1. set server_audit_events = 'connect' and keep default rotate size of 1000000.

2. connect with a bad password about 20 times: for i in {1..20}; do mysql -ufail -pfail; done

3. see that server_audit.log is X bytes

4. set server_audit_rotate_size = 1000

5. connect with bad password for another 20 times

6. see original server_audit.log is still X bytes (meaning log rotated immediately) and subsequent server_audit.log.* logs are ~1000 bytes or less