About the Audit Logging Service
AM writes log messages generated from audit events triggered by its instances, web or Java agents, the ssoadm tool, and connected ForgeRock Identity Platform implementations.
AM's Audit Logging Service provides a versatile and rich feature set as follows:
Global and Realm-Based Log Configuration. You can configure audit logging globally, which ensures that all realms inherit your global log settings. You can also configure audit logging by realm, which allows you to set different log settings for each realm.
Audit Event Handlers. The Audit Logging Service supports a variety of audit event handlers that allow you to write logs to different types of data stores. See "Configuring Audit Event Handlers" for a list of event handlers available in AM.
Audit Event Buffering. By default, AM writes each log message separately as they are generated. AM supports message buffering, a type of batch processing, that stores log messages in memory and flushes the buffer after a preconfigured time interval or after a certain number of log messages reaches the configured threshold value.
Tamper-Evident Logging for the CSV audit event handler. You can digitally sign your audit to enable the detection of tampering.
Log Rotation and Retention Policies. AM rotates JSON and CSV audit logs when it reaches a specified maximum size. You can also configure a time-based rotation policy, which disables the max-size rotation policy and implements log rotation based on a preconfigured time sequence. AM also provides the option to disable log rotation completely for these file types. AM does not support external log rotation for JSON and CSV audit logs.
For Syslog, JDBC, JMS, and Splunk handlers, AM does not control log rotation and retention as they are handled by each respective service.
Blacklist and Whitelist Support. The Audit Logging Service supports whitelist and blacklist-filtering to show or hide sensitive values or fields in the logs, such as HTTP headers, query parameters, cookies, profile attributes, or the entire field value.
Reverse DNS Lookup. The Audit Logging Service supports a reverse DNS lookup feature for network troubleshooting purposes. Reverse DNS lookup is disabled by default as it enacts a performance hit in operation throughput.
Audit Log Topics
AM integrates log messages based on four different audit topics. A topic is a category of audit log event that has an associated one-to-one mapping to a schema type. Topics can be broadly categorized as access details, system activity, authentication operations, and configuration changes. The following table shows the basic event topics and associated audit log files for AM's default audit logging configuration, which uses a JSON audit event handler:
| Event Topic | File Name | Description |
|---|---|---|
| Access | access.audit.json | Captures who, what, when, and output for every access request. |
| Activity | activity.audit.json | Captures state changes to objects that have been created, updated, or deleted by end users (that is, non-administrators). Session, user profile, and device profile changes are captured in the logs. |
| Authentication | authentication.audit.json | Captures when and how a subject is authenticated and related events. |
| Configuration | config.audit.json | Captures configuration changes to the product with a timestamp and by whom. Note that the |
Audit Logging in Web and Java Agents
Web and Java agents log audit events for security, troubleshooting, and regulatory compliance. You can store web or Java agent audit event logs in the following ways:
Remotely. Log audit events to the audit event handler configured in the AM realm.
Locally. Log audit events to a file in the web or Java agent installation directory.
For more information about audit logs in agents, see the ForgeRock Web Agents User Guide and the ForgeRock Java Agents User Guide.