The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →On MySQL 8.4, authentication logging is configured on the server with MySQL Enterprise Audit, not in a client application. Enable the audit-log component or plugin available in your edition, create a filter for the connection event class, and assign that filter to the accounts you need to monitor. The following filter records connection activity for accounts covered by the default assignment:
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
SET @f = '{ "filter": { "class": { "name": "connection" } } }';
SELECT audit_log_filter_set_filter('log_conn_events', @f);
SELECT audit_log_filter_set_user('%', 'log_conn_events');Use a controlled successful login and a deliberately failed login to verify the result, then protect the audit destination as sensitive security data.
As an Amazon Associate I earn from qualifying purchases.
Free tools Windows power users keep installed
One-click scans. No signup required.
What MySQL authentication logging records
Authentication logging is an audit-log configuration task on the MySQL server. A client-side driver, command-line option, or application log cannot provide a complete record of what the server accepted, rejected, or subsequently disconnected.
MySQL Enterprise Audit represents connection activity as auditable events. A connection event can include the event status, connection ID, supplied user name, authenticated user, and proxy or external-user fields. Those fields let you distinguish an unsuccessful password attempt from a successful connection made through a proxy account or external authentication path.
#1 Best Overall
For MySQL 8.4, the practical approach is the audit-log component or plugin supplied for the server edition. The component’s filtering model is account based. Oracle’s documentation says that, by default, no accounts have a filter assigned, so no auditable events are processed for any account until you configure one.
Choose the implementation before changing the server
First establish which MySQL release and server edition you operate. The component and plugin installation or activation procedure depends on that edition. Do not copy an installation command intended for a different distribution into production; use the Enterprise Audit installation instructions that match your server package, then return to the filter steps below.
Questions to answer
- Is the server running MySQL 8.4 or an older release?
- Is the audit-log component or legacy audit plugin installed and available?
- Do you want every connection event, only failed connections, or a narrower set of connection activity?
- Should the policy apply to all accounts that have no named filter, or only to selected accounts?
- Who is allowed to administer filters and read the resulting files?
Authentication logging can produce more events than a failed-login report. Decide the event scope and retention period before enabling it so that the output remains useful and the storage and access controls are ready.
Confirm administrative privileges
The documented audit-filter functions require AUDIT_ADMIN or the deprecated SUPER privilege. A separate runtime change to audit_log_disable requires AUDIT_ADMIN together with SYSTEM_VARIABLES_ADMIN, or the deprecated SUPER. Grant the least privilege needed for the task and avoid using a broad administrative account for routine log inspection.
Enable a connection filter in MySQL 8.4
1. Install or enable the audit-log component or plugin
Install or enable MySQL Enterprise Audit according to the server edition and package documentation. The exact activation method is edition-specific; the important check is that the audit-log component or plugin is loaded before you call its filter functions. If the functions are unknown, the audit implementation is not installed, or the server reports that the component is unavailable, stop and correct that installation rather than repeatedly submitting filter statements.
After activation, identify the configured audit-log destination. You will need that location for verification, permissions, retention, and forwarding decisions. The destination may be a file or another output selected by the audit implementation and server configuration.
2. Define a JSON filter for connection events
Run the following statements with an account holding the required audit administration privilege:
SET @f = '{ "filter": { "class": { "name": "connection" } } }';
SELECT audit_log_filter_set_filter('log_conn_events', @f);The first statement stores a JSON document in a session variable. The filter names the connection class, which is the class used for connection activity rather than general statement auditing. The second statement creates or replaces the named filter, log_conn_events.
A filter definition is separate from filter assignment. Creating log_conn_events does not make it active for any account; the server needs an account assignment before it processes events.
3. Assign the filter to the default account scope
To apply the filter to accounts without a more specific assignment, run:
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11SELECT audit_log_filter_set_user('%', 'log_conn_events');In this documented use, the percent account assignment is the default-account assignment. It covers connection activity for accounts that do not have a more specific filter. A named account assignment can override the default, so review existing assignments before assuming that every account follows the same policy.
The assignment records connection activity such as connect, change-user, and disconnect events. It does not mean that every account has been individually listed; it establishes the fallback policy for accounts without a named assignment.
4. Keep filter creation and assignment in your change record
Record the filter name, JSON definition, assignment scope, operator, time, and intended retention. If a later administrator sees connection events but cannot identify why they are being collected, the audit configuration itself has become an operational gap. Treat filter changes as security changes and review them like other access-control modifications.
Verify successful and failed authentication events
Verification should be performed in a non-production environment first, or during an approved maintenance window if no test environment exists. A configuration that loads without SQL errors can still be assigned to the wrong scope or write to a destination no one is monitoring.
- Record the starting state. Note the active filter name, assignment scope, audit destination, and current file size or event position.
- Make a controlled successful connection. Use a test account from the scope covered by the assignment. Record the approximate time, client address if available to your monitoring process, and the connection ID returned by the session.
- Make a controlled failed connection. In a test environment, submit an intentionally invalid credential for a test account. Do not create repeated failures against a production identity; lockout or delay controls may react to them.
- Inspect the configured audit destination. Locate events around the test times and confirm that the status distinguishes the successful and failed attempts. Check the supplied user, authenticated user, connection ID, and proxy or external-user fields when those fields apply.
- Test an account outside the default scope if one exists. A named assignment may override the default. Confirm that the observed behavior matches the intended account policy rather than assuming the percent assignment applies universally.
- Document the result. Save the test time, account scope, observed event status, and the log location. Remove temporary test accounts and credentials after verification.
If no event appears, check the assignment first, then the component status, destination path, file permissions, and the time range used for inspection. Also check whether a more specific account assignment overrides the default.
Choose the connection-event scope
Legacy audit-log filtering exposes a connection policy with three values. These values are useful when that implementation is present, but a component filter is generally the more flexible choice for new MySQL 8.4 configurations.
| Policy | Events recorded | When it fits |
|---|---|---|
ALL |
All connection events | Investigations and environments where connect, change-user, and disconnect history is required. |
ERRORS |
Only failed connection events | Focused failed-login monitoring when successful-session history is not required. |
NONE |
No connection events | Temporarily suppressing connection-event collection in a legacy configuration; this is not an authentication-monitoring policy. |
With a component filter, use the connection class and account assignments to express the scope. This allows a default policy and more specific account policies instead of forcing one connection setting on every account.
Understand the older audit_log_policy=LOGINS approach
Older configurations may use audit_log_policy=LOGINS to record only login events. MySQL documents this variable as deprecated and startup-only. It is therefore a poor choice for a new deployment: changing it requires a server restart, and it does not provide the account-based flexibility of component filters.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →If you inherit a server using audit_log_policy=LOGINS, capture the current behavior before migrating. Identify the startup configuration, restart procedure, existing log destination, and any downstream parser that expects the legacy event format. Plan the migration as a controlled configuration change rather than deleting the old setting while the audit component is still unverified.
Legacy versus component configuration
| Comparison point | Component filter | Legacy settings |
|---|---|---|
| Version and availability | Use the audit-log component or plugin available for the MySQL edition; availability must be checked on the server. | May be present on older installations or retained for compatibility. |
| Event scope | Targets the connection class and can be assigned by account scope. |
audit_log_connection_policy uses ALL, ERRORS, or NONE; audit_log_policy=LOGINS records login events. |
| Account scope | Default assignment plus more specific account assignments. | Policy is not the same account-filter model. |
| Configuration timing | Filter creation and assignment use SQL functions at runtime. | audit_log_policy is documented as startup-only; other legacy variable behavior depends on the setting and server version. |
| Privileges | Audit-filter functions require AUDIT_ADMIN or deprecated SUPER. |
Administrative requirements depend on the variable or plugin operation. |
| Operational handling | Protect the audit destination, define retention, and validate forwarding. | Apply the same protection requirements while preserving any legacy parser or restart process. |
Use Connection Control for failed-login visibility and delay
The Connection Control component or plugin complements audit logging. It exposes failed-login information through INFORMATION_SCHEMA.CONNECTION_CONTROL_FAILED_LOGIN_ATTEMPTS and can add delays after repeated failures.
Connection Control answers a different operational question from the audit log. Its failed-attempt information and delay behavior help identify repeated failures and slow brute-force activity. The audit log provides the broader event record, including successful connections and connection lifecycle events when your filter captures them. Enabling Connection Control does not remove the need to configure an audit filter if you need a durable authentication audit trail.
A practical combined design
- Use the audit-log component to record the connection events required for investigation and compliance.
- Use Connection Control to observe repeated failed attempts and apply configured delay behavior.
- Correlate the failed-attempt view with audit events by account, time, connection information, and status.
- Keep alerting thresholds and response actions separate from the audit filter so a change in alert policy does not silently disable evidence collection.
Protect audit files and plan retention
Audit records may contain sensitive information, including SQL text and identity data. Oracle’s security guidance says that audit log files should be written to a directory accessible only to the MySQL server and users with a legitimate reason to view the log.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Filesystem and operating-system controls
- Place the destination in a directory that is not broadly readable by local users or unrelated services.
- Grant read access only to the MySQL service account, the smallest approved security or operations group, and any controlled log-forwarding process.
- Prevent application containers, web workers, and ordinary database users from reading the raw files unless there is a documented need.
- Include the audit directory in host monitoring so unexpected permission or ownership changes generate an alert.
Retention and forwarding
Set a retention period that matches your incident-response and regulatory requirements, then verify that rotation does not remove records before they are forwarded or backed up. If logs are sent to a SIEM, use protected transport and restrict who can read the forwarded copy. The forwarding destination inherits the sensitivity of the original audit file.
Do not treat a full disk as an acceptable way to control audit volume. A failed write can remove the visibility you enabled the audit system to provide. Monitor free space, file growth, rotation, forwarding lag, and parser errors.
Separate administration from investigation
The person who can change filters should not automatically be the only person who can investigate every event. Use role separation where practical: one tightly controlled role administers the component and assignments, while an approved monitoring role reads the output through a controlled pipeline.
Troubleshoot missing or unexpected login events
| Symptom | Likely cause | Check and remedy |
|---|---|---|
| The filter function is unknown or unavailable. | The audit component or plugin is not installed, enabled, or compatible with the server edition. | Verify the server version and edition, install or enable the supported Enterprise Audit implementation, and rerun the documented status checks. |
| The filter exists but no events are recorded. | No account assignment is active, or the tested account has no applicable assignment. | Inspect filter assignments and apply the default or named assignment required for the test account. |
| The default assignment appears to be ignored. | A more specific account assignment overrides the default. | Review named assignments for the account and change the specific assignment if that is the intended policy. |
| Failed attempts appear, but successful sessions do not. | The active policy is limited to errors or failed-login monitoring. | Use a component filter that captures the connection class or select the legacy ALL policy when that legacy implementation is intentionally retained. |
| Events exist but cannot be read by the monitoring process. | Filesystem permissions, ownership, rotation, or forwarding credentials are incorrect. | Grant only the approved read access, test rotation and forwarding, and keep the raw directory restricted. |
| The setting changed only after a restart. | An older startup-only variable such as audit_log_policy is still in use. |
Plan a migration to runtime component filters and update the startup configuration only during an approved change. |
| Repeated failures trigger delays or unexpected behavior. | Connection Control is applying its failed-login and delay policy. | Inspect INFORMATION_SCHEMA.CONNECTION_CONTROL_FAILED_LOGIN_ATTEMPTS, use a test account, and coordinate the delay policy with incident-response procedures. |
Operational checklist after activation
- Confirm the audit implementation is loaded on every MySQL server that accepts client connections, including replicas or separate read/write endpoints where authentication occurs.
- Record the active filter definition and account assignments in the server configuration record.
- Test one successful and one failed connection using non-production credentials.
- Confirm event status, supplied user, authenticated user, connection ID, and proxy or external-user fields where relevant.
- Check that the audit destination is protected and that the monitoring pipeline can read only the approved copy.
- Test rotation, retention, forwarding, and alerting before relying on the logs for an incident.
- Review filter assignments after account changes, proxy-authentication changes, and server upgrades.
- Remove test identities and temporary permissions.
Which configuration should you use?
For a new MySQL 8.4 deployment, use the audit-log component or plugin supported by the server edition, define a JSON filter for the connection class, and assign it to the required account scope. Use a default assignment when accounts without named policies should be covered, then add specific assignments only where their logging needs differ.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteRetain a legacy ERRORS policy only when you deliberately need failed connection events from an existing legacy implementation. Choose ALL there when the investigation requires the full connection lifecycle, and do not use NONE as a substitute for a monitoring policy. Treat audit_log_policy=LOGINS as a migration candidate because it is deprecated and startup-only.
Add Connection Control when you need failed-login counters or delay behavior. It improves detection and resistance to repeated attempts, but it is complementary: it does not replace the audit record generated by Enterprise Audit.
Conclusion
To enable authentication logging in MySQL 8.4, activate the supported Enterprise Audit implementation, create the connection JSON filter, assign it with audit_log_filter_set_user, and verify both successful and failed test connections. Keep the audit destination private, retain it deliberately, and use Connection Control alongside—not instead of—the audit log when you need failed-login counters and brute-force delays.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
