Percona Audit - Plugin

/var/log/mysql/audit.log daily rotate 30 compress delaycompress postrotate mysql -e "SET GLOBAL audit_log_rotate = ON;" endscript

"class": "table_access", "command": ["DROP", "ALTER", "TRUNCATE"], "log": true percona audit plugin

SHOW STATUS LIKE 'audit_log%'; -- e.g., audit_log_current_size, audit_log_buffer_size, audit_log_lost_events (critical): /var/log/mysql/audit

Apply filter:

(if using syslog or custom paths):

SET GLOBAL audit_log_logging_events = 'connect,query,table_access'; : " endscript "class": "table_access"

-- Apply simple filter: log only failed logins + DROP/ALTER SET GLOBAL audit_log_filter = ' "filter": "class": "general", "event": "status", "log": false , "rule": [