understanding RDS audit log file format

Greetings,

As mentioned in the below provided documentation link, the operation is the the recorded action type for the event and the object is the value indicates the query that the database performed or for a TABLE events, it indicates the table name.

https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/AuroraMySQL.Auditing.html

If the the server_audit_events is set to TABLE, the it logs the tables that were affected by query execution. Please refer the below mentioned explanation for the logs when the server_audit_events is set to TABLE,

E.g. 1653053459680124,c731-instance-1,admin,52.94.133.136,35,698024,WRITE,testdb,test2,0

In this log record according to "timestamp, serverhost, username, host, connectionid, queryid, operation, database, object, retcode", the operation is WRITE and the object is test2 from the database testdb, and the operation done is admin on server c731-instance-1 from the source 52.94.133.136.

E.g. 1653053810763970,c731-instance-1,admin,52.94.133.136,35,701204,WRITE,mysql,proc,0

In this log record according to "timestamp, serverhost, username, host, connectionid, queryid, operation, database, object, retcode", the operation is WRITE and the object is a Stored Procedure which is created in the the database mysql, and the is operation done by admin on server c731-instance-1 from the source 52.94.133.136.

I hope the above provided information is clear and helpful!

Thanks