# Audit log disabled categories, official documentation and audit.yml formatting are different

**URL:** <https://forum.opensearch.org/t/audit-log-disabled-categories-official-documentation-and-audit-yml-formatting-are-different/19926>\
**Category:** Security\
**Tags:** documentation\
**Created:** [June 20, 2024, 2:32pm UTC](https://forum.opensearch.org/t/audit-log-disabled-categories-official-documentation-and-audit-yml-formatting-are-different/19926 "2024-06-20T14:32:53Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Konnan](https://avatars.discourse-cdn.com/v4/letter/k/94ad74/32.png) [@Konnan](https://forum.opensearch.org/u/Konnan)\
**Post date:** [June 20, 2024, 2:32pm UTC](https://forum.opensearch.org/t/audit-log-disabled-categories-official-documentation-and-audit-yml-formatting-are-different/19926/1 "2024-06-20T14:32:53Z")

</div>

**Versions** : OpenSearch 2.14

**Describe the issue** :  
I removed all audit logs categories from the disabled categories in the GUI. So far, it works well. I would like that the audit.yml file also has the same configuration than the GUI, because if someone use the audit.yml file in the future to change settings using CLI, it might overwrite the settings that I did in the GUI.

The documentation state to use NONE in the audit.yml file but the formatting of the file in the documentation is not the same as in the audit.yml file and I don’t want to have problems. In the documentation, it seem to be a comma separated list, but in the file, it seems to be using dashes and new lines to separate options.

Documentation says to replace this:  
plugins.security.audit.config.disabled\_rest\_categories: AUTHENTICATED, GRANTED\_PRIVILEGES  
plugins.security.audit.config.disabled\_transport\_categories: AUTHENTICATED, GRANTED\_PRIVILEGES

By this:  
plugins.security.audit.config.disabled\_rest\_categories: NONE  
plugins.security.audit.config.disabled\_transport\_categories: NONE

But the file is in this format instead:  
disabled\_rest\_categories:  
- AUTHENTICATED  
- GRANTED\_PRIVILEGES

```
disabled_transport_categories:
  - AUTHENTICATED
  - GRANTED_PRIVILEGES

```

Should I use:  
- NONE

Or should I leave it empty?

Or should I use : NONE

What’s the correct way to do this?

How should I modify my audit.yml file?

Thank you very much!  
Konnan

---

<div class="post-metadata">

**Author:** ![Anthony](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/anthony/32/9939_2.png) [@Anthony](https://forum.opensearch.org/u/Anthony)\
**Post date:** [June 24, 2024, 10:05am UTC](https://forum.opensearch.org/t/audit-log-disabled-categories-official-documentation-and-audit-yml-formatting-are-different/19926/2 "2024-06-24T10:05:59Z")

</div>

Hi Konnan,  
audit.yml file can be updated as follows:

`disabled_rest_categories: []`

Another useful option to get this and other configuration syntax is to update the configuration using GUI, then use securityadmin.sh script with `-backup` option to extract the current configuration to a local drive. Root certificate should be used when running this script.

Regarding the change to documentation, I would recommend to raise an issue in the github repo [Issues · opensearch-project/documentation-website · GitHub](https://github.com/opensearch-project/documentation-website/issues)

---

<div class="post-metadata">

**Author:** ![Konnan](https://avatars.discourse-cdn.com/v4/letter/k/94ad74/32.png) [@Konnan](https://forum.opensearch.org/u/Konnan)\
**Post date:** [June 25, 2024, 12:24pm UTC](https://forum.opensearch.org/t/audit-log-disabled-categories-official-documentation-and-audit-yml-formatting-are-different/19926/3 "2024-06-25T12:24:33Z")

</div>

Hello Anthony,

Thank you very much for your detailed answer, it’s much appreciated! That’s exactly what I wanted and more hehe!

Have a nice day!  
Konnan