Configure logging

For audit logging (decision logging), see Audit logging.

ADS logging is configured in the logging section of deployment.yaml. Logging covers two concerns:

• System logging: operational log output covering startup, errors, and runtime events.
• Audit logging: structured records of policy evaluation and administrative events.

System log level

Set the minimum log level using logging.level.root. The default is WARN.

logging:
  level:
    root: WARN

Supported log levels

Level	Description
OFF	Disables all logging.
FATAL	Critical errors that indicate ADS cannot continue.
ERROR	Errors that are handled but indicate faulty behavior.
WARN	Situations that are not errors but may lead to problems. Default.
INFO	General operational information about runtime state.
DEBUG	Detailed diagnostic information for developers.
TRACE	The finest level of detail, showing internal processing steps.

Audit logging

Audit logging records two types of events:

• Evaluation events: data about access requests and authorization decisions.
• Administrative events: data about runtime changes to the ADS configuration.

Enable audit logging

Set logging.level.com.axiomatics.audit to INFO in deployment.yaml:

logging:
  level:
    root: WARN
    "com.axiomatics.audit": INFO

To disable audit logging, comment out the com.axiomatics.audit line or set it to OFF.

Audit log format and mode

note

This section applies to ADS logs only. CAQ logs are available in XML format exclusively.

Audit logs can be generated in JSON or XML format, in either concise or verbose mode. Set the audit.mode property to control the output:

Value	Format	Detail level
concise_json	JSON	Concise (default)
verbose_json	JSON	Verbose
concise	XML	Concise
verbose	XML	Verbose

JSON is the default because it produces smaller log files and is easier to parse than XML.

Example: enable verbose JSON audit logging:

audit:
  mode: verbose_json

logging:
  level:
    root: WARN
    "com.axiomatics.audit": INFO

For output examples, see Audit log message format.

Filter audit log output by event type

Control which event types appear in the audit log output by declaring specific loggers:

Logger	Output
com.axiomatics.audit	Both evaluation and administrative events (default)
com.axiomatics.audit.ads.eval	Evaluation events only
com.axiomatics.audit.ads.admin	Administrative events only

Route log output with Logback

For advanced logging configuration, such as writing to files, separating event types into different outputs, controlling log format, or adjusting logger additivity, create a custom logback.xml file and reference it in deployment.yaml:

logging:
  config: <path_to_file>/logback.xml

See the Logback documentationOpens in a new tab for the full configuration reference.

Logback configuration samples

The following samples show how to configure common audit logging scenarios.

• Admin events only
• Evaluation events only
• Both events, one file
• Both events, separate files
• JSON to console

Write only administrative events to ads-admin-event.log:

logging:
  config: <path_to_file>/logbackAdmin.xml
  level:
    com:
      axiomatics:
        audit: INFO

Write only evaluation events to ads-eval-event.log:

logging:
  config: <path_to_file>/logbackEval.xml
  level:
    com:
      axiomatics:
        audit: INFO

Write both administrative and evaluation events to ads-audit.log:

logging:
  config: <path_to_file>/logbackBothAdminEval.xml
  level:
    com:
      axiomatics:
        audit: INFO

Write administrative events to ads-admin.log and evaluation events to ads-eval.log:

logging:
  config: <path_to_file>/logbackSeparateAdminEval.xml
  level:
    com:
      axiomatics:
        audit: INFO

Write all logs to the console in JSON format:

logging:
  config: <path_to_file>/logbackJSON.xml
  level:
    root: INFO
    com:
      axiomatics:
        audit: INFO

For complete Logback XML samples, see Logback samples.