Free tools Windows power users keep installed
One-click scans. No signup required.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
To log MySQL authentication activity, configure the server’s audit-log component or plugin; there is no client-side switch. In MySQL 8.4, create a JSON audit filter for the connection event class and assign it to the accounts you want to monitor. Assigning the filter to % provides a default for accounts without a more specific filter.
For failed-logins-only monitoring, legacy audit filtering supports the ERRORS connection policy. Older installations may also use audit_log_policy=LOGINS, but that setting is deprecated and startup-only. Connection Control can expose failed-login counters and add delays after repeated failures, complementing rather than replacing audit logs.
What MySQL authentication logging records
MySQL authentication logging is part of server-side auditing. The audit log can record connection activity, including successful connections, rejected connection attempts, CHANGE USER operations, and disconnects. A connection event contains useful context such as the event status, connection ID, supplied user name, authenticated user, and proxy or external-user fields.
The audit system is account based. A filter must be assigned to an account before its auditable events are processed. Oracle’s documentation states that, by default, no accounts have a filter assigned, so no auditable events are processed until an administrator configures one.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
Logging every connection gives the strongest investigative record but produces more data. Logging only errors reduces volume and is often appropriate when the immediate goal is detecting password guessing or invalid credentials. Named-account filters let you apply detailed logging to administrative or sensitive service accounts without automatically auditing every user.
Choose the logging method for your MySQL version
| Approach | Event scope | Account scope | Configuration characteristics | When to use it |
|---|---|---|---|---|
| MySQL Enterprise Audit component or plugin | Filters can target the connection class, including successful and failed connection activity. |
Named accounts or a default assignment such as %. |
Filter definitions and assignments are made with audit functions; availability depends on the server edition and whether the component or plugin is installed. | Preferred approach for MySQL 8.4 deployments that provide Enterprise Audit. |
audit_log_connection_policy |
ALL logs all connection events, ERRORS logs failed connection events, and NONE logs no connection events. |
Controlled by the legacy audit-log configuration rather than the component’s per-account filter model. | Use the variable format and change method supported by your installed audit implementation. | Useful on installations still using legacy audit-log filtering, especially for failed-login-only collection. |
audit_log_policy=LOGINS |
Login events only. | Legacy audit policy scope. | Deprecated and startup-only; it is not the preferred design for new configurations. | Only when maintaining an older deployment that already depends on it. |
| Connection Control | Failed-login information and repeated-failure delay behavior. | Applies to failed-login tracking handled by the component or plugin. | Exposes counters through INFORMATION_SCHEMA.CONNECTION_CONTROL_FAILED_LOGIN_ATTEMPTS. |
Use alongside audit logging for brute-force visibility and response. |
Before changing settings, confirm which implementation your edition supplies. Enterprise Audit component functions and legacy plugin variables are not interchangeable, and a configuration written for one may have no effect on the other.
Check the server and your administrative privileges
Authentication logging must be enabled on the MySQL server. A client application cannot turn on server audit collection by changing its own connection options. First identify the server version and inspect installed components or plugins.
- Connect with an administrative account over the same type of interface used by your production clients.
- Check the version:
SELECT VERSION();- Inspect installed plugins and confirm that the audit implementation supplied for your edition is present:
SHOW PLUGINS;The exact installation or activation procedure depends on the server edition and whether you are using the component or legacy plugin. Do not assume that an audit function exists simply because the server is running MySQL 8.4; verify that the relevant implementation is installed and enabled.
Audit-filter functions require the AUDIT_ADMIN privilege or the older SUPER privilege, according to the documented filtering rules. Changing the runtime audit_log_disable setting requires AUDIT_ADMIN together with SYSTEM_VARIABLES_ADMIN, or the deprecated SUPER privilege. Use a dedicated administrative identity and grant only what is needed for the change.
Enable a MySQL 8.4 connection audit filter
The current component-based method is to define a JSON filter whose class name is connection, then assign that filter to accounts. The following example is the documented pattern for a default assignment:
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
SET @f = '{ "filter": { "class": { "name": "connection" } } }';
SELECT audit_log_filter_set_filter('log_conn_events', @f);
SELECT audit_log_filter_set_user('%', 'log_conn_events');1. Define the filter JSON
The first statement stores the filter document in a session variable. The filter name in this example is log_conn_events; choose a name that identifies its purpose and keep it consistent in your change records. The JSON selects the connection class rather than unrelated audit classes.
2. Register the filter
audit_log_filter_set_filter() creates or replaces the named filter using the JSON document. A successful function call means the filter definition was accepted; it does not by itself cause any account to be audited.
3. Assign the filter
audit_log_filter_set_user() associates the filter with an account pattern. In the example, % is the default-account assignment. It applies to accounts that do not have a more specific filter assignment. This is why the example can cover newly created accounts while still allowing exceptions for named users.
When you need narrower scope, assign the filter to the specific account identity supported by your server’s audit-filter syntax instead of using %. Create separate filters when different groups need different event classes; do not rely on a broad default assignment if a privileged account must have a stricter policy.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Scope logging to selected accounts
Account-based filtering is useful when a full connection trail would be unnecessarily large or would expose more user activity than your monitoring purpose requires. Common scopes include administrative accounts, application service accounts, and identities used by external authentication or proxy layers.
- Default coverage: Assign the connection filter to
%so accounts without a specific assignment are covered. - Named coverage: Assign a filter directly to a sensitive account when you need a policy that is independent of the default.
- Different event classes: Use separately named JSON filters when one account requires connection events and another requires a different audit scope.
- Exceptions: Review existing specific assignments before changing the default. A specific assignment can take precedence over the default account assignment.
Document each assignment with its purpose, owner, and expected retention. An account can appear in an audit record under both supplied and authenticated identities, so account names alone may not explain every authentication path when proxy or external-user fields are involved.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
Verify that successful and failed logins are being recorded
Verification should be deliberate and should not use a production account that could be locked, delayed, or otherwise affected by repeated failures.
- Apply the filter and assignment with the administrative session.
- Open a separate test connection with valid credentials for an account covered by the assignment.
- Close that connection normally so the connection and disconnect activity can be distinguished.
- In a non-production environment, make one deliberately invalid connection attempt using a controlled test identity.
- Inspect the configured audit-log destination for connection events and compare their status values with the test outcomes.
Connection records can include the connection ID, supplied user, authenticated user, proxy or external-user information, and an event status indicating whether the operation succeeded. Use those fields to distinguish an invalid password from a connection made through a proxy identity or a user switch.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →If the test creates no event, first confirm that the account really matches the assignment and that a more specific assignment is not overriding the default. Then verify that the audit component or plugin is enabled, that auditing has not been disabled, and that you are examining the destination configured for this server instance rather than a different replica or container.
Log only failed connection attempts with legacy filtering
Legacy audit-log filtering provides a direct failed-login mode through audit_log_connection_policy. The accepted values are:
| Value | Result |
|---|---|
ALL |
Records all connection events. |
ERRORS |
Records failed connection events only. |
NONE |
Records no connection events. |
Set the variable using the configuration and restart procedure required by your installed audit implementation. Check the variable’s dynamic or startup behavior for your exact version before attempting a runtime change; do not assume that a setting accepted in a configuration file can also be changed safely in a live session.
ERRORS is appropriate when the primary requirement is failed-login detection and the additional context of successful connections is not needed. It does not provide a complete account-access history, so incident investigations that require proof of successful access should use ALL or a component filter that captures the full connection class.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
Understand the deprecated audit_log_policy=LOGINS setting
Older MySQL configurations may contain audit_log_policy=LOGINS. MySQL documents this policy as deprecated and startup-only. It logs login events, but it is less flexible than component filters and the connection-policy values.
Do not select LOGINS for a new design merely because it appears in an existing configuration file. For a current deployment, prefer the component’s JSON filters when Enterprise Audit is available. If you must maintain an older server that uses LOGINS, record that dependency, apply changes through the required startup process, and plan a migration after confirming the replacement’s event and account scope.
Use Connection Control for failed-login counters and delays
Audit logging answers “what connection events occurred?” Connection Control addresses a related operational question: “How many failed attempts are associated with an account, and should repeated failures be slowed?”
The component or plugin exposes failed-login information through INFORMATION_SCHEMA.CONNECTION_CONTROL_FAILED_LOGIN_ATTEMPTS. It can also add delays after repeated failures. These controls help reveal password-guessing activity and make rapid retries less effective, but they do not replace the audit trail. Keep both mechanisms when you need event details for investigation and active response to repeated failures.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Test delay behavior with a dedicated non-production identity. Repeated invalid attempts against a real user can create operational delays and may interfere with incident-response testing.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Protect the audit destination
Audit records can contain sensitive information, including account identities and, depending on the audited classes and configuration, SQL text. Oracle’s security guidance says that audit-log files should be written to a directory accessible only to the MySQL server and to users with a legitimate reason to view the log.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
- Use filesystem permissions that allow the MySQL service to write and restrict readers to approved administrators or log-collection agents.
- Separate audit files from general application logs when different teams have different access rights.
- Define a retention period that matches your incident-investigation and compliance requirements.
- Protect logs in transit when forwarding them to a SIEM or centralized collector.
- Restrict access to exported copies, backups, and temporary files as well as the live directory.
- Monitor disk capacity so a full filesystem does not silently interrupt normal logging or other server functions.
Do not treat a successful filter assignment as proof that the log is protected. Filesystem ownership, directory permissions, backup policy, forwarding credentials, and retention settings are separate controls that must be reviewed.
Troubleshoot common failures
No connection events appear
- Confirm the audit component or plugin is installed and enabled with
SHOW PLUGINS. - Check that the filter name passed to
audit_log_filter_set_user()exactly matches the filter registered byaudit_log_filter_set_filter(). - Verify that the test account matches the assigned account pattern.
- Look for a more specific account assignment that overrides the default
%assignment. - Confirm that auditing has not been disabled and that you are reading the destination for the correct server instance.
- Check the MySQL service account’s permission to create or append to the configured audit destination.
The filter function returns a privilege error
Use an account with AUDIT_ADMIN or the documented legacy SUPER privilege for filter operations. If the operation also changes audit_log_disable, the runtime variable requires AUDIT_ADMIN and SYSTEM_VARIABLES_ADMIN, or the deprecated SUPER privilege. Ask for the narrow privilege needed instead of granting unrestricted administrative access permanently.
Only failed attempts are visible
Check whether the server is using legacy audit_log_connection_policy=ERRORS. That setting intentionally excludes successful connections. Change to ALL, or use a component filter for the connection class, when a complete connection history is required.
Changing a variable has no immediate effect
audit_log_policy=LOGINS is startup-only, and other legacy settings may also have version-specific dynamic behavior. Confirm the variable’s documented scope for the installed version and restart only through your normal change-management procedure.
The log is visible to too many users
Correct directory and file ownership, remove broad group or world permissions, and review access to forwarded copies and backups. Restricting the MySQL data directory alone is not enough if the audit destination is stored elsewhere.
Choose an operating pattern
| Requirement | Recommended configuration | Trade-off |
|---|---|---|
| Complete connection history for most accounts | Component filter for the connection class assigned to %. |
More events and larger audit files; stronger reconstruction of successful and failed access. |
| Detailed monitoring for a small set of privileged accounts | Named-account assignment with a connection filter, optionally combined with a narrower default policy. | Lower volume, but unlisted accounts may not have a complete trail. |
| Failed-login detection only | Legacy audit_log_connection_policy=ERRORS where that implementation is required, plus Connection Control for counters and delays. |
Efficient for brute-force monitoring, but successful access is not recorded by the errors-only policy. |
| Existing older deployment using login policy | Keep audit_log_policy=LOGINS only as a documented compatibility measure and plan migration to component filters. |
Startup-only and deprecated, with less granular scope. |
Maintain and review the configuration
Authentication logging is useful only when someone can interpret and retain it. Review the account assignments whenever users are created, renamed, removed, or moved behind a proxy. Re-test after MySQL upgrades, audit-component changes, filesystem migrations, and SIEM pipeline changes.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallKeep a record of filter names, JSON definitions, account assignments, the server edition, and the date each change became active. Periodically generate one successful and one controlled failed test event in a non-production environment, then verify that the expected fields reach the protected destination. Review retention and access permissions at the same time.
Bottom line
For MySQL 8.4, enable the available Enterprise Audit component or plugin, define a JSON filter for the connection class, and assign it to the required accounts—often using % as the default. Use ERRORS only when a legacy deployment specifically needs failed connections, treat audit_log_policy=LOGINS as deprecated, and pair audit records with Connection Control when repeated failures require counters or delays.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
