# Audit all users login to kibana

**URL:** <https://discuss.elastic.co/t/audit-all-users-login-to-kibana/261264>\
**Category:** Kibana\
**Tags:** elastic-stack-security\
**Created:** [January 15, 2021, 1:45pm UTC](https://discuss.elastic.co/t/audit-all-users-login-to-kibana/261264 "2021-01-15T13:45:56Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![rohitarorait82](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rohitarorait82/32/82981_2.png) [@rohitarorait82](https://discuss.elastic.co/u/rohitarorait82)\
**Post date:** [January 15, 2021, 1:45pm UTC](https://discuss.elastic.co/t/audit-all-users-login-to-kibana/261264/1 "2021-01-15T13:45:56Z")

</div>

Hi All,

We are planning to give Kibana access to other users.

Now we need to monitor what all activities they are doing, who all logged in to Kibana and also if we can monitor whether same user id is getting user from multiple ids at the same time.

Can someone please suggest on this.

---

<div class="post-metadata">

**Author:** ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)\
**Post date:** [January 15, 2021, 3:39pm UTC](https://discuss.elastic.co/t/audit-all-users-login-to-kibana/261264/2 "2021-01-15T15:39:44Z")

</div>

Check out [audit logs](https://www.elastic.co/guide/en/kibana/current/xpack-security-audit-logging.html).

---

<div class="post-metadata">

**Author:** ![rohitarorait82](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rohitarorait82/32/82981_2.png) [@rohitarorait82](https://discuss.elastic.co/u/rohitarorait82)\
**Post date:** [January 15, 2021, 5:14pm UTC](https://discuss.elastic.co/t/audit-all-users-login-to-kibana/261264/3 "2021-01-15T17:14:22Z")

</div>

Hi @aaron-nimocks I have updated **xpack.security.audit.enabled to true** in kibana.yml. not sure, where to check these logs

---

<div class="post-metadata">

**Author:** ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)\
**Post date:** [January 15, 2021, 5:34pm UTC](https://discuss.elastic.co/t/audit-all-users-login-to-kibana/261264/4 "2021-01-15T17:34:36Z")

</div>

Here is a [good post](https://discuss.elastic.co/t/how-to-enable-kibana-audit-logs/223261/5) about that question.

---

<div class="post-metadata">

**Author:** ![rohitarorait82](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rohitarorait82/32/82981_2.png) [@rohitarorait82](https://discuss.elastic.co/u/rohitarorait82)\
**Post date:** [January 18, 2021, 1:01pm UTC](https://discuss.elastic.co/t/audit-all-users-login-to-kibana/261264/5 "2021-01-18T13:01:39Z")

</div>

Hi @aaron-nimocks , Thanks for the suggestion. I have gone through that link and configured kibana.yml according. Now logs are getting generated.

When I tried login using consumer credentials(passed wrong password), i can see below error. Is there a way to get the exact consumer name here. I logged in with **credit card** consumer. And also can I view this is any Kibana index instead of the log file

I just want to create a report in Kibana, where I can see ,,, which consumer tried to login , and what all queries they tried in Kibana.

I tried configureing [[https://www.elastic.co/guide/en/kibana/7.x/xpack-security-access-agreement.html](https://www.elastic.co/guide/en/kibana/7.x/xpack-security-access-agreement.html)]([https://Access](https://Access) management) but that is also not working as expected

**Error** :  
**"Logging in with provider "basic" (basic)"}**

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 15, 2021, 1:01pm UTC](https://discuss.elastic.co/t/audit-all-users-login-to-kibana/261264/6 "2021-02-15T13:01:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
