go:70] [ID=16502898290] [TIMESTAMP=2022/04/18 21:50:29.669 +08:00] [EVENT_CLASS=CONNECTION] [EVENT_SUBCLASS=Disconnect] [STATUS_CODE=0] [COST_TIME=0] [HOST=127.0.0.1] [CLIENT_IP=127.0.0.1] [USER=root] [DATABASES="[]"] go:70] [ID=16502898400] [TIMESTAMP=2022/04/18 21:50:40.198 +08:00] [EVENT_CLASS=CONNECTION] [EVENT_SUBCLASS=Reject] [STATUS_CODE=0] [COST_TIME=0] [HOST=127.0.0.1] [CLIENT_IP=127.0.0.1] [USER=ccd] [DATABASES="[]"] go:70] [ID=16502904470] [TIMESTAMP=2022/04/18 22:00:47.085 +08:00] [EVENT_CLASS=TABLE_ACCESS] [EVENT_SUBCLASS=Select] [STATUS_CODE=0] [COST_TIME=0] [HOST=127.0.0.1] [CLIENT_IP=127.0.0.1] [USER=root] [DATABASES="[test]"]

event classes. One event class can be a subclass of another event class. For example: ● The event classes for SELECT * FROM t are QUERY and SELECT. SELECT is a subclass of QUERY. ● The event classes for INSERT INTO t VALUES (1),(2),(3) are QUERY, QUERY_DML and INSERT. QUERY_DML is a subclass of QUERY, and INSERT is a subclass of QUERY_DML. ● The event classes for SET GLOBAL tidb_audit_enabled = 1 are AUDIT AUDIT, AUDIT_SET_SYS_VAR and AUDIT_ENABLE. AUDIT_SET_SYS_VAR is a subclass of AUDIT, and AUDIT_ENABLE is a subclass of AUDIT_SET_SYS_VAR. There are several advantages to distinguish between different