# Audit Log Filter format - XML (old style) The old style XML format uses `` tag as the root element and adds the `` tag when the file closes. Each audited event is contained in an element. The order of the attributes within an can vary. Certain attributes are in every element. Other attributes are optional and depend on the type of audit record. ```xml ``` The required attributes are the following: HTML Table Generator
Attribute Name
Description
 NAME  The action that generated the audit record.
 RECORD_ID  The RECORD_ID consists of a sequence number and a timestamp value. The sequence number is initialized when the plugin opens the audit log filter file.
 TIMESTAMP  Displays the date and time when the audit event happened.
The optional attributes are the following: HTML Table Generator
Attribute Name
Description
COMMAND_CLASS
 Type of action performed
CONNECTION_ID Client connection identifier
CONNECTION_TYPE Connection security type
DB Database name
HOST Client's hostname
IP Client's IP address
MYSQL_VERSION Server version
OS_LOGIN The user name used during an external authentication, for example, if the user is authenticated through an LDAP plugin. If the authentication plugin does not set a value or the user is authenticated using MySQL authentication, this value is empty.
OS_VERSION Server's operating system
PRIV_USER The user name used by the server when checking privileges. This name may be different than USER.
PROXY_USER The proxy user. If a proxy is not used, the value is empty.
SERVER_ID Server Identifier
SQLTEXT SQL statement text
STARTUP_OPTIONS Server startup options, either command line or config files
STATUS Command's status - a 0 (zero) is a success, a non-zero is an error
STATUS_CODE A 0 (zero) is a success, a non-zero is an error
TABLE Table name
USER  Client's user name - this name may be different than PRIV_USER.
VERSION Format of audit log filter