Architectural Implementation of JSON-Based Audit Log Filtering in MySQL 8.4 (LTS)

The transition to MySQL 8.4 Long-Term Support (LTS) introduces a paradigm shift in database telemetry through the deprecation of the legacy audit_log_plugin in favor of the component_audit_log_filter. This modular component provides granular telemetry control, allowing Database Administrators (DBAs) to mitigate I/O overhead by applying sophisticated logic to event capture. Effective auditing is not merely a compliance checkbox but a critical security vector for monitoring privilege escalation, unauthorized Data Definition Language (DDL) execution, and anomalous user behavior.

Key Takeaways

JSON-Defined Granularity: The new filtering engine utilizes JSON structures to define complex logic gates for event inclusion or exclusion.
Performance Optimization: Asynchronous logging strategies decouple query execution from disk I/O, minimizing the performance penalty of high-volume auditing.
Telemetry Format Shift: Transitioning from XML to JSON storage facilitates seamless integration with modern observability stacks.
LTS Compliance: MySQL 8.4 establishes the Audit Log Filter as the default standard, necessitating a migration from legacy plugin-based configurations.

Audit Plugin vs. The New Audit Log Filter

The legacy audit plugin operated primarily as a monolithic capture tool with limited filtering capabilities. In contrast, the MySQL 8.4 Audit Log Filter introduces a decoupled architecture where the filtering engine processes events based on dynamic rules stored in system tables. This reduces technical debt and enhances system stability.

Technical Feature	Legacy Audit Plugin (v8.0)	Audit Log Filter (v8.4+)
Framework	Static Plugin	Extensible Component
Filter Logic	Limited/Global	JSON-based/User-specific
I/O Methodology	Synchronous Bias	Optimized Asynchronous Buffer
Log Schema	XML Bloat	Parsed JSON Struct
User-based Filters	Not Supported	Fully Supported

How to Install the Audit Log Filter

Step 1: Install the Component

The audit filter is deployed as a server component rather than a traditional plugin. Execute the following command to load the component into the server's runtime environment:

INSTALL COMPONENT 'file://component_audit_log_filter';

Step 2: Verify the Installation

Post-installation validation is performed by inspecting the global system variables. This ensures the component is active and the filtering engine is ready to receive rule definitions.

Understanding Key Configuration Variables

The efficiency of the audit log is primarily governed by the write strategy. Choosing the correct strategy involves balancing data durability with system throughput requirements.

Audit_log_filter.strategy

ASYNCHRONOUS (Default): Events are queued in a memory buffer before being flushed to disk. This maximizes performance by batching I/O operations.
SYNCHRONOUS: Every event is written directly to the storage layer before returning control to the client, providing maximum durability.

Extended Parameters

audit_log_filter.buffer_size: Defines the memory allocation for asynchronous queuing.
audit_log_filter.compression: Enables log file compression to optimize storage utilization.
audit_log_filter.format: Specifies the output format; "NEW" utilizes the JSON-structured schema.

Creating and Assigning Filters

Filters are defined using JSON syntax and managed via built-in system functions. This allows for specific exclusion or inclusion of events based on class and command types.

SELECT audit_log_filter_set_filter(
  'ddl_only',
  '{ "filter": { "rule": { "event_class": "query", "command_class": ["create","alter","drop"], "log": true } } }'
);
SELECT audit_log_filter_set_user('%', 'ddl_only');

Technical FAQ

What are the primary advantages of LFP chemistry in 2026 budget models?

LFP (Lithium Iron Phosphate) offers superior thermal stability and a cycle life of over 3,000 full charge/discharge cycles compared to approximately 1,500 for traditional NMC. This significantly reduces long-term degradation risk.

How does the 2026 German subsidy affect international manufacturers?

The 2026 framework is country-neutral, allowing all manufacturers to qualify as long as the vehicle meets specific energy efficiency and price ceiling criteria (typically under 35,000 EUR for the maximum subsidy).

Why is the NEDC range still used in some entry-level specifications?

While WLTP is the European standard, some markets continue to cite NEDC for consistency with legacy data. Engineers typically apply a conversion factor of 0.70 to 0.75 to estimate real-world range performance.