# Audit log configuration

**URL:** <https://forum.opensearch.org/t/audit-log-configuration/17748>\
**Category:** Security\
**Tags:** configure\
**Created:** [February 6, 2024, 10:35am UTC](https://forum.opensearch.org/t/audit-log-configuration/17748 "2024-02-06T10:35:00Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Mantas](https://avatars.discourse-cdn.com/v4/letter/m/7bcc69/32.png) [@Mantas](https://forum.opensearch.org/u/Mantas)\
**Post date:** [February 6, 2024, 10:35am UTC](https://forum.opensearch.org/t/audit-log-configuration/17748/1 "2024-02-06T10:35:00Z")

</div>

\*\* On behalf of a user of [Slack](https://opensearch.slack.com/archives/C051Y637FKK/p1706899976863069) \*\*

“We are testing audit logs. I found some requests are logged and some are not. Is this expected behavior?”

---

<div class="post-metadata">

**Author:** ![Mantas](https://avatars.discourse-cdn.com/v4/letter/m/7bcc69/32.png) [@Mantas](https://forum.opensearch.org/u/Mantas)\
**Post date:** [February 6, 2024, 10:37am UTC](https://forum.opensearch.org/t/audit-log-configuration/17748/2 "2024-02-06T10:37:50Z")

</div>

Hi Eric,

If you want to log events in all categories set below in your `audit.yml`:

```auto
plugins.security.audit.config.disabled_rest_categories: NONE
plugins.security.audit.config.disabled_transport_categories: NONE

```

For a more granular configuration refer to the: [Audit logs - OpenSearch Documentation](https://opensearch.org/docs/latest/security/audit-logs/index/#audit-log-settings) and [Audit log field reference - OpenSearch Documentation](https://opensearch.org/docs/latest/security/audit-logs/field-reference/)

Let me know if you have any questions.  
Best,  
mj