> For the complete documentation index, see [llms.txt](https://mariadb.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://mariadb.com/docs/server/reference/plugins/mariadb-enterprise-audit.md).

# MariaDB Enterprise Audit

The MariaDB Enterprise Audit plugin logs detailed data access and configuration changes, offering advanced filtering to meet security and compliance requirements.

## Overview

While application design specifications and database configurations may intend specific limitations to be placed around access to data, audit mechanisms help confirm the effectiveness of these controls.

MariaDB Enterprise Audit is a plugin that logs data access and database operations.

Audit mechanisms are most effective when they produce a manageable quantity of output. MariaDB Enterprise Audit includes advanced filtering features to enable narrowly defining which information is logged.

Where audit mechanisms may only be effective when control parameters can also be audited, MariaDB Enterprise Audit implements logging of configuration changes.

{% hint style="danger" %}
**Plugin Conflict (**[MENT-316](https://jira.mariadb.org/browse/MENT-316)**)**

The MariaDB Enterprise Audit plugin (`server_audit2.so`) is incompatible with the older server\_audit.so (`v1`) plugin. Running both can cause server instability or deadlocks.

*If you are a new user: You can continue reading.*

*If you are migrating: You must remove the old `v1` plugin. Go directly to* [*Upgrading to Enterprise Audit*](/docs/server/reference/plugins/mariadb-enterprise-audit/mariadb-enterprise-audit-upgrades.md) *for complete instructions.*
{% endhint %}

## Configuration Overview

MariaDB Enterprise Audit is installed and loaded by default. If you are unsure whether it is loaded on your system, you can [confirm that the plugin is loaded](/docs/server/reference/plugins/mariadb-enterprise-audit/mariadb-enterprise-audit-installation.md#confirm-the-audit-plugin-is-loaded).

To use MariaDB Enterprise Audit, the plugin must be configured: Administrators must define [Audit Filters](/docs/server/reference/plugins/mariadb-enterprise-audit/mariadb-enterprise-audit-filters.md) to configure what MariaDB Enterprise Audit writes to the audit log.

MariaDB Enterprise Audit supports two types of Audit Filters:

| Audit Filter Type                                                                                                                        | Used For                                                                                         |
| ---------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------ |
| [Default Audit Filter](/docs/server/reference/plugins/mariadb-enterprise-audit/mariadb-enterprise-audit-filters.md#default-audit-filter) | The Default Audit Filter is used for any user account that is not assigned a Named Audit Filter. |
| [Named Audit Filters](/docs/server/reference/plugins/mariadb-enterprise-audit/mariadb-enterprise-audit-filters.md#named-audit-filters)   | Named Audit Filters are assigned to specific user accounts.                                      |

Administrators can define Audit Filters to audit log activity using multiple types of filters:

| Filter Type                                                                                                                        | Used For                                                                                                                                                                                                                                                                                                     |
| ---------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| [Event Filters](/docs/server/reference/plugins/mariadb-enterprise-audit/mariadb-enterprise-audit-filter-types.md#event-filters)    | Event Filters are used to enable or disable audit logging for specific types of operations performed by the user accounts assigned to the Audit Filter.                                                                                                                                                      |
| [Logging Filters](/docs/server/reference/plugins/mariadb-enterprise-audit/mariadb-enterprise-audit-filter-types.md#logging-filter) | Logging Filters are used to enable or disable audit logging for the user accounts assigned to the Audit Filter.                                                                                                                                                                                              |
| [Object Filters](/docs/server/reference/plugins/mariadb-enterprise-audit/mariadb-enterprise-audit-filter-types.md#object-filters)  | Object Filters are used to enable or disable audit logging for specific databases or tables accessed by the user accounts assigned to the Audit Filter. Support for Object Filters was added in MariaDB Enterprise Server 10.6. Support for Object Filters was backported to ES 10.4.21-13 and ES 10.5.12-8. |

Administrators must [start audit logging](/docs/server/reference/plugins/mariadb-enterprise-audit/mariadb-enterprise-audit-installation.md#start-audit-logging).

## General Operation

MariaDB Enterprise Audit performs audit logging during typical operations of MariaDB Enterprise Server:

* When a user connects, fails to connect, or disconnects, MariaDB Enterprise Audit will write a message to the audit log if the Audit Filter specifies the specific type of [Connect Event](/docs/server/reference/plugins/mariadb-enterprise-audit/mariadb-enterprise-audit-filter-types.md#connection-events).
* When a user executes a query, MariaDB Enterprise Audit will write a message to the audit log if the Audit Filter specifies the specific type of [Query Event](/docs/server/reference/plugins/mariadb-enterprise-audit/mariadb-enterprise-audit-filter-types.md#query-events) and if the queried objects are not excluded by [Object Filters](/docs/server/reference/plugins/mariadb-enterprise-audit/mariadb-enterprise-audit-filter-types.md#object-filters).
* When a query accesses a table, MariaDB Enterprise Audit will write a message to the audit log if the Audit Filter specifies the specific type of Table Event and if the table is not excluded by [Object Filters](/docs/server/reference/plugins/mariadb-enterprise-audit/mariadb-enterprise-audit-filter-types.md#object-filters).
* When a query modifies the MariaDB Enterprise Audit configuration, MariaDB Enterprise Audit will write a message to the audit log if the Audit Filter specifies the [Audit Config Event](/docs/server/reference/plugins/mariadb-enterprise-audit/mariadb-enterprise-audit-filter-types.md#audit-config-events).
* When a user's [Audit Filter](/docs/server/reference/plugins/mariadb-enterprise-audit/mariadb-enterprise-audit-filter-types.md#logging-filter) contains a Logging Filter that disables audit logging, all audit logging for the user's activity will be skipped.

MariaDB Enterprise Audit writes audit log messages either to a dedicated [audit log file or to the system log (syslog)](/docs/server/reference/plugins/mariadb-enterprise-audit/mariadb-enterprise-audit-log-destinations-and-format.md#audit-log-destinations), depending on configuration.

Audit log messages that correspond to a query are logged when the query completes. If a query is executed in a transaction, the audit log messages that correspond to the query are logged when the individual query completes, not when the transaction completes. If the query fails, the audit log message is logged at time of failure.

## Audit Log Considerations

Care must be taken when logging data for audit to maintain alignment to business requirements. Concerns include:

* Queries should not be logged for tables containing Personally Identifiable Information (PII) or Sensitive PII (SPII) such as passwords, since audit log data is written unencrypted. Consider using [Object Filters](/docs/server/reference/plugins/mariadb-enterprise-audit/mariadb-enterprise-audit-filter-types.md#object-filters) to exclude sensitive information from the audit log.
* Backup of audit data should be performed at least as frequently as database backups.
* Audit log data on database servers could be tampered with if the database server is compromised. Consider secure transmission of log data to a hardened and remote logging server.
* Where audit data is mission-critical, it should be subject to controls, data protection, data retention, and highly-available storage as are used for other mission-critical data.

## In This Section

{% columns %}
{% column %}
{% content-ref url="/pages/sgYa3ejWdoU9JWeg7uBm" %}
[Enterprise Audit Installation and Setup](/docs/server/reference/plugins/mariadb-enterprise-audit/mariadb-enterprise-audit-installation.md)
{% endcontent-ref %}
{% endcolumn %}

{% column %}
Verify and load the MariaDB Enterprise Audit plugin, start audit logging, forbid its uninstallation, and understand its server startup behavior.
{% endcolumn %}
{% endcolumns %}

{% columns %}
{% column %}
{% content-ref url="/pages/AvLWG5J4ozGn1w6veVme" %}
[Enterprise Audit Filters](/docs/server/reference/plugins/mariadb-enterprise-audit/mariadb-enterprise-audit-filters.md)
{% endcontent-ref %}
{% endcolumn %}

{% column %}
Create, assign, query, and reload the Default and Named Audit Filters that control what MariaDB Enterprise Audit writes to the audit log.
{% endcolumn %}
{% endcolumns %}

{% columns %}
{% column %}
{% content-ref url="/pages/Q3YX1xFj0B7UxmpZ2uOB" %}
[Enterprise Audit Filter Types](/docs/server/reference/plugins/mariadb-enterprise-audit/mariadb-enterprise-audit-filter-types.md)
{% endcontent-ref %}
{% endcolumn %}

{% column %}
Reference for the Event Filters, Logging Filter, and Object Filters that make up a MariaDB Enterprise Audit filter rule, with examples.
{% endcolumn %}
{% endcolumns %}

{% columns %}
{% column %}
{% content-ref url="/pages/vJ1dqF0CWtYiluAbmHHJ" %}
[Enterprise Audit Log Destinations and Format](/docs/server/reference/plugins/mariadb-enterprise-audit/mariadb-enterprise-audit-log-destinations-and-format.md)
{% endcontent-ref %}
{% endcolumn %}

{% column %}
Send MariaDB Enterprise Audit output to a file or to syslog, configure log path and rotation, and parse the audit log record format.
{% endcolumn %}
{% endcolumns %}

{% columns %}
{% column %}
{% content-ref url="/pages/7FX6zdNFjW3uMBQ3uF9t" %}
[Enterprise Audit Error Log Messages](/docs/server/reference/plugins/mariadb-enterprise-audit/mariadb-enterprise-audit-error-log-messages.md)
{% endcontent-ref %}
{% endcolumn %}

{% column %}
Messages that MariaDB Enterprise Audit writes to the MariaDB error log when it loads, starts or stops logging, or rejects invalid filters.
{% endcolumn %}
{% endcolumns %}

{% columns %}
{% column %}
{% content-ref url="/pages/mkSZPguFeFGxF4HWmIHU" %}
[Upgrading to Enterprise Audit](/docs/server/reference/plugins/mariadb-enterprise-audit/mariadb-enterprise-audit-upgrades.md)
{% endcontent-ref %}
{% endcolumn %}

{% column %}
Uninstall the v1 MariaDB Audit Plugin and migrate its settings, filters, and user lists to MariaDB Enterprise Audit (v2).
{% endcolumn %}
{% endcolumns %}

<sub>*This page is: Copyright © 2026 MariaDB. All rights reserved.*</sub>

{% @marketo/form formId="4316" %}