Re: MySQL Audit Excluding delete logs on one table
Hi Krzysiek,
excluding logs of the queries that contain "WHERE" clause is not possible.
What I could propose is to define a filter that does following:
1. Wait for the event that signals deletion from the 'c' table.
2. Set a new filter that does not log general/status filter.
3. Set a previous filter that does the process from the beginning.
'{ "filter": { "id": "main",
"class": [ { "name": "table_access",
"event": { "name": "delete",
"log": false,
"filter" : { "class" : { "name" : "general",
"event": { "name": "status",
"log": false,
"filter": { "ref": "main" } } },
"activate" : { "field": { "name": "table_name.str",
"value": "c" } } } } },
{ "name": "general",
"event": { "name": "status",
"log": { "field": { "name": "general_sql_command.str",
"value": "delete" } } } } ] } }'
The filter may look complex, but I will try to describe how it works:
1. Audit Log plugin logs table_access events that signal table read, insert, delete and update. SELECT * FROM `a`,`b`,`c` statement will generate three table_access/read events. Eventually general/status event will appear at the end. What we do in the filter is we wait for the table_access/delete event.
2. When the table_access/read is generated we replace the filter with a new filter (if the table name condition is met) that just waits for general/status event, which is not logged. The purpose of handling this event is not to log general/status event.
3. Additionally we set the old filter ("filter": { "ref": "main" }) that restarts the process of handling events.
I hope that will satisfy your needs for a while.
Marek Szymczak
MySQL Software Engineer