to a dedicated audit log file or to the system log (syslog), depending on configuration.
The audit log destination is configured with the server_audit_output_type system variable:
Audit Logging to File
MariaDB Enterprise Audit writes audit log messages to a dedicated audit log file when the server_audit_output_type system variable is set to FILE.
Audit Log Path
The path to the dedicated audit log file is configured with the server_audit_file_path system variable. The path can be a relative or absolute path. If it is a relative path, then it will be relative to the datadir. For example, to set the path to mariadb-enterprise-audit.log with the SET GLOBAL statement:
SET GLOBAL server_audit_file_path = 'mariadb-enterprise-audit.log'When a system variable is dynamically changed with the SET GLOBAL statement, the change does not survive server restarts. To ensure that the new path is used when the server restarts, set the server_audit_file_path system variable in a configuration file:
[mariadb]
server_audit_file_path=mariadb-enterprise-audit.logAudit Log Rotation
When MariaDB Enterprise Audit is configured to use the dedicated audit log file, it can rotate the file.
The file is rotated when its size exceeds the size specified by the server_audit_file_rotate_size system variable. For example, to set the maximum log size to 2 GB with the SET GLOBAL statement:
When a system variable is dynamically changed with the SET GLOBAL statement, the change does not survive server restarts. To ensure that the new file rotation size is used when the server restarts, set the server_audit_file_rotate_size system variable in a configuration file:
The file can also be rotated manually by setting the server_audit_file_rotate_now system variable to ON. For example, to rotate the log with the SET GLOBAL statement:
Audit Logging to System Log
MariaDB Enterprise Audit writes audit log messages to the system log (syslog) when the server_audit_output_type system variable is set to SYSLOG.
It can be very useful to configure audit logging to the syslog when your system's syslog is configured to securely transmit logs to a remote syslog server.
System Log Parameters
Several syslog parameters can be changed for MariaDB Enterprise Audit by setting the following system variables:
Audit Log Format
The audit log format for MariaDB Enterprise Audit depends on the audit log destination.
Formal Specification
When MariaDB Enterprise Audit is configured to use a dedicated file, it records events in a comma-separated (CSV) format. For tool developers, it is critical to use standardized field mappings to correlate audit data with other server logs.
Template: <timestamp>,<serverhost>,<username>,<host>:<port>,<connectionid>,<queryid>,<operation>,<database>,<object>,<retcode>,<tlsversion>
2
serverhost
String
The hostname of the server instance.
3
username
String
The MariaDB user account triggering the event.
4
host:port
String
The client host from which the user connected, followed by a colon and the client's TCP port. The port is written as unavailable when the client did not connect over TCP/IP, such as over a Unix socket or a named pipe. The port was added in MariaDB Enterprise Server 12.3.
5
connectionid
Unsigned Int
Standardized: Thread ID. Matches the Thread ID in Error, General, and Slow logs.
6
queryid
Unsigned Int
A unique identifier for the specific query. Used to link Query and Table events.
7
operation
String
The type of action (e.g., CONNECT, QUERY, WRITE).
8
database
String
The name of the database being accessed.
9
object
String
The specific table or object involved in the operation.
10
retcode
Integer
The return code; 0 indicates success, non-zero indicates an error code.
11
tlsversion
String
The TLS version negotiated for the connection, such as TLSv1.3. Present only on connection events, and empty when the connection is not encrypted. Added in MariaDB Enterprise Server 12.3.
Changed in MariaDB Enterprise Server 12.3
Two changes to the log format require updates to tools that parse the audit log:
The
hostfield now contains a colon and the client port.Connection event records carry an eleventh field. Records for all other operations still end at
retcode.
Milliseconds Precision Timestamps
Auditing regulations and standards require auditing logs with timestamps recording fractions of a second and timezone information. To fulfill this requirement, MariaDB Enterprise Audit uses the system log (syslog) via the server_audit_output_type option, where the timestamp format is controlled by the syslog setting.
To define the format of the timestamp:
Configure
server_audit_output_type=file.Set the
server_audit_timestamp_formatsystem variable in a configuration file (it is read-only at runtime), changing its default of%Y%m%d %H:%i:%s(which assures compatibility) to something including milliseconds (%f) and time zone information (%z), like%Y%m%dT%H:%i:%s.%f%z.
This results in audit log entries like these:
Value Mapping for Operations
To build accurate filters and parsers, the <operation> field corresponds to the following standardized event types:
CONNECT
Successful user authentication and connection.
FAILED_CONNECT
Authentication failures or denied access.
DISCONNECT
Session termination.
QUERY
Direct execution of a SQL statement.
READ
Table read access (e.g., SELECT).
WRITE
Table modification (e.g., INSERT, UPDATE, DELETE).
AUDIT_CONFIG
Changes to audit settings via SET GLOBAL or log rotation.
Audit Log Format with Syslog
When configured to use SYSLOG, the standard CSV line is prefixed with syslog metadata: <timestamp> <syslog_host> <syslog_ident>: <syslog_info> [Standard CSV Fields]
This page is: Copyright © 2026 MariaDB. All rights reserved.
Last updated
Was this helpful?