Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →To log MySQL authentication activity, configure the server-side MySQL Enterprise Audit audit-log component or plugin. In MySQL 8.4, create a JSON filter for the connection event class, assign that filter to the accounts you want to monitor, and then inspect the configured audit-log destination. A default-account assignment can cover accounts that do not have a more specific filter.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Authentication logging is not a client setting. It is an audit configuration on the MySQL server, and it should be enabled with restrictive file permissions, deliberate retention, and a test plan that does not risk production access.
As an Amazon Associate I earn from qualifying purchases.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteWhat MySQL authentication logging records
MySQL Enterprise Audit represents login activity as connection events. Depending on the filter and policy you choose, the audit log can include successful connections, failed connection attempts, account changes made through change-user operations, and disconnects.
A connection event can include the connection status, connection ID, supplied user, authenticated user, and proxy or external-user fields. Those fields help distinguish what a client presented from the identity MySQL ultimately authenticated, which is important when proxies, external authentication, or account mapping are involved.
#1 Best Overall
Audit filtering is account based. MySQL documentation states that, by default, no accounts have a filter assigned, so no auditable events are processed for any account until you configure a filter. Installing the audit component alone therefore does not automatically produce authentication records.
Before you enable logging
Confirm the server version and audit implementation
The instructions below target MySQL 8.4 using the audit-log component or plugin supplied for the server edition. Component and plugin availability depends on the edition and installation you run, so confirm the appropriate MySQL Enterprise Audit installation or activation procedure for that edition before creating filters.
Recommended Free Tools
Older servers may use the legacy audit-log plugin variables described later in this guide. Do not assume that a setting documented for an older release is the preferred method on 8.4.
Choose the event scope
Decide whether you need every connection event, failed connections only, or a narrower account-specific view. Logging all connections gives the most complete trail but produces more records. Failed-only logging is useful for detecting incorrect credentials and password-guessing activity, while named-account filters reduce unrelated events.
Plan privileges and log access
Audit-filter functions require AUDIT_ADMIN or SUPER, according to the documented filtering requirements. Changing audit_log_disable at runtime requires AUDIT_ADMIN together with SYSTEM_VARIABLES_ADMIN; the deprecated SUPER privilege can also satisfy that requirement where MySQL permits it.
Audit records can contain sensitive information, including SQL text in some audit configurations. MySQL security guidance says audit files should be written to a directory accessible only to the MySQL server and users with a legitimate reason to view them. Apply restrictive operating-system permissions, define retention before enabling collection, and protect any forwarding to a SIEM or other monitoring service.
Free tools Windows power users keep installed
One-click scans. No signup required.
Enable the audit-log component or plugin
Install or enable MySQL Enterprise Audit according to the instructions for your MySQL 8.4 edition. The exact activation command and component name can differ between component-based and legacy plugin installations, so use the server’s matching Oracle MySQL procedure rather than copying a plugin command intended for a different release.
After activation, verify that the audit implementation is loaded before attempting to call audit-filter functions. If the functions are unavailable, stop and correct the installation or component-loading step; creating a filter cannot work until the audit implementation is active.
Configure a connection filter in MySQL 8.4
1. Define a JSON filter for connection events
Connect as an account with the required audit administration privilege and set a filter definition that selects the connection class:
SET @f = '{ "filter": { "class": { "name": "connection" } } }';
SELECT audit_log_filter_set_filter('log_conn_events', @f);The first statement stores the JSON definition in a session variable. The second creates or updates the named filter, log_conn_events, with the connection event class. This scope includes connection activity rather than every possible audit class.
2. Assign the filter to the default account
To apply the filter to accounts that do not have a more specific assignment, run:
SELECT audit_log_filter_set_user('%', 'log_conn_events');The % account assignment is the default-account mapping in the documented example. It records connection activity for accounts without a more specific filter assignment, including connect, change-user, and disconnect events.
3. Assign narrower filters when needed
Because assignments are account based, you can give a named account a different filter instead of relying on the default mapping. Use that pattern when administrators, applications, service accounts, or a high-volume integration need different event coverage. A specific account assignment should be treated as an intentional exception to the default policy; document it so later administrators understand why its records differ.
4. Keep the filter and account names identifiable
Use names that describe the policy, such as log_conn_events, rather than opaque labels. Clear names make it easier to audit which accounts are covered and to remove or replace a policy without guessing what it does.
Verify that successful and failed logins are recorded
Verification should be a controlled test, preferably in a non-production environment. Test both sides of the authentication path because a filter can be present while the wrong account mapping or destination is being inspected.
- Open a successful connection. Use a test account and the normal client connection method. Record the approximate test time and the account name.
- Attempt one deliberately failed connection. Supply an invalid password or otherwise use credentials that should be rejected. Do this only with a test account and a controlled procedure.
- Close the successful session. A disconnect event may be emitted separately from the initial connection event.
- Inspect the configured audit-log destination. Look for connection records around the test times and check the status values, connection ID, supplied user, authenticated user, and any proxy or external-user fields.
- Confirm the account mapping. If the failed attempt is absent, verify that the account uses the default assignment or has its own filter, and confirm that the filter name is spelled exactly as assigned.
Do not treat the absence of a file in an assumed directory as proof that logging failed. The relevant destination is the one configured for your audit installation, and its location and format depend on the server configuration.
Choose between all connections and failed connections
Legacy audit-log filtering exposes an explicit connection policy. The values have distinct meanings:
audit_log_connection_policy |
What is recorded | When it fits |
|---|---|---|
ALL |
All connection events | When you need a complete connection trail, including successful sessions and failures. |
ERRORS |
Only failed connection events | When the primary goal is failed-login monitoring and a full session trail is unnecessary. |
NONE |
No connection events | When connection logging is intentionally disabled in a legacy policy configuration. |
For a new MySQL 8.4 configuration, component filters are the more flexible approach because they let you select the connection class and assign it by account. Use the legacy policy values only when your installation uses that older filtering model and you have confirmed its startup and version requirements.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Understand the older audit_log_policy=LOGINS setting
Older configurations may set audit_log_policy=LOGINS, which logs only login events. MySQL documents audit_log_policy as deprecated and startup-only. That means it is not the preferred runtime configuration for a new deployment, and changing it requires the startup procedure applicable to the legacy plugin.
If you inherit a server using LOGINS, record that it is a legacy setting before changing it. Plan a migration to component filters or the finer connection-policy variables, test the new account assignments, and verify the resulting records before removing the old configuration.
Component filters versus legacy policies
| Decision point | MySQL 8.4 component filter | Legacy audit-log policy |
|---|---|---|
| Implementation | Audit-log component or plugin for the installed server edition. | Legacy audit-log plugin configuration. |
| Event scope | Select the connection class and define the filter in JSON; account assignments determine who is covered. |
audit_log_connection_policy supports ALL, ERRORS, or NONE; audit_log_policy=LOGINS is an older login-only option. |
| Account scope | Default assignment plus more specific per-account assignments. | Determined by the legacy policy model in use; it does not provide the same component-filter workflow. |
| Configuration timing | Filter definitions and user assignments are made with audit-filter functions at runtime. | audit_log_policy is documented as startup-only; other legacy variables follow their own documented timing rules. |
| Privileges | AUDIT_ADMIN or SUPER for audit-filter functions. |
Use the privileges required by the legacy variable or plugin operation; do not assume a client account can change it. |
| Operational risk | Can be scoped by account, but records still require protected storage and retention controls. | Broad policies can create unnecessary volume; deprecated settings also increase migration and maintenance risk. |
Use Connection Control for failed-login visibility
The Connection Control component or plugin complements audit logging. It exposes failed-login information through INFORMATION_SCHEMA.CONNECTION_CONTROL_FAILED_LOGIN_ATTEMPTS and can add delays after repeated failures.
Connection Control answers a different operational question from the audit log. Its failed-attempt information and delay behavior help identify repeated failures and slow brute-force attempts, while the audit log provides an event trail with connection status and identity fields. Enabling Connection Control does not replace assigning an audit filter, and an audit filter does not by itself provide the repeated-failure delay mechanism.
When to add it
- Add Connection Control when you need a queryable view of failed-login counts or progressive delays after repeated failures.
- Keep audit logging when you need durable connection records for investigation, compliance, or forwarding to a monitoring system.
- Test both features together so a delay or account policy does not interfere with your controlled verification procedure.
Protect, retain, and monitor the audit files
Restrict filesystem access
Place audit files in a directory that only the MySQL server and authorized log readers can access. Avoid broad directory permissions and avoid placing sensitive audit output in a location shared with application users.
Define retention before collection starts
Choose how long connection records must be retained, who may retrieve them, and how old records are removed or archived. Retention should account for the volume created by an ALL-style policy versus a failed-only policy and for any forwarding copies.
Protect forwarded copies
If an audit collector or SIEM receives the records, protect the transport and destination with the same care as the source files. Forwarding does not eliminate the need to secure the original audit directory.
Watch for sensitive fields
Audit output can contain sensitive information, including SQL text in configurations that record it. Limit access to people with a legitimate operational or security need, and avoid copying raw records into tickets, chat channels, or unsecured troubleshooting attachments.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Troubleshoot missing authentication events
No events appear for any account
- Confirm that the audit component or plugin is actually loaded for the running server.
- Check whether a filter has been assigned. By default, no accounts have one.
- Verify that the filter JSON names the
connectionclass exactly. - Confirm that the account used for testing is covered by the default assignment or a named-account assignment.
- Inspect the configured audit destination rather than an assumed file path.
Successful events appear but failed attempts do not
- Check the event status field and the time window used for inspection.
- Make sure the test failure was performed against the same server instance whose audit destination you are reading.
- If using a legacy policy, verify whether it is set to
ALL,ERRORS, orNONE. - Do not infer failed-login behavior from
audit_log_policy=LOGINSon a newer deployment without checking its deprecated, startup-only configuration.
A specific account is absent while others are logged
Review account-specific assignments. A more specific assignment can override the default-account mapping, so the account may be using another filter or no applicable filter. Correct the assignment with the required audit privilege, then repeat the controlled test.
You cannot change the audit setting
Use an account with the documented audit administration privileges. Runtime changes to audit_log_disable additionally require AUDIT_ADMIN and SYSTEM_VARIABLES_ADMIN, or the deprecated SUPER privilege where accepted.
A practical deployment checklist
- Confirm the MySQL version and the audit component or plugin available for that server edition.
- Decide whether to record all connection events, failed connections, or selected accounts.
- Grant the minimum audit administration privileges needed for setup.
- Enable the audit implementation using the matching MySQL procedure.
- Create a JSON filter for the
connectionclass. - Assign the filter to
%for default coverage, or assign named accounts deliberately. - Run a controlled successful and failed connection test outside production when possible.
- Inspect status, connection ID, supplied user, authenticated user, and proxy or external-user fields.
- Secure the audit directory, forwarding path, and retained copies.
- Add Connection Control if you also need failed-attempt counters or delays after repeated failures.
- Document any inherited legacy settings, especially deprecated
audit_log_policy=LOGINS, before migrating them.
Bottom line
On MySQL 8.4, authentication logging is enabled by loading the appropriate MySQL Enterprise Audit implementation, defining a connection-class JSON filter, and assigning it to the accounts that need coverage. The default-account assignment can capture users without specific mappings, while legacy ALL and ERRORS policies remain relevant only to older configurations. Verify both successful and failed connections, and treat the resulting audit files as sensitive security records.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
