# Audit log configuration not applying

**URL:** <https://forum.opensearch.org/t/audit-log-configuration-not-applying/14502>\
**Category:** Security\
**Tags:** troubleshoot\
**Created:** [May 30, 2023, 4:58pm UTC](https://forum.opensearch.org/t/audit-log-configuration-not-applying/14502 "2023-05-30T16:58:50Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![jamie.stewart](https://avatars.discourse-cdn.com/v4/letter/j/e274bd/32.png) [@jamie.stewart](https://forum.opensearch.org/u/jamie.stewart)\
**Post date:** [May 30, 2023, 4:58pm UTC](https://forum.opensearch.org/t/audit-log-configuration-not-applying/14502/1 "2023-05-30T16:58:50Z")

</div>

**Versions** (relevant - OpenSearch):

v2.7.0

**Describe the issue** :

When applying audit log settings they do not take effect. See screenshot of the configuration not being applied. Its also worth pointing out i removed the ignore\_users setting as it was throwing an error.

```auto
plugins.security.audit.config.ignore_users:
  - kibanaserver
  - filebeat

```

The work around is to use the UI to configure however this is not efficient for us as its an additional step following installation and every time we re-apply our code for configuration updates the configuration gets removed and requires re-applying via the UI.

Any help would be really appreciated to get this fixed.

**Configuration** :

```auto
plugins.security.audit.config.index: "security-auditlog-'YYYY.MM.dd'"
plugins.security.audit.type: internal_opensearch
plugins.security.allow_unsafe_democertificates: false
plugins.security.allow_default_init_securityindex: false
plugins.security.audit.config.enable_rest: true
plugins.security.audit.config.enable_transport: true
plugins.security.audit.config.log_request_body: true
plugins.security.audit.config.resolve_indices: true
plugins.security.audit.config.disabled_rest_categories: NONE
plugins.security.audit.config.disabled_transport_categories: NONE

```

**Relevant Logs or Screenshots** :

 ![Screenshot 2023-05-30 at 17.44.48](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/9/9aa1928e33a9b8f15d91ee74fdefc435dbcd795f.png)

---

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\
**Post date:** [May 31, 2023, 11:07am UTC](https://forum.opensearch.org/t/audit-log-configuration-not-applying/14502/2 "2023-05-31T11:07:25Z")

</div>

@jamie.stewart I did some testing with just `plugins.security.audit.config.enable_rest`. I’ve set it to false and tried to disable audit logging at REST.

It didn’t work in 2.7, 1.0.0 and OpenDistro 1.13.2. 1.9.0 (opendistro\_security.audit.enable\_rest). It looks like this never worked.  
I was able to disable auditing REST with UI only.

There is already a bug reported in the OpenSearch Security plugin.

> <https://github.com/opensearch-project/security/issues/2673>
>
> \*\*What is the bug?\*\*
> I am using Opensearch v2.2.1 and have enabled audit loggin…g. I observed that few setting parameters are not taking any effect and not working. Below is the configuration I have added in opensearch.yml file after following documentation: \[Audit logs - OpenSearch documentation\](https://opensearch.org/docs/2.2/security/audit-logs/index/)
> 
> \*\*How can one reproduce the bug?\*\*
> Add below configuration in the opensearch.yml file and install opensearch 
> plugins.security.audit.type: log4j
> plugins.security.audit.config.log4j.logger\_name: audit
> plugins.security.audit.config.log4j.level: INFO
> plugins.security.audit.config.disabled\_rest\_categories: NONE
> plugins.security.audit.config.disabled\_transport\_categories: NONE
> plugins.security.audit.ignore\_users: NONE
> 
> 
> \*\*What is the expected behavior?\*\*
> All audit event categories should get logged and no user should get ignored and should emit logs for even kibanaserver and authenticated and granted\_privileges category.
> 
> \*\*What is your host/environment?\*\*
> - Opensearch v2.2.1
> 
> 
> \*\*Do you have any additional context?\*\*
> For plugins.security.audit.config.disabled\_rest\_categories and plugins.security.audit.config.disabled\_transport\_categories it is not throwing any error, however it is not having any impact.
> For plugins.security.audit.ignore\_users setting it throws below error:
> org.opensearch.bootstrap.StartupException: java.lang.IllegalArgumentException: unknown setting \[plugins.security.audit.ignore\_users\] did you mean \[plugins.security.audit.config.username\]?
> 
> 
> This same error about unknown setting is coming for many other settings mentioned in the documentation: https://opensearch.org/docs/2.2/security/audit-logs/index/

---

<div class="post-metadata">

**Author:** ![jamie.stewart](https://avatars.discourse-cdn.com/v4/letter/j/e274bd/32.png) [@jamie.stewart](https://forum.opensearch.org/u/jamie.stewart)\
**Post date:** [May 31, 2023, 11:49am UTC](https://forum.opensearch.org/t/audit-log-configuration-not-applying/14502/3 "2023-05-31T11:49:42Z")

</div>

Thanks for the info.