The most recent patch for this version is 26.2.1.  Learn more

Skip to main content
Version: 26.2

Audit logging

This page is the single source of truth for audit logging configuration. For general application logging, see Configure logging.

Audit logs in Access Decision Service (ADS) are detailed records that capture and store information about every authorization request the service processes. These logs are essential for monitoring, security, and compliance purposes. You can customize the audit logs to suit your deployment's needs. This includes adjusting the level of detail recorded, specifying which types of events to log, and determining how long logs should be retained.

Audit logging is disabled by default. You can enable it in the deployment.yaml configuration file, following the instructions in the Enable audit logging section.

By default, ADS generates audit logs in JSON format. You can switch to XML, which was the format used in ADS 1.x. Read the Audit log format and mode section for details. This does not apply to CAQ (Common Authorization Query) logs, which ADS always generates in XML format.

All other logging configuration options, including system log level and Logback-based log routing, are covered in Configure logging.

Logging events​

The audit logs ADS produces contain two types of logging events:

  • Evaluation Events: cover the specifics of access requests, including the queries made and the system's responses.
  • Administrative Events: focus on modifications made to the ADS configuration during runtime.

You can configure whether to include either event type in the audit logs. For detailed instructions on separating these event types within the audit log output, see Filter audit log output by event type.

By default, ADS presents evaluation event log output in a concise layout, which excludes information not essential to auditing. To configure logging to use verbose mode, refer to the Audit log format and mode section.

Audit log message character encoding​

ADS records audit log messages one per line in US-ASCII character encoding. Parameter values within these messages use a variant of the RFC 3986 URL encoding scheme (%) to represent special and reserved characters.

ADS UTF-8 encodes parameter values to octet streams and then percent-encodes them as needed.

Specifically, the logger URL-encodes the value of every parameter but excludes the following characters from encoding:

"|", "~", "!", "#", "$", "&", "'", "(", ")", "*", "+", "/", ":", ";", "?", "@", "[", "]", "-", ".", "<", ">", "\", "^", "_", "`"

Audit log samples​

note

This section is relevant only for ADS logs. CAQ logs use XML format only.

Evaluation event log - concise mode​

This snippet showcases a sample log entry in the default concise mode. The table below explains each line in detail.

{
  "DomainId": "4f1c96e8-9749-4233-b170-9560c5905904",
  "ClientIdentity": "Username%3A+ads-user",
  "ClientSource": "172.0.0.1:53633",
  "Request": {
    "Category": [
      {
        "CategoryId": "AccessSubject",
        "Attribute": [
          {
            "AttributeId": "urn:oasis:names:tc:xacml:1.0:subject:subject-id",
            "Value": "Alice"
          }
        ]
      }
    ],
    "XPathVersion": "http://www.w3.org/TR/1999/REC-xpath-19991116"
  },
  "Response": [
    {
      "Decision": "Permit",
      "Call": [
        {
          "attribute": {
            "Id": "location",
            "Category": "AccessSubject",
            "Datatype": "string"
          },
          "Values": [
            "Stockholm"
          ]
        },
        {
          "attribute": {
            "Id": "role",
            "Category": "AccessSubject",
            "Datatype": "string"
          },
          "Values": [
            "QA"
          ]
        },
        {
          "attribute": {
            "Id": "department",
            "Category": "AccessSubject",
            "Datatype": "string"
          },
          "Values": [
            "Engineering"
          ]
        }
      ]
    }
  ]
}
LineDescription
2The ID of the Authorization Domain.
3The identity of the caller. If ADS starts without authentication, ADS excludes this line.
4IP address and port number of the calling PEP (Policy Enforcement Point).
5-18The XACML request evaluated by ADS.
21The XACML decision (Permit, Deny, Not applicable, Indeterminate).
22-53Details regarding attribute Values, fetched from an Attribute Connector and used in the evaluation. The attribute object specifies the ID, category, and datatype of the attributes to which these values correspond, where:
Id - the id of the attribute
Category - the XACML category of the attribute
Datatype - the XACML datatype

Evaluation event log - verbose mode​

The following snippet showcases a sample log entry in verbose mode. The table below explains each line in detail.

{
  "DomainId": "4f1c96e8-9749-4233-b170-9560c5905904",
  "GroupVersion": "0",
  "ClientIdentity": "Username%3A+ads-user",
  "ClientSource": "172.0.0.1:53633",
  "EvaluationTimeMillis": 343,
  "InterfaceType": "REST",
  "PdpIdentity": "",
  "Request": {
    "Category": [
      {
        "CategoryId": "AccessSubject",
        "Attribute": [
          {
            "AttributeId": "urn:oasis:names:tc:xacml:1.0:subject:subject-id",
            "Value": "Alice"
          }
        ]
      }
    ],
    "XPathVersion": "http://www.w3.org/TR/1999/REC-xpath-19991116"
  },
  "Pips": [
    {
      "refId": "P1",
      "Id": "318ce3f1-c4dd-4540-be17-73766fe9afed",
      "Type": "com.axiomatics.attributeconnector.ldap.LDAPAttributeFinder",
      "Version": "0"
    },
    {
      "refId": "P2",
      "Id": "13371bff-a2db-4e17-9dba-166747dfd047",
      "Type": "com.axiomatics.attributeconnector.jdbc.SQLAttributeFinder",
      "Version": "0"
    },
    {
      "refId": "P3",
      "Id": "3c629267-2cda-4c91-bb14-ccc272c1d94e",
      "Type": "com.axiomatics.attributeconnector.table.TableAttributeFinder",
      "Version": "0"
    }
  ],
  "Attributes": [
    {
      "refId": "A3",
      "Id": "department",
      "Category": "urn:oasis:names:tc:xacml:1.0:subject-category:access-subject",
      "Datatype": "http://www.w3.org/2001/XMLSchema#string"
    },
    {
      "refId": "A1",
      "Id": "location",
      "Category": "urn:oasis:names:tc:xacml:1.0:subject-category:access-subject",
      "Datatype": "http://www.w3.org/2001/XMLSchema#string"
    },
    {
      "refId": "A2",
      "Id": "role",
      "Category": "urn:oasis:names:tc:xacml:1.0:subject-category:access-subject",
      "Datatype": "http://www.w3.org/2001/XMLSchema#string"
    }
  ],
  "Response": [
    {
      "Decision": "Permit",
      "Call": [
        {
          "attribute": {
            "Id": "location",
            "Category": "AccessSubject",
            "Datatype": "string"
          },
          "pipRef": "P1",
          "cachedValue": false,
          "Values": [
            "Stockholm"
          ]
        },
        {
          "attribute": {
            "Id": "role",
            "Category": "AccessSubject",
            "Datatype": "string"
          },
          "pipRef": "P2",
          "cachedValue": false,
          "Values": [
            "QA"
          ]
        },
        {
          "attribute": {
            "Id": "department",
            "Category": "AccessSubject",
            "Datatype": "string"
          },
          "pipRef": "P3",
          "cachedValue": false,
          "Values": [
            "Engineering"
          ]
        }
      ],
      "EvaluationComplexity": 26
    }
  ]
}
LineDescription
2The ID of the Authorization Domain.
3The object version of the Authorization Domain.
4The identity of the caller. If ADS starts without authentication, ADS excludes this line.
5IP address and port number of the calling PEP (Policy Enforcement Point).
6Evaluation time in milliseconds for this request.
7The interface by which the client contacts ADS for authorization services.
8Identity of the PDP as registered in ASM. For ADS this is always an empty string.
23-42The definition of an Attribute Connector called during evaluation, where:
refId - The evaluation unique identifier as referenced by the Call element in this evaluation to denote this Attribute Finder
Id - The unique identifier of the Attribute Connector object
Type - The Attribute Connector Type
Version - The object version of the Attribute Connector
43-62The definition of an external Attribute used during evaluation and for which values were fetched from an Attribute Finder (PIP), where
refId - The evaluation unique identifier as referenced by the Call element in this evaluation to denote this attribute
Id - the id of the attribute
Category - the XACML category of the attribute
Datatype - the XACML datatype
63-94The XACML result of the evaluation.
65The XACML Decision (Permit, Deny, Not applicable, Indeterminate).
66-103Details regarding attribute Values fetched from an Attribute Connector and used in the evaluation.
The attribute object specifies the ID, category, and datatype of the attributes to which these values correspond, where:
Id - the id of the attribute
Category - the XACML category of the attribute
Datatype - the XACML datatype
The attribute pipRef refers to the Attribute Connector these values were fetched from.
The attribute cachedValue indicates whether these values came from the cache.
104A metric indicating the complexity of the evaluation process, measured by the number of steps required.

Administrative event log example​

The following text is a sample log entry for an administrative event, with explanations in the table below:

"thread":"main","message":"Domain with id 08922b78-48f7-4147-b9eb-ae0034b6ccd0 was loaded","level":"INFO","timestamp":1629726715756,"logger":"com.axiomatics.audit.ads.admin"
ItemDescription
threadWhich thread of the log stream this entry belongs to.
messageThe event that was logged.
levelThe severity level set for the logging configuration.
timestampThe time of the event.
loggerThe logger that produced the event.

Administrative event log description

note

There is only one version of the administrative event log output. The concise/verbose option applies only to evaluation events.