Malformed record appears at the end of the file and it looks like:
<AUDIT_RECORD NAME=</AUDIT> "Query" RECORD="40_2016-08-25T14:07:40" TIMESTAMP="2016-08-25T14:07:40 UTC" COMMAND_CLASS="select" CONNECTION_ID="122" STATUS="0" SQLTEXT="select '&;&&&""""<><<>>>>'" USER="root[root] @ localhost []" HOST="localhost" OS_USER="" IP="" DB="test" />
Note that </AUDIT> is written in the middle of <AUDIT_RECORD>. Probably footer (which is written by logger_close) interferes with the usual record written by flush thread.
Malformed record appears at the end of the file and it looks like:
<AUDIT_RECORD "40_2016- 08-25T14: 07:40" "2016-08- 25T14:07: 40 UTC" CLASS=" select" ID="122" && &" "& quot;" <> << >> >> '"
NAME=</AUDIT>
"Query"
RECORD=
TIMESTAMP=
COMMAND_
CONNECTION_
STATUS="0"
SQLTEXT="select '&;
USER="root[root] @ localhost []"
HOST="localhost"
OS_USER=""
IP=""
DB="test"
/>
Note that </AUDIT> is written in the middle of <AUDIT_RECORD>. Probably footer (which is written by logger_close) interferes with the usual record written by flush thread.