Generating and Viewing the Audit Log File
Audit log data is added to the WildFly system log file.
By default this is located at:
wildfly-x.y.z/standalone/log/insight-audit.logwhere x.y.z are the version, subversion, and patch numbers.
Audit log records are formatted according to the pattern:
<timestamp> <operation> <initiation>and each audit log record will match one in the following list:
<timestamp> ADMIN_LOGIN admin <timestamp> ADMIN_LOGOUT admin <timestamp> USER_CREATE admin <user> <timestamp> USER_NAME admin <user> <firstname> <lastname> <timestamp> USER_EMAIL admin <user> <email> <timestamp> USER_LOCAL_ACCOUNT admin <user> false <timestamp> USER_LOCKED admin <user> <timestamp> USER_UNLOCKED admin <user> <timestamp> USER_ENABLE admin <user> <timestamp> USER_DISABLE admin <user> <timestamp> USER_PASSWORD admin <user> <timestmap> USER_TABLEAU_ENABLED admin <user> true <timestamp> USER_TABLEAU_USERNAME admin <user> <tableauUsername> <timestamp> GROUP_MEMBER_ADD admin <user> <group> <timestamp> GROUP_MEMBER_REMOVE admin <user> <group> <timestamp> PROJECT_MEMBER_ADD admin <user> <projectId> <projectName> <timestamp> PROJECT_MEMBER_REMOVE admin <user> <projectId> <projectName> <timestamp> GROUP_AUTHORITY_ADD admin <group> <authority> <timestamp> GROUP_AUTHORITY_REMOVE admin <group> <authority> <timestamp> AUTHORITY_CREATE admin <authority> <timestamp> AUTHORITY_DELETE admin <authority> <timestamp> AUTHORITY_GROUP_CREATE admin <group> <timestamp> AUTHORITY_GROUP_DELETE admin <group> <timestamp> DATABASE_USER_PASSWORD admin <databaseUser>Note that when a user name, or an app/project name contains spaces, they are escaped with a backslash, so an app called Facility location would appear as Facility\ location. Similarly, if needed, a backslash is escaped with a backslash.
Example Audit Log Activity Records
Administrative user logs in:
2017-12-05 10:22:45,023 ADMIN_LOGIN adminAdmin creates a new user - JSmith:
2017-12-05 10:53:04,130 USER_CREATE admin JSmithAdmin sets the new user's first and last names - note the escaped space:
2017-12-05 10:53:04,130 USER_NAME admin JSmith John\ SmithAdmin enables Tableau and sets the Tableau user name for the new user:
2017-12-05 10:53:04,130 USER_TABLEAU_ENABLED admin JSmith true 2017-12-05 10:53:04,131 USER_TABLEAU_USERNAME admin JSmith JSmithAdmin adds the new user's email address:
2017-12-05 10:53:04,131 USER_EMAIL admin JSmith jsmith@gmail.comAdmin adds the new user to an app/project - note the escaped space in the name of the project (Quick Start):
2017-12-05 10:53:04,210 PROJECT_MEMBER_ADD admin JSmith 31af2483-571e-40d1-83a8-9e2bd95ab9e8 Quick\ Start