When full auditing is activated with the the MariaDB Audit Plugin a large volume of audit data is generated and it can put an extra burden on the server. The MariaDB audit plugin offers the two following setup variables that allow to restrict what data will be logged.
MariaDB [test]> show variables like '%audit%users'; +-----------------------------+-----------------------+ | Variable_name | Value | +-----------------------------+-----------------------+ | server_audit_excl_users | | | server_audit_incl_users | | +-----------------------------+-----------------------+ 14 rows in set (0.00 sec)
These variables allow to restrict the data that is going to be pushed to the audit log.
You can say: I only want to log data from these users
MariaDB [test]> set global server_audit_syslog_incl_users='proxy';
Only activities coming from the user 'proxy' will be logged.
Or you can say : I want to log data except for these users.
MariaDB [test]> set global server_audit_excl_users='user2';
No activities coming from the user 'user2' will be logged.
What happens if a user is both included and excluded ? If a user is both included and excluded database activities for that user will be logged. Include has priority over exclude. It is important to notice that the audit plugin logs data only based on the username. This username is different from the MariaDB and MySQL user definition. For them a user is combination of the username and hostname ('user'@'host').
This capability to filter audit data is crucial to avoid too much burden on the audited server and to avoid generating too much volume of audit data.