Log Entry File Schemas

There are four types of schemas for log file entries, as explained below.

Schema for First Line in a Log File

The first line in a log file has a unique schema that differs from the generic case. Consider the following log entry, which indicates that a new log was opened because the audit log level was changed to ADMIN-ONLY:

0,2020-08-11 19:04:54.580,INFO: Log opened on MemSQL startup. Format version 2. Log level changed to ADMIN-ONLY

The first line above demonstrates the following schema:

<log-entry-id>,<timestamp>,INFO: <log-file-event-origin>. <log-format-version>. <log-file-event-action>

This line’s schema is described in the table below:

Example Value



This value is always 0 for the first line in a logfile.


This value is identical to a normal timestamp.


Describes the reason or event that caused the creation of the log file. There are currently two possible values: Log rotated - Indicates that a new file was required because rotation conditions were met. When a log is rotated, either the auditlog_rotation_size or the auditlog_rotation_time engine variables’ conditions were met. Log opened on MemSQL startup - Indicates that a new file was created because the node was either started or restarted.


Indicates the reason or event that opened or rotated the log file. It can have the following values: Log level initiated at <Auditlog-Level> - Indicates that audit logging was first enabled at a given level and then the log file was opened. Log level changed to <Auditlog-Level> - Indicates that logging was already enabled, but the audit logging level was changed. Logging at level <Auditlog-Level> - Indicates that the system was restarted or the log was rotated, but the audit log level remained the same.

Schema for ALL-RESULTS Database Responses

If your node is configured to use the ALL-RESULTS logging mode, the database’s responses are logged uniquely from other entries. Consider the following example result entry for the SHOW VARIABLES LIKE '%master_aggregator%' query:

237,R,master aggregator

The log entry above demonstrates the following schema:


Query results share the same entry ID as the query itself. In the example above, the log entry for the query also has an <entry-id> value of 237. The comma-separated R denotes that the log entry only contains query result data. Lastly, the returned data is included as the last value in the entry.