From 1aba30b8f990148ac23f0069b59976920acd3d61 Mon Sep 17 00:00:00 2001
From: Hashim Syed <hashsyd@amazon.com>
Date: Tue, 4 Jun 2024 23:58:37 +0000
Subject: [PATCH] MDEV-12182 Add Client TCP Port Number to MySQL Audit Plugin
 Logs

In environments with load balancers or proxies, the audit plugin logs
only the IP address, making it difficult to differentiate individual client
connections from the same IP.

Add a new 'port' field to the appropriate event objects to capture the
client's TCP port number. Populate the port field with thd->port  in the
appropriate functions. The audit plugin receives and logs this port field
along  with  other connection information, enabling better identification
of individual client connections.

All new code of the whole pull request, including one or several files that
are either new files or modified ones, are contributed under the BSD-new license.
I am contributing on behalf of my employer Amazon Web Services, Inc.
---
 include/mysql/plugin_audit.h                  |   3 +
 include/mysql/plugin_audit.h.pp               |   3 +
 .../suite/plugins/r/server_audit.result       | 506 +++++++++---------
 .../plugins/r/thread_pool_server_audit.result | 302 +++++------
 .../plugins/t/thread_pool_server_audit.test   |   6 +-
 plugin/server_audit/server_audit.c            |  45 +-
 sql/sql_audit.h                               |  12 +
 7 files changed, 455 insertions(+), 422 deletions(-)

diff --git a/include/mysql/plugin_audit.h b/include/mysql/plugin_audit.h
index 588d82f2d34..a2aba9f7ead 100644
--- a/include/mysql/plugin_audit.h
+++ b/include/mysql/plugin_audit.h
@@ -66,6 +66,7 @@ struct mysql_event_general
   unsigned long long general_rows;
   /* Added in version 0x302 */
   unsigned long long query_id;
+  unsigned int port;
   MYSQL_CONST_LEX_STRING database;
 };
 
@@ -101,6 +102,7 @@ struct mysql_event_connection
   unsigned int host_length;
   const char *ip;
   unsigned int ip_length;
+  unsigned int port;
   MYSQL_CONST_LEX_STRING database;
   /* Added in version 0x303 */
   const char *tls_version;
@@ -139,6 +141,7 @@ struct mysql_event_table
   const char *proxy_user;
   const char *host;
   const char *ip;
+  unsigned int port;
   MYSQL_CONST_LEX_STRING database;
   MYSQL_CONST_LEX_STRING table;
   /* for MYSQL_AUDIT_TABLE_RENAME */
diff --git a/include/mysql/plugin_audit.h.pp b/include/mysql/plugin_audit.h.pp
index a746396f921..93efe24f4a1 100644
--- a/include/mysql/plugin_audit.h.pp
+++ b/include/mysql/plugin_audit.h.pp
@@ -718,6 +718,7 @@ struct mysql_event_general
   unsigned long long general_time;
   unsigned long long general_rows;
   unsigned long long query_id;
+  unsigned int port;
   MYSQL_CONST_LEX_STRING database;
 };
 struct mysql_event_connection
@@ -737,6 +738,7 @@ struct mysql_event_connection
   unsigned int host_length;
   const char *ip;
   unsigned int ip_length;
+  unsigned int port;
   MYSQL_CONST_LEX_STRING database;
   const char *tls_version;
   unsigned int tls_version_length;
@@ -752,6 +754,7 @@ struct mysql_event_table
   const char *proxy_user;
   const char *host;
   const char *ip;
+  unsigned int port;
   MYSQL_CONST_LEX_STRING database;
   MYSQL_CONST_LEX_STRING table;
   MYSQL_CONST_LEX_STRING new_database;
diff --git a/mysql-test/suite/plugins/r/server_audit.result b/mysql-test/suite/plugins/r/server_audit.result
index f48a3e6c499..cd2619576b6 100644
--- a/mysql-test/suite/plugins/r/server_audit.result
+++ b/mysql-test/suite/plugins/r/server_audit.result
@@ -322,259 +322,259 @@ server_audit_syslog_priority	LOG_INFO
 uninstall plugin server_audit;
 Warnings:
 Warning	1620	Plugin is busy and will be uninstalled on shutdown
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,test,'set global server_audit_logging=on',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,test,'set global server_audit_incl_users= repeat("\'root\',", 10000)',ID
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,test,'show variables like \'server_audit_incl_users\'',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,test,'set global server_audit_excl_users= repeat("\'root\',", 10000)',ID
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,test,'show variables like \'server_audit_excl_users\'',0
-TIME,HOSTNAME,root,localhost,ID,0,CONNECT,mysql,,0
-TIME,HOSTNAME,root,localhost,ID,0,DISCONNECT,mysql,,0
-TIME,HOSTNAME,no_such_user,localhost,ID,0,FAILED_CONNECT,,,ID
-TIME,HOSTNAME,no_such_user,localhost,ID,0,DISCONNECT,,,0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,test,'set global server_audit_incl_users=\'odin, dva, tri\'',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,test,'set global server_audit_incl_users=\'odin, root, dva, tri\'',0
-TIME,HOSTNAME,root,localhost,ID,ID,CREATE,test,t2,
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,test,'create table t2 (id int)',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,test,'set global server_audit_excl_users=\'odin, dva, tri\'',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,test,'SHOW WARNINGS',0
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,test,t1,
-TIME,HOSTNAME,root,localhost,ID,ID,READ,mysql,table_stats,
-TIME,HOSTNAME,root,localhost,ID,ID,READ,mysql,column_stats,
-TIME,HOSTNAME,root,localhost,ID,ID,READ,mysql,index_stats,
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,test,'insert into t1 values (1), (2)',0
-TIME,HOSTNAME,root,localhost,ID,ID,READ,test,t1,
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,test,'select * from t1',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,test,'set global server_audit_incl_users=\'odin, root, dva, tri\'',0
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,test,t2,
-TIME,HOSTNAME,root,localhost,ID,ID,READ,mysql,table_stats,
-TIME,HOSTNAME,root,localhost,ID,ID,READ,mysql,column_stats,
-TIME,HOSTNAME,root,localhost,ID,ID,READ,mysql,index_stats,
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,test,'insert into t2 values (1), (2)',0
-TIME,HOSTNAME,root,localhost,ID,ID,READ,test,t2,
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,test,'select * from t2',0
-TIME,HOSTNAME,root,localhost,ID,ID,ALTER,test,t1,
-TIME,HOSTNAME,root,localhost,ID,ID,RENAME,test,t1|test.renamed_t1,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,table_stats,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,column_stats,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,index_stats,
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,test,'alter table t1 rename renamed_t1',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,test,'set global server_audit_events=\'connect,query\'',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,test,'select 1,\n2,\n# comment\n3',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,test,'insert into t2 values (1), (2)',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,test,'select * from t2',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,test,'select * from t_doesnt_exist',ID
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,test,'syntax_error_query',ID
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,test,'drop table renamed_t1, t2',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,test,'show variables like \'server_audit%\'',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,test,'set global server_audit_mode=1',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,test,'set global server_audit_events=\'\'',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,test,'create database sa_db',0
-TIME,HOSTNAME,root,localhost,ID,0,CONNECT,test,,0
-TIME,HOSTNAME,root,localhost,ID,ID,CREATE,test,t1,
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,test,'create table t1 (id2 int)',0
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,test,t1,
-TIME,HOSTNAME,root,localhost,ID,ID,READ,mysql,table_stats,
-TIME,HOSTNAME,root,localhost,ID,ID,READ,mysql,column_stats,
-TIME,HOSTNAME,root,localhost,ID,ID,READ,mysql,index_stats,
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,test,'insert into t1 values (1), (2)',0
-TIME,HOSTNAME,root,localhost,ID,ID,READ,test,t1,
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,test,'select * from t1',0
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,table_stats,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,column_stats,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,index_stats,
-TIME,HOSTNAME,root,localhost,ID,ID,DROP,test,t1,
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,test,'drop table t1',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'use sa_db',0
-TIME,HOSTNAME,root,localhost,ID,ID,CREATE,sa_db,sa_t1,
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'create table sa_t1(id int)',0
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,sa_db,sa_t1,
-TIME,HOSTNAME,root,localhost,ID,ID,READ,mysql,table_stats,
-TIME,HOSTNAME,root,localhost,ID,ID,READ,mysql,column_stats,
-TIME,HOSTNAME,root,localhost,ID,ID,READ,mysql,index_stats,
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'insert into sa_t1 values (1), (2)',0
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,table_stats,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,column_stats,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,index_stats,
-TIME,HOSTNAME,root,localhost,ID,ID,DROP,sa_db,sa_t1,
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'drop table sa_t1',0
-TIME,HOSTNAME,root,localhost,ID,ID,READ,mysql,proc,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,proc,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,event,
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'drop database sa_db',0
-TIME,HOSTNAME,root,localhost,ID,0,DISCONNECT,,,0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,test,'create database sa_db',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'use sa_db',0
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,db,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,tables_priv,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,columns_priv,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,procs_priv,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,proxies_priv,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,roles_mapping,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,global_priv,
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'CREATE USER u1 IDENTIFIED BY *****',0
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,tables_priv,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,global_priv,
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'GRANT ALL ON sa_db TO u2 IDENTIFIED BY *****',0
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,global_priv,
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'SET PASSWORD FOR u1 = PASSWORD(*****)',0
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,db,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,tables_priv,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,columns_priv,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,procs_priv,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,proxies_priv,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,roles_mapping,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,global_priv,
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'CREATE USER u3 IDENTIFIED BY *****',0
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,global_priv,
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'ALTER USER u3 IDENTIFIED BY *****',0
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,db,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,tables_priv,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,columns_priv,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,procs_priv,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,proxies_priv,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,roles_mapping,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,global_priv,
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'drop user u1, u2, u3',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'create table t1(id int)',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'drop table t1',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'create procedure pr1() insert into test.t1 values ("foo", 42)',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'create function fn1(i int) returns int deterministic return i+1',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'drop procedure pr1',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'drop function fn1',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'create table t1(id int)',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'insert into t1 values (1), (2)',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'select * from t1',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'select 2',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'drop table t1',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'insert into t1 values (1), (2)',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'select * from t1',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'select 2',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'(select 2)',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'/*! select 2*/',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'/*comment*/ select 2',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'CREATE USER u1 IDENTIFIED BY *****',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'GRANT ALL ON sa_db TO u2 IDENTIFIED BY *****',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'SET PASSWORD \n# comment\nFOR u1 = PASSWORD(*****)',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'SET PASSWORD FOR u1=<secret>',ID
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'CREATE USER u3 IDENTIFIED BY *****',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'drop user u1, u2, u3',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'insert into t1 values (1), (2)',0
-TIME,HOSTNAME,user1,localhost,ID,ID,CREATE,sa_db,t1,
-TIME,HOSTNAME,user1,localhost,ID,ID,WRITE,sa_db,t1,
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'set global server_audit_logging= off',0
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,db,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,tables_priv,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,columns_priv,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,procs_priv,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,proxies_priv,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,roles_mapping,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,global_priv,
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'set global server_audit_events=\'\'',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'set global server_audit_incl_users=\'root, plug_dest, ssl_user1\'',0
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,db,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,tables_priv,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,columns_priv,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,procs_priv,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,proxies_priv,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,roles_mapping,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,global_priv,
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'CREATE USER plug IDENTIFIED WITH \'test_plugin_server\' AS \'plug_dest\'',0
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,db,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,tables_priv,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,columns_priv,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,procs_priv,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,proxies_priv,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,roles_mapping,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,global_priv,
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'CREATE USER plug_dest IDENTIFIED BY *****',0
-TIME,HOSTNAME,plug,localhost,ID,0,FAILED_CONNECT,,,ID
-TIME,HOSTNAME,plug,localhost,ID,0,DISCONNECT,,,0
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,proxies_priv,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,global_priv,
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'GRANT PROXY ON plug_dest TO plug',0
-TIME,HOSTNAME,plug,localhost,ID,0,CONNECT,,,0
-TIME,HOSTNAME,plug,localhost,ID,0,PROXY_CONNECT,,`plug_dest`@`%`,0
-TIME,HOSTNAME,plug,localhost,ID,ID,QUERY,,'select USER(),CURRENT_USER()',0
-TIME,HOSTNAME,plug,localhost,ID,0,DISCONNECT,,,0
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,db,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,tables_priv,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,columns_priv,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,procs_priv,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,proxies_priv,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,roles_mapping,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,global_priv,
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'DROP USER plug',0
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,db,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,tables_priv,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,columns_priv,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,procs_priv,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,proxies_priv,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,roles_mapping,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,global_priv,
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'DROP USER plug_dest',0
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,db,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,tables_priv,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,columns_priv,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,procs_priv,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,proxies_priv,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,roles_mapping,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,global_priv,
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'CREATE USER ssl_user1@localhost require SSL',0
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,tables_priv,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,global_priv,
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'GRANT ALL ON sa_db TO ssl_user1@localhost',0
-TIME,HOSTNAME,ssl_user1,localhost,ID,0,CONNECT,sa_db,TLS_VERSION,0
-TIME,HOSTNAME,ssl_user1,localhost,ID,ID,QUERY,sa_db,'SHOW STATUS LIKE \'Ssl_version\'',0
-TIME,HOSTNAME,ssl_user1,localhost,ID,ID,QUERY,sa_db,'select variable_value > \'\' as \'have_ssl\' from information_schema.session_status where variable_name=\'ssl_cipher\'',0
-TIME,HOSTNAME,ssl_user1,localhost,ID,0,DISCONNECT,sa_db,TLS_VERSION,0
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,db,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,tables_priv,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,columns_priv,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,procs_priv,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,proxies_priv,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,roles_mapping,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,global_priv,
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'DROP USER ssl_user1@localhost',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'set global serv',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'select (1), (2)',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'select \'A\', ',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'set global server_audit_query_log_limit= 1024',0
-TIME,HOSTNAME,root,localhost,ID,ID,READ,mysql,proc,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,proc,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,event,
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'drop database sa_db',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'select length(\'012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567',0
-TIME,HOSTNAME,root,localhost,ID,ID,CREATE,test,t1,
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'CREATE TABLE test.t1 (a char(4))',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'set sql_mode=""',0
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,test,t1,
-TIME,HOSTNAME,root,localhost,ID,ID,READ,mysql,table_stats,
-TIME,HOSTNAME,root,localhost,ID,ID,READ,mysql,column_stats,
-TIME,HOSTNAME,root,localhost,ID,ID,READ,mysql,index_stats,
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'insert into test.t1 value("12345")',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'SHOW WARNINGS',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'set sql_mode=default',0
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,table_stats,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,column_stats,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,index_stats,
-TIME,HOSTNAME,root,localhost,ID,ID,DROP,test,t1,
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'drop table test.t1',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'set global server_audit_file_path=\'.\'',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'set global server_audit_file_path=\'.\'',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'show status like \'server_audit_current_log\'',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'set global server_audit_file_path=\'\'',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'set global server_audit_file_path=\'\'',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'show status like \'server_audit_current_log\'',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'set global server_audit_file_path=\'  \'',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'set global server_audit_file_path=\'  \'',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'show status like \'server_audit_current_log\'',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'set global server_audit_file_path=\'nonexisting_dir/\'',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'set global server_audit_file_path=\'nonexisting_dir/\'',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'SHOW WARNINGS',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'show status like \'server_audit_current_log\'',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'show variables like \'server_audit%\'',0
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,plugin,
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'uninstall plugin server_audit',0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,test,'set global server_audit_logging=on',0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,test,'set global server_audit_incl_users= repeat("\'root\',", 10000)',ID
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,test,'show variables like \'server_audit_incl_users\'',0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,test,'set global server_audit_excl_users= repeat("\'root\',", 10000)',ID
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,test,'show variables like \'server_audit_excl_users\'',0
+TIME,HOSTNAME,root,localhost:unavailable,ID,0,CONNECT,mysql,,0
+TIME,HOSTNAME,root,localhost:unavailable,ID,0,DISCONNECT,mysql,,0
+TIME,HOSTNAME,no_such_user,localhost:unavailable,ID,0,FAILED_CONNECT,,,ID
+TIME,HOSTNAME,no_such_user,localhost:unavailable,ID,0,DISCONNECT,,,0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,test,'set global server_audit_incl_users=\'odin, dva, tri\'',0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,test,'set global server_audit_incl_users=\'odin, root, dva, tri\'',0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,CREATE,test,t2,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,test,'create table t2 (id int)',0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,test,'set global server_audit_excl_users=\'odin, dva, tri\'',0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,test,'SHOW WARNINGS',0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,test,t1,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,READ,mysql,table_stats,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,READ,mysql,column_stats,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,READ,mysql,index_stats,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,test,'insert into t1 values (1), (2)',0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,READ,test,t1,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,test,'select * from t1',0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,test,'set global server_audit_incl_users=\'odin, root, dva, tri\'',0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,test,t2,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,READ,mysql,table_stats,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,READ,mysql,column_stats,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,READ,mysql,index_stats,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,test,'insert into t2 values (1), (2)',0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,READ,test,t2,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,test,'select * from t2',0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,ALTER,test,t1,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,RENAME,test,t1|test.renamed_t1,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,mysql,table_stats,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,mysql,column_stats,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,mysql,index_stats,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,test,'alter table t1 rename renamed_t1',0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,test,'set global server_audit_events=\'connect,query\'',0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,test,'select 1,\n2,\n# comment\n3',0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,test,'insert into t2 values (1), (2)',0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,test,'select * from t2',0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,test,'select * from t_doesnt_exist',ID
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,test,'syntax_error_query',ID
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,test,'drop table renamed_t1, t2',0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,test,'show variables like \'server_audit%\'',0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,test,'set global server_audit_mode=1',0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,test,'set global server_audit_events=\'\'',0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,test,'create database sa_db',0
+TIME,HOSTNAME,root,localhost:unavailable,ID,0,CONNECT,test,,0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,CREATE,test,t1,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,test,'create table t1 (id2 int)',0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,test,t1,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,READ,mysql,table_stats,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,READ,mysql,column_stats,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,READ,mysql,index_stats,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,test,'insert into t1 values (1), (2)',0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,READ,test,t1,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,test,'select * from t1',0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,mysql,table_stats,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,mysql,column_stats,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,mysql,index_stats,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,DROP,test,t1,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,test,'drop table t1',0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,sa_db,'use sa_db',0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,CREATE,sa_db,sa_t1,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,sa_db,'create table sa_t1(id int)',0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,sa_db,sa_t1,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,READ,mysql,table_stats,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,READ,mysql,column_stats,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,READ,mysql,index_stats,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,sa_db,'insert into sa_t1 values (1), (2)',0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,mysql,table_stats,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,mysql,column_stats,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,mysql,index_stats,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,DROP,sa_db,sa_t1,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,sa_db,'drop table sa_t1',0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,READ,mysql,proc,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,mysql,proc,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,mysql,event,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,sa_db,'drop database sa_db',0
+TIME,HOSTNAME,root,localhost:unavailable,ID,0,DISCONNECT,,,0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,test,'create database sa_db',0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,sa_db,'use sa_db',0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,mysql,db,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,mysql,tables_priv,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,mysql,columns_priv,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,mysql,procs_priv,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,mysql,proxies_priv,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,mysql,roles_mapping,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,mysql,global_priv,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,sa_db,'CREATE USER u1 IDENTIFIED BY *****',0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,mysql,tables_priv,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,mysql,global_priv,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,sa_db,'GRANT ALL ON sa_db TO u2 IDENTIFIED BY *****',0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,mysql,global_priv,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,sa_db,'SET PASSWORD FOR u1 = PASSWORD(*****)',0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,mysql,db,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,mysql,tables_priv,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,mysql,columns_priv,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,mysql,procs_priv,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,mysql,proxies_priv,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,mysql,roles_mapping,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,mysql,global_priv,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,sa_db,'CREATE USER u3 IDENTIFIED BY *****',0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,mysql,global_priv,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,sa_db,'ALTER USER u3 IDENTIFIED BY *****',0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,mysql,db,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,mysql,tables_priv,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,mysql,columns_priv,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,mysql,procs_priv,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,mysql,proxies_priv,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,mysql,roles_mapping,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,mysql,global_priv,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,sa_db,'drop user u1, u2, u3',0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,sa_db,'create table t1(id int)',0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,sa_db,'drop table t1',0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,sa_db,'create procedure pr1() insert into test.t1 values ("foo", 42)',0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,sa_db,'create function fn1(i int) returns int deterministic return i+1',0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,sa_db,'drop procedure pr1',0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,sa_db,'drop function fn1',0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,sa_db,'create table t1(id int)',0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,sa_db,'insert into t1 values (1), (2)',0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,sa_db,'select * from t1',0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,sa_db,'select 2',0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,sa_db,'drop table t1',0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,sa_db,'insert into t1 values (1), (2)',0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,sa_db,'select * from t1',0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,sa_db,'select 2',0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,sa_db,'(select 2)',0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,sa_db,'/*! select 2*/',0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,sa_db,'/*comment*/ select 2',0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,sa_db,'CREATE USER u1 IDENTIFIED BY *****',0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,sa_db,'GRANT ALL ON sa_db TO u2 IDENTIFIED BY *****',0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,sa_db,'SET PASSWORD \n# comment\nFOR u1 = PASSWORD(*****)',0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,sa_db,'SET PASSWORD FOR u1=<secret>',ID
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,sa_db,'CREATE USER u3 IDENTIFIED BY *****',0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,sa_db,'drop user u1, u2, u3',0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,sa_db,'insert into t1 values (1), (2)',0
+TIME,HOSTNAME,user1,localhost:unavailable,ID,ID,CREATE,sa_db,t1,
+TIME,HOSTNAME,user1,localhost:unavailable,ID,ID,WRITE,sa_db,t1,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,sa_db,'set global server_audit_logging= off',0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,mysql,db,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,mysql,tables_priv,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,mysql,columns_priv,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,mysql,procs_priv,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,mysql,proxies_priv,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,mysql,roles_mapping,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,mysql,global_priv,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,sa_db,'set global server_audit_events=\'\'',0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,sa_db,'set global server_audit_incl_users=\'root, plug_dest, ssl_user1\'',0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,mysql,db,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,mysql,tables_priv,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,mysql,columns_priv,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,mysql,procs_priv,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,mysql,proxies_priv,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,mysql,roles_mapping,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,mysql,global_priv,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,sa_db,'CREATE USER plug IDENTIFIED WITH \'test_plugin_server\' AS \'plug_dest\'',0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,mysql,db,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,mysql,tables_priv,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,mysql,columns_priv,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,mysql,procs_priv,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,mysql,proxies_priv,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,mysql,roles_mapping,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,mysql,global_priv,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,sa_db,'CREATE USER plug_dest IDENTIFIED BY *****',0
+TIME,HOSTNAME,plug,localhost:unavailable,ID,0,FAILED_CONNECT,,,ID
+TIME,HOSTNAME,plug,localhost:unavailable,ID,0,DISCONNECT,,,0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,mysql,proxies_priv,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,mysql,global_priv,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,sa_db,'GRANT PROXY ON plug_dest TO plug',0
+TIME,HOSTNAME,plug,localhost:unavailable,ID,0,CONNECT,,,0
+TIME,HOSTNAME,plug,localhost:unavailable,ID,0,PROXY_CONNECT,,`plug_dest`@`%`,0
+TIME,HOSTNAME,plug,localhost:unavailable,ID,ID,QUERY,,'select USER(),CURRENT_USER()',0
+TIME,HOSTNAME,plug,localhost:unavailable,ID,0,DISCONNECT,,,0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,mysql,db,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,mysql,tables_priv,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,mysql,columns_priv,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,mysql,procs_priv,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,mysql,proxies_priv,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,mysql,roles_mapping,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,mysql,global_priv,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,sa_db,'DROP USER plug',0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,mysql,db,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,mysql,tables_priv,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,mysql,columns_priv,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,mysql,procs_priv,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,mysql,proxies_priv,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,mysql,roles_mapping,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,mysql,global_priv,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,sa_db,'DROP USER plug_dest',0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,mysql,db,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,mysql,tables_priv,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,mysql,columns_priv,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,mysql,procs_priv,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,mysql,proxies_priv,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,mysql,roles_mapping,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,mysql,global_priv,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,sa_db,'CREATE USER ssl_user1@localhost require SSL',0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,mysql,tables_priv,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,mysql,global_priv,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,sa_db,'GRANT ALL ON sa_db TO ssl_user1@localhost',0
+TIME,HOSTNAME,ssl_user1,localhost:unavailable,ID,0,CONNECT,sa_db,TLS_VERSION,0
+TIME,HOSTNAME,ssl_user1,localhost:unavailable,ID,ID,QUERY,sa_db,'SHOW STATUS LIKE \'Ssl_version\'',0
+TIME,HOSTNAME,ssl_user1,localhost:unavailable,ID,ID,QUERY,sa_db,'select variable_value > \'\' as \'have_ssl\' from information_schema.session_status where variable_name=\'ssl_cipher\'',0
+TIME,HOSTNAME,ssl_user1,localhost:unavailable,ID,0,DISCONNECT,sa_db,TLS_VERSION,0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,mysql,db,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,mysql,tables_priv,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,mysql,columns_priv,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,mysql,procs_priv,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,mysql,proxies_priv,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,mysql,roles_mapping,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,mysql,global_priv,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,sa_db,'DROP USER ssl_user1@localhost',0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,sa_db,'set global serv',0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,sa_db,'select (1), (2)',0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,sa_db,'select \'A\', ',0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,sa_db,'set global server_audit_query_log_limit= 1024',0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,READ,mysql,proc,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,mysql,proc,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,mysql,event,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,sa_db,'drop database sa_db',0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,sa_db,'select length(\'012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567',0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,CREATE,test,t1,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,sa_db,'CREATE TABLE test.t1 (a char(4))',0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,sa_db,'set sql_mode=""',0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,test,t1,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,READ,mysql,table_stats,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,READ,mysql,column_stats,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,READ,mysql,index_stats,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,sa_db,'insert into test.t1 value("12345")',0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,sa_db,'SHOW WARNINGS',0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,sa_db,'set sql_mode=default',0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,mysql,table_stats,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,mysql,column_stats,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,mysql,index_stats,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,DROP,test,t1,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,sa_db,'drop table test.t1',0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,sa_db,'set global server_audit_file_path=\'.\'',0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,sa_db,'set global server_audit_file_path=\'.\'',0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,sa_db,'show status like \'server_audit_current_log\'',0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,sa_db,'set global server_audit_file_path=\'\'',0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,sa_db,'set global server_audit_file_path=\'\'',0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,sa_db,'show status like \'server_audit_current_log\'',0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,sa_db,'set global server_audit_file_path=\'  \'',0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,sa_db,'set global server_audit_file_path=\'  \'',0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,sa_db,'show status like \'server_audit_current_log\'',0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,sa_db,'set global server_audit_file_path=\'nonexisting_dir/\'',0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,sa_db,'set global server_audit_file_path=\'nonexisting_dir/\'',0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,sa_db,'SHOW WARNINGS',0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,sa_db,'show status like \'server_audit_current_log\'',0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,sa_db,'show variables like \'server_audit%\'',0
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,WRITE,mysql,plugin,
+TIME,HOSTNAME,root,localhost:unavailable,ID,ID,QUERY,sa_db,'uninstall plugin server_audit',0
 #
 # MDEV-27631 Assertion `global_status_var.global_memory_used == 0' failed in mysqld_exit
 #
diff --git a/mysql-test/suite/plugins/r/thread_pool_server_audit.result b/mysql-test/suite/plugins/r/thread_pool_server_audit.result
index 8c6ece53227..98ac3484584 100644
--- a/mysql-test/suite/plugins/r/thread_pool_server_audit.result
+++ b/mysql-test/suite/plugins/r/thread_pool_server_audit.result
@@ -239,154 +239,154 @@ server_audit_syslog_priority	LOG_INFO
 uninstall plugin server_audit;
 Warnings:
 Warning	1620	Plugin is busy and will be uninstalled on shutdown
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,test,'set global server_audit_logging=on',0
-TIME,HOSTNAME,root,localhost,ID,0,CONNECT,mysql,,0
-TIME,HOSTNAME,root,localhost,ID,0,DISCONNECT,mysql,,0
-TIME,HOSTNAME,no_such_user,localhost,ID,0,FAILED_CONNECT,,,ID
-TIME,HOSTNAME,no_such_user,localhost,ID,0,DISCONNECT,,,0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,test,'set global server_audit_incl_users=\'odin, dva, tri\'',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,test,'set global server_audit_incl_users=\'odin, root, dva, tri\'',0
-TIME,HOSTNAME,root,localhost,ID,ID,CREATE,test,t2,
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,test,'create table t2 (id int)',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,test,'set global server_audit_excl_users=\'odin, dva, tri\'',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,test,'SHOW WARNINGS',0
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,test,t1,
-TIME,HOSTNAME,root,localhost,ID,ID,READ,mysql,table_stats,
-TIME,HOSTNAME,root,localhost,ID,ID,READ,mysql,column_stats,
-TIME,HOSTNAME,root,localhost,ID,ID,READ,mysql,index_stats,
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,test,'insert into t1 values (1), (2)',0
-TIME,HOSTNAME,root,localhost,ID,ID,READ,test,t1,
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,test,'select * from t1',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,test,'set global server_audit_incl_users=\'odin, root, dva, tri\'',0
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,test,t2,
-TIME,HOSTNAME,root,localhost,ID,ID,READ,mysql,table_stats,
-TIME,HOSTNAME,root,localhost,ID,ID,READ,mysql,column_stats,
-TIME,HOSTNAME,root,localhost,ID,ID,READ,mysql,index_stats,
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,test,'insert into t2 values (1), (2)',0
-TIME,HOSTNAME,root,localhost,ID,ID,READ,test,t2,
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,test,'select * from t2',0
-TIME,HOSTNAME,root,localhost,ID,ID,ALTER,test,t1,
-TIME,HOSTNAME,root,localhost,ID,ID,RENAME,test,t1|test.renamed_t1,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,table_stats,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,column_stats,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,index_stats,
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,test,'alter table t1 rename renamed_t1',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,test,'set global server_audit_events=\'connect,query\'',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,test,'select 1,\n2,\n# comment\n3',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,test,'insert into t2 values (1), (2)',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,test,'select * from t2',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,test,'select * from t_doesnt_exist',ID
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,test,'syntax_error_query',ID
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,test,'drop table renamed_t1, t2',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,test,'show variables like \'server_audit%\'',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,test,'set global server_audit_mode=1',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,test,'set global server_audit_events=\'\'',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,test,'create database sa_db',0
-TIME,HOSTNAME,root,localhost,ID,0,CONNECT,test,,0
-TIME,HOSTNAME,root,localhost,ID,ID,CREATE,test,t1,
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,test,'create table t1 (id2 int)',0
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,test,t1,
-TIME,HOSTNAME,root,localhost,ID,ID,READ,mysql,table_stats,
-TIME,HOSTNAME,root,localhost,ID,ID,READ,mysql,column_stats,
-TIME,HOSTNAME,root,localhost,ID,ID,READ,mysql,index_stats,
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,test,'insert into t1 values (1), (2)',0
-TIME,HOSTNAME,root,localhost,ID,ID,READ,test,t1,
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,test,'select * from t1',0
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,table_stats,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,column_stats,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,index_stats,
-TIME,HOSTNAME,root,localhost,ID,ID,DROP,test,t1,
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,test,'drop table t1',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'use sa_db',0
-TIME,HOSTNAME,root,localhost,ID,ID,CREATE,sa_db,sa_t1,
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'create table sa_t1(id int)',0
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,sa_db,sa_t1,
-TIME,HOSTNAME,root,localhost,ID,ID,READ,mysql,table_stats,
-TIME,HOSTNAME,root,localhost,ID,ID,READ,mysql,column_stats,
-TIME,HOSTNAME,root,localhost,ID,ID,READ,mysql,index_stats,
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'insert into sa_t1 values (1), (2)',0
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,table_stats,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,column_stats,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,index_stats,
-TIME,HOSTNAME,root,localhost,ID,ID,DROP,sa_db,sa_t1,
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'drop table sa_t1',0
-TIME,HOSTNAME,root,localhost,ID,ID,READ,mysql,proc,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,proc,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,event,
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'drop database sa_db',0
-TIME,HOSTNAME,root,localhost,ID,0,DISCONNECT,,,0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,test,'create database sa_db',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'use sa_db',0
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,db,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,tables_priv,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,columns_priv,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,procs_priv,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,proxies_priv,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,roles_mapping,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,global_priv,
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'CREATE USER u1 IDENTIFIED BY *****',0
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,tables_priv,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,global_priv,
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'GRANT ALL ON sa_db TO u2 IDENTIFIED BY *****',0
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,global_priv,
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'SET PASSWORD FOR u1 = PASSWORD(*****)',0
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,db,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,tables_priv,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,columns_priv,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,procs_priv,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,proxies_priv,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,roles_mapping,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,global_priv,
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'CREATE USER u3 IDENTIFIED BY *****',0
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,db,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,tables_priv,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,columns_priv,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,procs_priv,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,proxies_priv,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,roles_mapping,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,global_priv,
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'drop user u1, u2, u3',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'create table t1(id int)',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'drop table t1',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'create table t1(id int)',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'insert into t1 values (1), (2)',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'select * from t1',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'select 2',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'drop table t1',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'insert into t1 values (1), (2)',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'select * from t1',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'select 2',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'(select 2)',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'/*! select 2*/',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'/*comment*/ select 2',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'CREATE USER u1 IDENTIFIED BY *****',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'GRANT ALL ON sa_db TO u2 IDENTIFIED BY *****',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'SET PASSWORD\n# comment\nFOR u1 = PASSWORD(*****)',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'SET PASSWORD FOR u1=<secret>',ID
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'CREATE USER u3 IDENTIFIED BY *****',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'drop user u1, u2, u3',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'set global server_audit_events=\'\'',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'set global serv',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'select (1), (2)',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'select \'A\', ',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'set global server_audit_query_log_limit= 1024',0
-TIME,HOSTNAME,root,localhost,ID,ID,READ,mysql,proc,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,proc,
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,event,
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'drop database sa_db',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'set global server_audit_file_path=\'.\'',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'set global server_audit_file_path=\'.\'',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'show status like \'server_audit_current_log\'',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'set global server_audit_file_path=\'\'',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'set global server_audit_file_path=\'\'',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'show status like \'server_audit_current_log\'',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'set global server_audit_file_path=\'  \'',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'set global server_audit_file_path=\'  \'',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'show status like \'server_audit_current_log\'',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'set global server_audit_file_path=\'nonexisting_dir/\'',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'set global server_audit_file_path=\'nonexisting_dir/\'',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'SHOW WARNINGS',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'show status like \'server_audit_current_log\'',0
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'show variables like \'server_audit%\'',0
-TIME,HOSTNAME,root,localhost,ID,ID,WRITE,mysql,plugin,
-TIME,HOSTNAME,root,localhost,ID,ID,QUERY,sa_db,'uninstall plugin server_audit',0
+TIME,HOSTNAME,root,localhost:port,ID,ID,QUERY,test,'set global server_audit_logging=on',0
+TIME,HOSTNAME,root,localhost:port,ID,0,CONNECT,mysql,,0
+TIME,HOSTNAME,root,localhost:port,ID,0,DISCONNECT,mysql,,0
+TIME,HOSTNAME,no_such_user,localhost:port,ID,0,FAILED_CONNECT,,,ID
+TIME,HOSTNAME,no_such_user,localhost:port,ID,0,DISCONNECT,,,0
+TIME,HOSTNAME,root,localhost:port,ID,ID,QUERY,test,'set global server_audit_incl_users=\'odin, dva, tri\'',0
+TIME,HOSTNAME,root,localhost:port,ID,ID,QUERY,test,'set global server_audit_incl_users=\'odin, root, dva, tri\'',0
+TIME,HOSTNAME,root,localhost:port,ID,ID,CREATE,test,t2,
+TIME,HOSTNAME,root,localhost:port,ID,ID,QUERY,test,'create table t2 (id int)',0
+TIME,HOSTNAME,root,localhost:port,ID,ID,QUERY,test,'set global server_audit_excl_users=\'odin, dva, tri\'',0
+TIME,HOSTNAME,root,localhost:port,ID,ID,QUERY,test,'SHOW WARNINGS',0
+TIME,HOSTNAME,root,localhost:port,ID,ID,WRITE,test,t1,
+TIME,HOSTNAME,root,localhost:port,ID,ID,READ,mysql,table_stats,
+TIME,HOSTNAME,root,localhost:port,ID,ID,READ,mysql,column_stats,
+TIME,HOSTNAME,root,localhost:port,ID,ID,READ,mysql,index_stats,
+TIME,HOSTNAME,root,localhost:port,ID,ID,QUERY,test,'insert into t1 values (1), (2)',0
+TIME,HOSTNAME,root,localhost:port,ID,ID,READ,test,t1,
+TIME,HOSTNAME,root,localhost:port,ID,ID,QUERY,test,'select * from t1',0
+TIME,HOSTNAME,root,localhost:port,ID,ID,QUERY,test,'set global server_audit_incl_users=\'odin, root, dva, tri\'',0
+TIME,HOSTNAME,root,localhost:port,ID,ID,WRITE,test,t2,
+TIME,HOSTNAME,root,localhost:port,ID,ID,READ,mysql,table_stats,
+TIME,HOSTNAME,root,localhost:port,ID,ID,READ,mysql,column_stats,
+TIME,HOSTNAME,root,localhost:port,ID,ID,READ,mysql,index_stats,
+TIME,HOSTNAME,root,localhost:port,ID,ID,QUERY,test,'insert into t2 values (1), (2)',0
+TIME,HOSTNAME,root,localhost:port,ID,ID,READ,test,t2,
+TIME,HOSTNAME,root,localhost:port,ID,ID,QUERY,test,'select * from t2',0
+TIME,HOSTNAME,root,localhost:port,ID,ID,ALTER,test,t1,
+TIME,HOSTNAME,root,localhost:port,ID,ID,RENAME,test,t1|test.renamed_t1,
+TIME,HOSTNAME,root,localhost:port,ID,ID,WRITE,mysql,table_stats,
+TIME,HOSTNAME,root,localhost:port,ID,ID,WRITE,mysql,column_stats,
+TIME,HOSTNAME,root,localhost:port,ID,ID,WRITE,mysql,index_stats,
+TIME,HOSTNAME,root,localhost:port,ID,ID,QUERY,test,'alter table t1 rename renamed_t1',0
+TIME,HOSTNAME,root,localhost:port,ID,ID,QUERY,test,'set global server_audit_events=\'connect,query\'',0
+TIME,HOSTNAME,root,localhost:port,ID,ID,QUERY,test,'select 1,\n2,\n# comment\n3',0
+TIME,HOSTNAME,root,localhost:port,ID,ID,QUERY,test,'insert into t2 values (1), (2)',0
+TIME,HOSTNAME,root,localhost:port,ID,ID,QUERY,test,'select * from t2',0
+TIME,HOSTNAME,root,localhost:port,ID,ID,QUERY,test,'select * from t_doesnt_exist',ID
+TIME,HOSTNAME,root,localhost:port,ID,ID,QUERY,test,'syntax_error_query',ID
+TIME,HOSTNAME,root,localhost:port,ID,ID,QUERY,test,'drop table renamed_t1, t2',0
+TIME,HOSTNAME,root,localhost:port,ID,ID,QUERY,test,'show variables like \'server_audit%\'',0
+TIME,HOSTNAME,root,localhost:port,ID,ID,QUERY,test,'set global server_audit_mode=1',0
+TIME,HOSTNAME,root,localhost:port,ID,ID,QUERY,test,'set global server_audit_events=\'\'',0
+TIME,HOSTNAME,root,localhost:port,ID,ID,QUERY,test,'create database sa_db',0
+TIME,HOSTNAME,root,localhost:port,ID,0,CONNECT,test,,0
+TIME,HOSTNAME,root,localhost:port,ID,ID,CREATE,test,t1,
+TIME,HOSTNAME,root,localhost:port,ID,ID,QUERY,test,'create table t1 (id2 int)',0
+TIME,HOSTNAME,root,localhost:port,ID,ID,WRITE,test,t1,
+TIME,HOSTNAME,root,localhost:port,ID,ID,READ,mysql,table_stats,
+TIME,HOSTNAME,root,localhost:port,ID,ID,READ,mysql,column_stats,
+TIME,HOSTNAME,root,localhost:port,ID,ID,READ,mysql,index_stats,
+TIME,HOSTNAME,root,localhost:port,ID,ID,QUERY,test,'insert into t1 values (1), (2)',0
+TIME,HOSTNAME,root,localhost:port,ID,ID,READ,test,t1,
+TIME,HOSTNAME,root,localhost:port,ID,ID,QUERY,test,'select * from t1',0
+TIME,HOSTNAME,root,localhost:port,ID,ID,WRITE,mysql,table_stats,
+TIME,HOSTNAME,root,localhost:port,ID,ID,WRITE,mysql,column_stats,
+TIME,HOSTNAME,root,localhost:port,ID,ID,WRITE,mysql,index_stats,
+TIME,HOSTNAME,root,localhost:port,ID,ID,DROP,test,t1,
+TIME,HOSTNAME,root,localhost:port,ID,ID,QUERY,test,'drop table t1',0
+TIME,HOSTNAME,root,localhost:port,ID,ID,QUERY,sa_db,'use sa_db',0
+TIME,HOSTNAME,root,localhost:port,ID,ID,CREATE,sa_db,sa_t1,
+TIME,HOSTNAME,root,localhost:port,ID,ID,QUERY,sa_db,'create table sa_t1(id int)',0
+TIME,HOSTNAME,root,localhost:port,ID,ID,WRITE,sa_db,sa_t1,
+TIME,HOSTNAME,root,localhost:port,ID,ID,READ,mysql,table_stats,
+TIME,HOSTNAME,root,localhost:port,ID,ID,READ,mysql,column_stats,
+TIME,HOSTNAME,root,localhost:port,ID,ID,READ,mysql,index_stats,
+TIME,HOSTNAME,root,localhost:port,ID,ID,QUERY,sa_db,'insert into sa_t1 values (1), (2)',0
+TIME,HOSTNAME,root,localhost:port,ID,ID,WRITE,mysql,table_stats,
+TIME,HOSTNAME,root,localhost:port,ID,ID,WRITE,mysql,column_stats,
+TIME,HOSTNAME,root,localhost:port,ID,ID,WRITE,mysql,index_stats,
+TIME,HOSTNAME,root,localhost:port,ID,ID,DROP,sa_db,sa_t1,
+TIME,HOSTNAME,root,localhost:port,ID,ID,QUERY,sa_db,'drop table sa_t1',0
+TIME,HOSTNAME,root,localhost:port,ID,ID,READ,mysql,proc,
+TIME,HOSTNAME,root,localhost:port,ID,ID,WRITE,mysql,proc,
+TIME,HOSTNAME,root,localhost:port,ID,ID,WRITE,mysql,event,
+TIME,HOSTNAME,root,localhost:port,ID,ID,QUERY,sa_db,'drop database sa_db',0
+TIME,HOSTNAME,root,localhost:port,ID,0,DISCONNECT,,,0
+TIME,HOSTNAME,root,localhost:port,ID,ID,QUERY,test,'create database sa_db',0
+TIME,HOSTNAME,root,localhost:port,ID,ID,QUERY,sa_db,'use sa_db',0
+TIME,HOSTNAME,root,localhost:port,ID,ID,WRITE,mysql,db,
+TIME,HOSTNAME,root,localhost:port,ID,ID,WRITE,mysql,tables_priv,
+TIME,HOSTNAME,root,localhost:port,ID,ID,WRITE,mysql,columns_priv,
+TIME,HOSTNAME,root,localhost:port,ID,ID,WRITE,mysql,procs_priv,
+TIME,HOSTNAME,root,localhost:port,ID,ID,WRITE,mysql,proxies_priv,
+TIME,HOSTNAME,root,localhost:port,ID,ID,WRITE,mysql,roles_mapping,
+TIME,HOSTNAME,root,localhost:port,ID,ID,WRITE,mysql,global_priv,
+TIME,HOSTNAME,root,localhost:port,ID,ID,QUERY,sa_db,'CREATE USER u1 IDENTIFIED BY *****',0
+TIME,HOSTNAME,root,localhost:port,ID,ID,WRITE,mysql,tables_priv,
+TIME,HOSTNAME,root,localhost:port,ID,ID,WRITE,mysql,global_priv,
+TIME,HOSTNAME,root,localhost:port,ID,ID,QUERY,sa_db,'GRANT ALL ON sa_db TO u2 IDENTIFIED BY *****',0
+TIME,HOSTNAME,root,localhost:port,ID,ID,WRITE,mysql,global_priv,
+TIME,HOSTNAME,root,localhost:port,ID,ID,QUERY,sa_db,'SET PASSWORD FOR u1 = PASSWORD(*****)',0
+TIME,HOSTNAME,root,localhost:port,ID,ID,WRITE,mysql,db,
+TIME,HOSTNAME,root,localhost:port,ID,ID,WRITE,mysql,tables_priv,
+TIME,HOSTNAME,root,localhost:port,ID,ID,WRITE,mysql,columns_priv,
+TIME,HOSTNAME,root,localhost:port,ID,ID,WRITE,mysql,procs_priv,
+TIME,HOSTNAME,root,localhost:port,ID,ID,WRITE,mysql,proxies_priv,
+TIME,HOSTNAME,root,localhost:port,ID,ID,WRITE,mysql,roles_mapping,
+TIME,HOSTNAME,root,localhost:port,ID,ID,WRITE,mysql,global_priv,
+TIME,HOSTNAME,root,localhost:port,ID,ID,QUERY,sa_db,'CREATE USER u3 IDENTIFIED BY *****',0
+TIME,HOSTNAME,root,localhost:port,ID,ID,WRITE,mysql,db,
+TIME,HOSTNAME,root,localhost:port,ID,ID,WRITE,mysql,tables_priv,
+TIME,HOSTNAME,root,localhost:port,ID,ID,WRITE,mysql,columns_priv,
+TIME,HOSTNAME,root,localhost:port,ID,ID,WRITE,mysql,procs_priv,
+TIME,HOSTNAME,root,localhost:port,ID,ID,WRITE,mysql,proxies_priv,
+TIME,HOSTNAME,root,localhost:port,ID,ID,WRITE,mysql,roles_mapping,
+TIME,HOSTNAME,root,localhost:port,ID,ID,WRITE,mysql,global_priv,
+TIME,HOSTNAME,root,localhost:port,ID,ID,QUERY,sa_db,'drop user u1, u2, u3',0
+TIME,HOSTNAME,root,localhost:port,ID,ID,QUERY,sa_db,'create table t1(id int)',0
+TIME,HOSTNAME,root,localhost:port,ID,ID,QUERY,sa_db,'drop table t1',0
+TIME,HOSTNAME,root,localhost:port,ID,ID,QUERY,sa_db,'create table t1(id int)',0
+TIME,HOSTNAME,root,localhost:port,ID,ID,QUERY,sa_db,'insert into t1 values (1), (2)',0
+TIME,HOSTNAME,root,localhost:port,ID,ID,QUERY,sa_db,'select * from t1',0
+TIME,HOSTNAME,root,localhost:port,ID,ID,QUERY,sa_db,'select 2',0
+TIME,HOSTNAME,root,localhost:port,ID,ID,QUERY,sa_db,'drop table t1',0
+TIME,HOSTNAME,root,localhost:port,ID,ID,QUERY,sa_db,'insert into t1 values (1), (2)',0
+TIME,HOSTNAME,root,localhost:port,ID,ID,QUERY,sa_db,'select * from t1',0
+TIME,HOSTNAME,root,localhost:port,ID,ID,QUERY,sa_db,'select 2',0
+TIME,HOSTNAME,root,localhost:port,ID,ID,QUERY,sa_db,'(select 2)',0
+TIME,HOSTNAME,root,localhost:port,ID,ID,QUERY,sa_db,'/*! select 2*/',0
+TIME,HOSTNAME,root,localhost:port,ID,ID,QUERY,sa_db,'/*comment*/ select 2',0
+TIME,HOSTNAME,root,localhost:port,ID,ID,QUERY,sa_db,'CREATE USER u1 IDENTIFIED BY *****',0
+TIME,HOSTNAME,root,localhost:port,ID,ID,QUERY,sa_db,'GRANT ALL ON sa_db TO u2 IDENTIFIED BY *****',0
+TIME,HOSTNAME,root,localhost:port,ID,ID,QUERY,sa_db,'SET PASSWORD\n# comment\nFOR u1 = PASSWORD(*****)',0
+TIME,HOSTNAME,root,localhost:port,ID,ID,QUERY,sa_db,'SET PASSWORD FOR u1=<secret>',ID
+TIME,HOSTNAME,root,localhost:port,ID,ID,QUERY,sa_db,'CREATE USER u3 IDENTIFIED BY *****',0
+TIME,HOSTNAME,root,localhost:port,ID,ID,QUERY,sa_db,'drop user u1, u2, u3',0
+TIME,HOSTNAME,root,localhost:port,ID,ID,QUERY,sa_db,'set global server_audit_events=\'\'',0
+TIME,HOSTNAME,root,localhost:port,ID,ID,QUERY,sa_db,'set global serv',0
+TIME,HOSTNAME,root,localhost:port,ID,ID,QUERY,sa_db,'select (1), (2)',0
+TIME,HOSTNAME,root,localhost:port,ID,ID,QUERY,sa_db,'select \'A\', ',0
+TIME,HOSTNAME,root,localhost:port,ID,ID,QUERY,sa_db,'set global server_audit_query_log_limit= 1024',0
+TIME,HOSTNAME,root,localhost:port,ID,ID,READ,mysql,proc,
+TIME,HOSTNAME,root,localhost:port,ID,ID,WRITE,mysql,proc,
+TIME,HOSTNAME,root,localhost:port,ID,ID,WRITE,mysql,event,
+TIME,HOSTNAME,root,localhost:port,ID,ID,QUERY,sa_db,'drop database sa_db',0
+TIME,HOSTNAME,root,localhost:port,ID,ID,QUERY,sa_db,'set global server_audit_file_path=\'.\'',0
+TIME,HOSTNAME,root,localhost:port,ID,ID,QUERY,sa_db,'set global server_audit_file_path=\'.\'',0
+TIME,HOSTNAME,root,localhost:port,ID,ID,QUERY,sa_db,'show status like \'server_audit_current_log\'',0
+TIME,HOSTNAME,root,localhost:port,ID,ID,QUERY,sa_db,'set global server_audit_file_path=\'\'',0
+TIME,HOSTNAME,root,localhost:port,ID,ID,QUERY,sa_db,'set global server_audit_file_path=\'\'',0
+TIME,HOSTNAME,root,localhost:port,ID,ID,QUERY,sa_db,'show status like \'server_audit_current_log\'',0
+TIME,HOSTNAME,root,localhost:port,ID,ID,QUERY,sa_db,'set global server_audit_file_path=\'  \'',0
+TIME,HOSTNAME,root,localhost:port,ID,ID,QUERY,sa_db,'set global server_audit_file_path=\'  \'',0
+TIME,HOSTNAME,root,localhost:port,ID,ID,QUERY,sa_db,'show status like \'server_audit_current_log\'',0
+TIME,HOSTNAME,root,localhost:port,ID,ID,QUERY,sa_db,'set global server_audit_file_path=\'nonexisting_dir/\'',0
+TIME,HOSTNAME,root,localhost:port,ID,ID,QUERY,sa_db,'set global server_audit_file_path=\'nonexisting_dir/\'',0
+TIME,HOSTNAME,root,localhost:port,ID,ID,QUERY,sa_db,'SHOW WARNINGS',0
+TIME,HOSTNAME,root,localhost:port,ID,ID,QUERY,sa_db,'show status like \'server_audit_current_log\'',0
+TIME,HOSTNAME,root,localhost:port,ID,ID,QUERY,sa_db,'show variables like \'server_audit%\'',0
+TIME,HOSTNAME,root,localhost:port,ID,ID,WRITE,mysql,plugin,
+TIME,HOSTNAME,root,localhost:port,ID,ID,QUERY,sa_db,'uninstall plugin server_audit',0
diff --git a/mysql-test/suite/plugins/t/thread_pool_server_audit.test b/mysql-test/suite/plugins/t/thread_pool_server_audit.test
index c12ef29ff20..c532203cc68 100644
--- a/mysql-test/suite/plugins/t/thread_pool_server_audit.test
+++ b/mysql-test/suite/plugins/t/thread_pool_server_audit.test
@@ -27,7 +27,7 @@ connection default;
 --sleep 2
 set global server_audit_incl_users='odin, dva, tri';
 create table t1 (id int);
-set global server_audit_incl_users='odin, root, dva, tri';
+set global server_audit_incl_users='odin, root, dva, tri'; 
 create table t2 (id int);
 set global server_audit_excl_users='odin, dva, tri';
 insert into t1 values (1), (2);
@@ -144,8 +144,8 @@ uninstall plugin server_audit;
 --enable_ps2_protocol
 
 let $MYSQLD_DATADIR= `SELECT @@datadir`;
-# replace the timestamp and the hostname with constant values
---replace_regex /[0-9]* [0-9][0-9]:[0-9][0-9]:[0-9][0-9]\,[^,]*\,/TIME,HOSTNAME,/ /\,[1-9][0-9]*\,/,1,/ /\,[1-9][0-9]*/,ID/
+# replace the timestamp, hostname, and port number with constant values
+--replace_regex /[0-9]* [0-9][0-9]:[0-9][0-9]:[0-9][0-9]\,[^,]*\,/TIME,HOSTNAME,/ /\,[1-9][0-9]*\,/,1,/ /\,[1-9][0-9]*/,ID/ /,localhost:([0-9]+|unavailable)/,localhost:port/
 cat_file $MYSQLD_DATADIR/server_audit.log;
 remove_file $MYSQLD_DATADIR/server_audit.log;
 
diff --git a/plugin/server_audit/server_audit.c b/plugin/server_audit/server_audit.c
index 71d4666163a..00a1e55e5c1 100644
--- a/plugin/server_audit/server_audit.c
+++ b/plugin/server_audit/server_audit.c
@@ -16,7 +16,7 @@
 
 
 #define PLUGIN_VERSION 0x104
-#define PLUGIN_STR_VERSION "1.4.14"
+#define PLUGIN_STR_VERSION "1.5.14"
 
 #define _my_thread_var loc_thread_var
 
@@ -336,6 +336,7 @@ struct connection_info
   char query_buffer[1024];
   time_t query_time;
   int log_always;
+  unsigned int port;
   char proxy[USERNAME_CHAR_LENGTH+1];
   int proxy_length;
   char proxy_host[HOSTNAME_LENGTH+1];
@@ -1199,6 +1200,7 @@ static void setup_connection_simple(struct connection_info *ci)
   ci->query_length= 0;
   ci->header= 0;
   ci->proxy_length= 0;
+  ci->port= 0;
 }
 
 
@@ -1445,16 +1447,22 @@ static size_t log_header(char *message, size_t message_len,
                       const char *username, unsigned int username_len,
                       const char *host, unsigned int host_len,
                       const char *userip, unsigned int userip_len,
-                      unsigned int connection_id, long long query_id,
-                      const char *operation)
+                      unsigned int connection_id, unsigned int port,
+                      long long query_id, const char *operation)
 {
   struct tm tm_time;
-
+  char port_str[16];
   if (host_len == 0 && userip_len != 0)
   {
     host_len= userip_len;
     host= userip;
   }
+  if (port == 0) {
+    strncpy(port_str, "unavailable", sizeof(port_str) - 1);
+    port_str[sizeof(port_str) - 1] = '\0'; 
+  } else {
+    my_snprintf(port_str, sizeof(port_str), "%u", port);
+  }
 
   /*
     That was added to find the possible cause of the MENT-1438.
@@ -1468,20 +1476,20 @@ static size_t log_header(char *message, size_t message_len,
 
   if (output_type == OUTPUT_SYSLOG)
     return my_snprintf(message, message_len,
-        "%.*s,%.*s,%.*s,%d,%lld,%s",
+        "%.*s,%.*s,%.*s:%s,%d,%lld,%s",
         (int) serverhost_len, serverhost,
         username_len, username,
-        host_len, host,
+        host_len, host, port_str,
         connection_id, query_id, operation);
 
   (void) localtime_r(ts, &tm_time);
   return my_snprintf(message, message_len,
-      "%04d%02d%02d %02d:%02d:%02d,%.*s,%.*s,%.*s,%d,%lld,%s",
+      "%04d%02d%02d %02d:%02d:%02d,%.*s,%.*s,%.*s:%s,%d,%lld,%s",
       tm_time.tm_year+1900, tm_time.tm_mon+1, tm_time.tm_mday,
       tm_time.tm_hour, tm_time.tm_min, tm_time.tm_sec,
       (int) serverhost_len, serverhost,
       username_len, username,
-      host_len, host,
+      host_len, host, port_str,
       connection_id, query_id, operation);
 }
 
@@ -1511,7 +1519,8 @@ static int log_proxy(const struct connection_info *cn,
                     cn->user, cn->user_length,
                     cn->host, cn->host_length,
                     cn->ip, cn->ip_length,
-                    event->thread_id, 0, "PROXY_CONNECT");
+                    event->thread_id, event->port,
+                    0, "PROXY_CONNECT");
   csize+= my_snprintf(message+csize, sizeof(message) - 1 - csize,
     ",%.*s,`%.*s`@`%.*s`,%d", cn->db_length, cn->db,
                      cn->proxy_length, cn->proxy,
@@ -1538,7 +1547,7 @@ static int log_connection(const struct connection_info *cn,
                     cn->user, cn->user_length,
                     cn->host, cn->host_length,
                     cn->ip, cn->ip_length,
-                    event->thread_id, 0, type);
+                    event->thread_id, event->port, 0, type);
 
   obj_len= create_tls_obj(event, tls_obj, sizeof(tls_obj));
   csize+= my_snprintf(message+csize, sizeof(message) - 1 - csize,
@@ -1564,7 +1573,7 @@ static int log_connection_event(const struct mysql_event_connection *event,
                     event->user, event->user_length,
                     event->host, event->host_length,
                     event->ip, event->ip_length,
-                    event->thread_id, 0, type);
+                    event->thread_id, event->port, 0, type);
   obj_len= create_tls_obj(event, tls_obj, sizeof(tls_obj));
   csize+= my_snprintf(message+csize, sizeof(message) - 1 - csize,
     ",%.*s,%.*s,%d", (int) event->database.length,event->database.str,
@@ -1953,7 +1962,7 @@ do_log_query:
   csize= log_header(message, message_size-1, &ev_time,
                     servhost, servhost_len,
                     cn->user, cn->user_length,cn->host, cn->host_length,
-                    cn->ip, cn->ip_length, thd_id, query_id, type);
+                    cn->ip, cn->ip_length, thd_id, cn->port, query_id, type);
 
   csize+= my_snprintf(message+csize, message_size - 1 - csize,
       ",%.*s,\'", db_length, db);
@@ -2039,13 +2048,15 @@ static int log_table(const struct connection_info *cn,
   char message[1024];
   time_t ctime;
 
+
+
   (void) time(&ctime);
   csize= log_header(message, sizeof(message)-1, &ctime,
                     servhost, servhost_len,
                     event->user, SAFE_STRLEN_UI(event->user),
                     event->host, SAFE_STRLEN_UI(event->host),
                     event->ip, SAFE_STRLEN_UI(event->ip),
-                    event->thread_id, cn->query_id, type);
+                    event->thread_id, event->port, cn->query_id, type);
   csize+= my_snprintf(message+csize, sizeof(message) - 1 - csize, ",%.*s,%.*s,",
                      (int) event->database.length, event->database.str,
                      (int) event->table.length, event->table.str);
@@ -2067,7 +2078,8 @@ static int log_rename(const struct connection_info *cn,
                     event->user, SAFE_STRLEN_UI(event->user),
                     event->host, SAFE_STRLEN_UI(event->host),
                     event->ip, SAFE_STRLEN_UI(event->ip),
-                    event->thread_id, cn->query_id, "RENAME");
+                    event->thread_id, event->port, 
+                    cn->query_id, "RENAME");
   csize+= my_snprintf(message+csize, sizeof(message) - 1 - csize,
                       ",%.*s,%.*s|%.*s.%.*s,",
                       (int) event->database.length, event->database.str,
@@ -2126,6 +2138,7 @@ static void update_connection_info(MYSQL_THD thd, struct connection_info *cn,
   {
     const struct mysql_event_general *event =
       (const struct mysql_event_general *) ev;
+    cn->port= event->port;
     switch (event->event_subclass) {
       case MYSQL_AUDIT_GENERAL_LOG:
       {
@@ -2209,6 +2222,7 @@ static void update_connection_info(MYSQL_THD thd, struct connection_info *cn,
   {
     const struct mysql_event_table *event =
       (const struct mysql_event_table *) ev;
+    cn->port= event->port;
     if (ci_needs_setup(cn))
       setup_connection_table(cn, event);
 
@@ -2234,6 +2248,7 @@ static void update_connection_info(MYSQL_THD thd, struct connection_info *cn,
   {
     const struct mysql_event_connection *event =
       (const struct mysql_event_connection *) ev;
+    cn->port= event->port;
     switch (event->event_subclass)
     {
       case MYSQL_AUDIT_CONNECTION_CONNECT:
@@ -2856,7 +2871,7 @@ static void log_current_query(MYSQL_THD thd)
   {
     cn->log_always= 1;
     log_statement_ex(cn, cn->query_time, thd_get_thread_id(thd),
-		     cn->query, cn->query_length, 0, "QUERY", 0);
+		cn->query, cn->query_length, 0, "QUERY", 0);
     cn->log_always= 0;
   }
 }
diff --git a/sql/sql_audit.h b/sql/sql_audit.h
index 1078be9ca99..a5789a1598f 100644
--- a/sql/sql_audit.h
+++ b/sql/sql_audit.h
@@ -139,6 +139,7 @@ void mysql_audit_general_log(THD *thd, time_t time,
       event.general_charset= thd->variables.character_set_client;
       event.database= thd->db;
       event.query_id= thd->query_id;
+      event.port= thd->peer_port;
     }
     else
     {
@@ -146,6 +147,7 @@ void mysql_audit_general_log(THD *thd, time_t time,
       event.general_charset= global_system_variables.character_set_client;
       event.database= null_clex_str;
       event.query_id= 0;
+      event.port= 0;
     }
 
     mysql_audit_notify(thd, MYSQL_AUDIT_GENERAL_CLASS, &event);
@@ -191,6 +193,7 @@ void mysql_audit_general(THD *thd, uint event_subtype,
       event.general_rows= thd->get_stmt_da()->current_row_for_warning();
       event.database= thd->db;
       event.query_id= thd->query_id;
+      event.port= thd->peer_port;
     }
     else
     {
@@ -203,6 +206,7 @@ void mysql_audit_general(THD *thd, uint event_subtype,
       event.general_rows= 0;
       event.database= null_clex_str;
       event.query_id= 0;
+      event.port= thd->peer_port;
     }
 
     mysql_audit_notify(thd, MYSQL_AUDIT_GENERAL_CLASS, &event);
@@ -233,6 +237,7 @@ void mysql_audit_notify_connection_connect(THD *thd)
     event.host= sctx->host;
     event.host_length= safe_strlen_uint(sctx->host);
     event.ip= sctx->ip;
+    event.port= thd->peer_port;
     event.ip_length= safe_strlen_uint(sctx->ip);
     event.database= thd->db;
     set_tls_version_of_event(thd, &event);
@@ -263,6 +268,7 @@ void mysql_audit_notify_connection_disconnect(THD *thd, int errcode)
     event.host= sctx->host;
     event.host_length= safe_strlen_uint(sctx->host);
     event.ip= sctx->ip;
+    event.port= thd->peer_port;
     event.ip_length= safe_strlen_uint(sctx->ip) ;
     event.database= thd->db;
     set_tls_version_of_event(thd, &event);
@@ -294,6 +300,7 @@ void mysql_audit_notify_connection_change_user(THD *thd,
     event.host= old_ctx->host;
     event.host_length= safe_strlen_uint(old_ctx->host);
     event.ip= old_ctx->ip;
+    event.port= thd->peer_port;
     event.ip_length= safe_strlen_uint(old_ctx->ip);
     event.database= thd->db;
     set_tls_version_of_event(thd, &event);
@@ -323,6 +330,7 @@ void mysql_audit_external_lock_ex(THD *thd, my_thread_id thread_id,
     event.proxy_user= sctx->proxy_user;
     event.host= host;
     event.ip= ip;
+    event.port= thd->peer_port;
     event.database= share->db;
     event.table= share->table_name;
     event.new_database= null_clex_str;
@@ -361,6 +369,7 @@ void mysql_audit_create_table(TABLE *table)
     event.proxy_user= sctx->proxy_user;
     event.host= sctx->host;
     event.ip= sctx->ip;
+    event.port= thd->peer_port;
     event.database=     share->db;
     event.table=        share->table_name;
     event.new_database= null_clex_str;
@@ -389,6 +398,7 @@ void mysql_audit_drop_table(THD *thd, TABLE_LIST *table)
     event.proxy_user= sctx->proxy_user;
     event.host= sctx->host;
     event.ip= sctx->ip;
+    event.port= thd->peer_port;
     event.database=     table->db;
     event.table=        table->table_name;
     event.new_database= null_clex_str;
@@ -419,6 +429,7 @@ void mysql_audit_rename_table(THD *thd, const LEX_CSTRING *old_db,
     event.proxy_user= sctx->proxy_user;
     event.host= sctx->host;
     event.ip= sctx->ip;
+    event.port= thd->peer_port;
     event.database=  *old_db;
     event.table=     *old_tb;
     event.new_database= *new_db;
@@ -447,6 +458,7 @@ void mysql_audit_alter_table(THD *thd, TABLE_LIST *table)
     event.proxy_user= sctx->proxy_user;
     event.host= sctx->host;
     event.ip= sctx->ip;
+    event.port= thd->peer_port;
     event.database= table->db;
     event.table= table->table_name;
     event.new_database= null_clex_str;