Audit Event Ids
This page provides an overview of all occurring audit event ids. All properties within the table are related to individual audit events. Below, you find a list of properties each audit events contains.
| Id | Name | Properties |
|---|---|---|
1000 |
Search | Tables, Columns, Queries, Sqls, Ids, ResultCount |
1010 |
ValueSearch | Column, Value, ResultCount |
1100 |
ConfigurationSaveDifference | Path, Difference |
1101 |
ConfigurationSaveDifferenceHiddenValues | Path, Difference |
1102 |
ConfigurationSaveDifferenceHiddenSecrets | Path, Difference |
1110 |
ConfigurationReload | |
1200 |
SystemRestart | |
1300 |
CreateIndex | IndexId |
1310 |
EraseIndex | IndexId |
1320 |
UpdateIndex | IndexId |
1330 |
IndexSearch | IndexId, Value, Type, ResultCount |
1340 |
IndexGetFromIds | IndexId, Ids, ResultCount |
1350 |
IndexGetAll | IndexId, ResultCount |
1360 |
IndexSearchIds | IndexId, Value, Type, ResultCount |
1370 |
IndexSearchValues | IndexId, Value, Type, ResultCount |
1380 |
IndexGetValuesFromIds | IndexId, Ids, ResultCount |
1500 |
LocalLoginSuccess | Username |
1510 |
LocalLoginFailed | Username |
1520 |
BasicAuthenticationLoginFailed | Username |
1530 |
CertificateLoginFailed | Subject, Thumbprint |
2000 |
AuthenticatedRequest | RequestUri, ReponseStatus |
2001 |
UnauthenticatedRequest | RequestUri, ReponseStatus |
General audit event properties
| Property | Description |
|---|---|
Timestamp |
ISO-8601 Timestamp |
Level |
Information |
MessageTemplate |
Plain text template |
IPAddress |
Remote ip address |
UserAgent |
Connected Agent (Header User-Agent) |
Usertype |
Type of user authentication |
User |
User(name),in regards to authentication type |
Origin |
Request origin: Api, Ui, Undefined |
Roles |
List of roles assigned to current user |
EventId |
Event id (Object with properties Id, Name). Compare with upper list. |
Application |
concrii |
ConnectionId |
Http connection id (from .net). Matches ConnectionId from within logs. |
RequestId |
Http request id (from .net). Matches RequestId from within logs. |
RequestPath |
Http request path (uri and parameter). |
ActionName |
Controller action name (from code, .net mvc). |
ActionId |
Unique id for Action (ActionName). |
Context |
Application context where audit log has been initiated. |
Important notes to audit events
Warning
Within all audit configuration examples, audit event 1100 is excluded because content of this audit record might contain secret information from your configuration files. Act wisely with your configuration files, if you decide to include these events.
Note
Within all audit configuration examples, audit event 1101 is excluded because all values from your configuration files are hidden within. Therefore , trailing configuration changes is hardly possible. For this reason, audit event id 1102 is included (better: not excluded), which combines event id 1100 and 1101 with best promise concerning security. In event id 1102, all secrets within configuration files are hidden. All secrets means, values from following property names (case insensitive): password, connectionstring, sharedsecret, clientsecret, instrumentationkey, eventcollectortoken. Properties to be handled secret can be configured, see here.
Note
Within all audit configuration examples, audit event 2000 is exculded, as it produces an audit record for every request. Having enought size available within your audit store (location), you might active it (or better: not exclude it).