From testing comments:

> - set global server_audit_file_rotate_now=off rotates the log;
Right. Any value assigned to it supposed to rotate the log.
In fact it's the STRING variable, not BOOLEAN

Right, and this is weird. It's boolean by nature, so make it such. No inventions needed, there are already '%now' examples in MySQL 5.6 (innodb_buffer_pool_dump_now, innodb_buffer_pool_load_now), they work predictably and reasonably:

• if I set them to ON, 'ON' or 1, they do the job;
• if I set them to OFF, 'OFF' or 0, they don't do the job;
• if I set them to "maybe sometimes later", they produce an error;
• when I do 'show variables', they are shown as OFF, which, I presume, means they are not dumping/loading now (I don't know if they show ON when they are).

In our case, for server_audit_file_rotate_now,

• if I set it to ON, 'ON', OFF, 'OFF', '', 'maybe sometimes later', it still rotates;
• if I set it to 1 or 0, it produces an error;
• when I do 'show variables', it is shown as an empty string, which, since an empty string triggers the rotation, must mean that it's rotating right now.

From testing comments:

> - set global server_audit_file_rotate_now=1 does not rotate the log;
That's quite weird. Can't repeat on my computer.

This is very easy to repeat.

MariaDB [test]> set global server_audit_file_rotate_now = 1;

ERROR 1232 (42000): Incorrect argument type to variable 'server_audit_file_rotate_now'

Which is not exactly surprising, if it's a string variable.