mysql 系統審計日誌格式說明:

寫 audit_log  檔案 日誌格式: 

[timestamp],[serverhost],[username],[host],[connectionid],
[queryid],[operation],[database],[object],[retcode]

寫 syslog   檔案格式: 

[timestamp][syslog_host][syslog_ident]:[syslog_info][serverhost],[username],[host],
[connectionid],[queryid],[operation],[database],[object],[retcode]

Item logged	Description
timestamp	Time at which the event occurred. If syslog is used, the format is defined by  syslogd.
syslog_host	Host from which the syslog entry was received.
syslog_ident	For identifying a system log entry, including the MariaDB server.
syslog_info	For providing information for identifying a system log entry.
serverhost	The MariaDB server host name.
username	Connected user.
host	Host from which the user connected.
connectionid	Connection ID number for the related operation.
queryid	Query ID number, which can be used for finding the relational table events and related queries. For TABLE events, multiple lines will be added.
operation	Recorded action type: CONNECT, QUERY, READ, WRITE, CREATE, ALTER, RENAME, DROP.
database	Active database (as set by  ).
object	Executed query for QUERY events, or the table name in the case of TABLE events.
retcode	Return code of the logged operation.

參考連結: 

mariadb.com/kb/en/mariadb-audit-plugin-configuration/

mariadb.com/kb/en/mariadb-audit-plugin/

mariadb.com/kb/en/mariadb-audit-plugin-installation/

mariadb.com/kb/en/mariadb-audit-plugin-log-settings/

mariadb.com/kb/en/mariadb-audit-plugin-log-format/