Generating and Viewing the Audit Log File
wildfly-15.0.1/standalone/log/insight-audit.log
Audit log records are formatted according to the pattern:
<timestamp> <operation> <initiation>and each audit log record will match one in the following list:
<timestamp> ADMIN_LOGIN admin <timestamp> ADMIN_LOGOUT admin <timestamp> USER_CREATE admin <user> <timestamp> USER_NAME admin <user> <firstname> <lastname> <timestamp> USER_EMAIL admin <user> <email> <timestamp> USER_LOCAL_ACCOUNT admin <user> false <timestamp> USER_LOCKED admin <user> <timestamp> USER_UNLOCKED admin <user> <timestamp> USER_ENABLE admin <user> <timestamp> USER_DISABLE admin <user> <timestamp> USER_PASSWORD admin <user> <timestmap> USER_TABLEAU_ENABLED admin <user> true <timestamp> USER_TABLEAU_USERNAME admin <user> <tableauUsername> <timestamp> GROUP_MEMBER_ADD admin <user> <group> <timestamp> GROUP_MEMBER_REMOVE admin <user> <group> <timestamp> PROJECT_MEMBER_ADD admin <user> <projectId> <projectName> <timestamp> PROJECT_MEMBER_REMOVE admin <user> <projectId> <projectName> <timestamp> GROUP_AUTHORITY_ADD admin <group> <authority> <timestamp> GROUP_AUTHORITY_REMOVE admin <group> <authority> <timestamp> AUTHORITY_CREATE admin <authority> <timestamp> AUTHORITY_DELETE admin <authority> <timestamp> AUTHORITY_GROUP_CREATE admin <group> <timestamp> AUTHORITY_GROUP_DELETE admin <group> <timestamp> DATABASE_USER_PASSWORD admin <databaseUser>Note that when a user name, or an app/project name contains spaces, they are escaped with a backslash, so an app called Facility location would appear as Facility\ location. Similarly, if needed, a backslash is escaped with a backslash.
Example Audit Log Activity Records
2017-12-05 10:22:45,023 ADMIN_LOGIN adminAdmin creates a new user - JSmith:
2017-12-05 10:53:04,130 USER_CREATE admin JSmithAdmin sets the new user's first and last names - note the escaped space:
2017-12-05 10:53:04,130 USER_NAME admin JSmith John\ SmithAdmin enables Tableau and sets the Tableau user name for the new user:
2017-12-05 10:53:04,130 USER_TABLEAU_ENABLED admin JSmith true 2017-12-05 10:53:04,131 USER_TABLEAU_USERNAME admin JSmith JSmithAdmin adds the new user's email address:
2017-12-05 10:53:04,131 USER_EMAIL admin JSmith jsmith@gmail.comAdmin adds the new user to an app/project - note the escaped space in the name of the project (Quick Start):
2017-12-05 10:53:04,210 PROJECT_MEMBER_ADD admin JSmith 31af2483-571e-40d1-83a8-9e2bd95ab9e8 Quick\ Start
© 2001-2019 Fair Isaac Corporation. All rights reserved. This documentation is the property of Fair Isaac Corporation (“FICO”). Receipt or possession of this documentation does not convey rights to disclose, reproduce, make derivative works, use, or allow others to use it except solely for internal evaluation purposes to determine whether to purchase a license to the software described in this documentation, or as otherwise set forth in a written software license agreement between you and FICO (or a FICO affiliate). Use of this documentation and the software described in it must conform strictly to the foregoing permitted uses, and no other use is permitted.