Monitor specific activity log changes
For the activity log only, you can specify fields whose values are considered particularly important in terms of logging.
Fields to watch
The watchedFields property (in conf/audit.json) lets you define a list of properties that should be monitored for changes. When the value of one of the properties in this list changes, the change is logged in the activity log, under the column changedFields. This parameter enables you to have quick access to important changes in the log.
Properties to monitor are listed as values of the watchedFields property, separated by commas, for example:
"watchedFields" : [ "email", "address" ]
You can monitor changes to any field in this way.
To configure watched fields in the admin UI, select Configure > System Preferences > Audit. Scroll down to Event Topics, and click the pencil icon next to the activity event.
Password fields to watch
You can set a list of passwordFields that functions much like the watchedFields property. Changes to these property values are logged in the activity log, under the column changedFields. In addition, when a password property is changed, the boolean passwordChanged flag is set to true in the activity log. Properties that should be considered as passwords are listed as values of the passwordFields parameter, separated by commas. For example:
"passwordFields" : [ "password", "userPassword" ]
To configure password fields in the admin UI, select Configure > System Preferences > Audit. Scroll down to Event Topics, and click the pencil icon next to the activity event.