SELECT VARIABLE_VALUE FROM performance_schema.global_status WHERE VARIABLE_NAME = 'audit_log_lost_events'; If > 0, increase audit_log_buffer_size (default 1MB → set to 4–8MB).

(enable in logs):

"class": "table_access", "command": ["DROP", "ALTER", "TRUNCATE"], "log": true

SHOW STATUS LIKE 'audit_log%'; -- e.g., audit_log_current_size, audit_log_buffer_size, audit_log_lost_events (critical):

: Use ASYNCHRONOUS + separate fast disk (SSD) for audit log file. 9. Log Rotation & Management Manual rotation (closes current, reopens):

"rule": "user": "monitor_user", "log": false