If I add audit_log_include_accounts=<any account> to my.cnf and restart MySQL, it will stop logging anything to audit log. However, if I run "set global audit_log_include_accounts='...' it will take effect.
How to repeat (enable audit plugin first):
- Add audit_log_include_accounts=root@localhost to my.cnf and restart
- Login as root@localhost and watch audit.log - nothing goes there, try with another user - same effect, nothing being logged
mysql> set global audit_log_include_accounts = 'root@localhost';
Query OK, 0 rows affected (0.00 sec)
and login as root from another session. Audit.log will have entries. Everything now works as expected.