# Auditing for kibana **URL:** \ **Category:** Kibana\ **Tags:** elastic-stack-security\ **Created:** [February 24, 2022, 5:15pm UTC](https://discuss.elastic.co/t/auditing-for-kibana/298197 "2022-02-24T17:15:35Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![aman123](https://avatars.discourse-cdn.com/v4/letter/a/e47774/32.png) [@aman123](https://discuss.elastic.co/u/aman123)\ **Post date:** [February 24, 2022, 5:15pm UTC](https://discuss.elastic.co/t/auditing-for-kibana/298197/1 "2022-02-24T17:15:35Z")
Hi All, I'm trying to enable the auditing for kibana by adding the below configuration in the kibana.yml file xpack.security.audit.enabled: true and setting the logging destination option to the /var/log/kibana.log. After doing all above still the file kibana.log is not created in that directory and no logs are there. Requirement is to get the user details who are accessing the kibana. I have platinum subcription type for Elasticsearch. Please guide me how can I enable the auditing for kibana. ---
**Author:** ![sholzhauer](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sholzhauer/32/110282_2.png) [@sholzhauer](https://discuss.elastic.co/u/sholzhauer)\ **Post date:** [February 24, 2022, 6:10pm UTC](https://discuss.elastic.co/t/auditing-for-kibana/298197/2 "2022-02-24T18:10:03Z")
Hi, Auditing isn't done on the kibana service but on the Elasticsearch service. Try doing the same but on your elastic node and in `elasticsearch.yml`. I recommend just adding the `xpack.security.audit.enabled: true` and leaving the rest. You can then find your audit log events in `/var/log/elasticsearch/*_audit.json` Which in turn can be ingested by [filebeats elasticsearch module](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-elasticsearch.html) for easy searching. ---
**Author:** ![aman123](https://avatars.discourse-cdn.com/v4/letter/a/e47774/32.png) [@aman123](https://discuss.elastic.co/u/aman123)\ **Post date:** [February 25, 2022, 11:10am UTC](https://discuss.elastic.co/t/auditing-for-kibana/298197/3 "2022-02-25T11:10:19Z")
will it provide info of the users who access the kibana? and after adding xpack.security.audit.enabled: true, do I need to restart the Elasticsearch service? ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [February 25, 2022, 2:01pm UTC](https://discuss.elastic.co/t/auditing-for-kibana/298197/4 "2022-02-25T14:01:21Z")
There is [Audit in Kibana](https://www.elastic.co/guide/en/kibana/current/xpack-security-audit-logging.html#xpack-security-audit-logging) as well, not only in Elasticsearch. Your configuration is correct and issue is probably because the kibana user does not have permissions to write in the `/var/log` directory. Try to create a `/var/log/kibana/` directory, give the ownership of the directory `/var/log/kibana/` to the `kibana` user and change your `logging.dest` to point to `/var/log/kibana/kibana.log`. After you restart the service Kibana should be able to create the log file. ---
**Author:** ![sholzhauer](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sholzhauer/32/110282_2.png) [@sholzhauer](https://discuss.elastic.co/u/sholzhauer)\ **Post date:** [February 25, 2022, 3:13pm UTC](https://discuss.elastic.co/t/auditing-for-kibana/298197/5 "2022-02-25T15:13:46Z")
> [@leandrojmp](#): > > There is [Audit in Kibana](https://www.elastic.co/guide/en/kibana/current/xpack-security-audit-logging.html#xpack-security-audit-logging) as well, not only in Elasticsearch. My bad 😓 ---
**Author:** ![aman123](https://avatars.discourse-cdn.com/v4/letter/a/e47774/32.png) [@aman123](https://discuss.elastic.co/u/aman123)\ **Post date:** [February 25, 2022, 3:51pm UTC](https://discuss.elastic.co/t/auditing-for-kibana/298197/6 "2022-02-25T15:51:12Z")
Hi Leandrojmp, thanks for the solution, its working now but the logs doesn't shows users' information. Is there any way to get info of the users who are accessing the kibana tool. ---
**Author:** ![aman123](https://avatars.discourse-cdn.com/v4/letter/a/e47774/32.png) [@aman123](https://discuss.elastic.co/u/aman123)\ **Post date:** [February 25, 2022, 3:54pm UTC](https://discuss.elastic.co/t/auditing-for-kibana/298197/7 "2022-02-25T15:54:37Z")
in logs the user-agent will give us the users right? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 25, 2022, 3:54pm UTC](https://discuss.elastic.co/t/auditing-for-kibana/298197/8 "2022-03-25T15:54:50Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.