Verify the MariaDB Enterprise Audit plugin is loaded and actively logging: MariaDB> SHOW GLOBAL STATUS LIKE 'Server_audit_active'; If the MariaDB Enterprise Audit is not active, this is a finding. Check what filters are in place by running the following as an administrative user: MariaDB> SELECT * FROM mysql.server_audit_filters; Verify query_events includes DCL or ALL in corresponding audit filters. If not, this is a finding. In one terminal, tail the audit log file. For example: $ tail -F /var/lib/mysql/server_audit.log (default location) Open a new terminal and connect to the database. As the database administrator, create a user without special permissions: MariaDB> CREATE USER 'user_name_here'@'localhost' IDENTIFIED BY 'password_here'; As the database administrator, create a role by running the following SQL: MariaDB> CREATE ROLE 'role_name_here'; As the database administrator, GRANT role to testuser: MariaDB> GRANT 'role_name_here' TO 'user_name_here'@'localhost'; As the database administrator, add privileges to user_role for testdb, and add GRANT role to testuser: MariaDB> GRANT SELECT ON db_name_here TO 'user_name_here'@'localhost'; MariaDB> GRANT SELECT ON db_name_here TO 'role_name_here'; As the database administrator, modify privileges for testuser and user_role: MariaDB> GRANT DELETE ON db_name_here TO 'user_name_here'@'localhost'; MariaDB> GRANT DELETE ON db_name_here TO 'role_name_here'; If the audit records are not produced for successful attempts to modify privileges/permissions and roles in the first terminal, this is a finding.