Audit logs not updating properly

Elastic Stack Elasticsearch
1

Hi Folks

I'm facing an issue in elasticsearch audit logs part. Audit logs not updating after somtime during restart.

Configuration details

Kindly go through the below log4j2.properties file
`status = error

appender.console.type = Console
appender.console.name = console
appender.console.layout.type = PatternLayout
appender.console.layout.pattern = [%d{ISO8601}][%-5p][%-25c{1.}] [%node_name]%marker %m%n

rootLogger.level = info
rootLogger.appenderRef.console.ref = console

appender.audit_rolling.type = RollingFile
appender.audit_rolling.name = audit_rolling
appender.audit_rolling.fileName = {sys:es.logs.base_path}{sys:file.separator}{sys:es.logs.cluster_name}_audit.log appender.audit_rolling.layout.type = PatternLayout appender.audit_rolling.layout.pattern = [%d{ISO8601}] %m%n appender.audit_rolling.filePattern = {sys:es.logs.base_path}{sys:file.separator}{sys:es.logs.cluster_name}_audit-%d{yyyy-MM-dd}.log
appender.audit_rolling.policies.type = Policies
appender.audit_rolling.policies.time.type = TimeBasedTriggeringPolicy
appender.audit_rolling.policies.time.interval = 1
appender.audit_rolling.policies.time.modulate = true

logger.xpack_security_audit_logfile.name = org.elasticsearch.xpack.security.audit.logfile.LoggingAuditTrail
logger.xpack_security_audit_logfile.level = info
logger.xpack_security_audit_logfile.appenderRef.audit_rolling.ref = audit_rolling`

elasticsearch.yml
xpack.security.enabled: true
xpack.security.audit.enabled: true

Elasticsearch version : 6.8.2

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.