# Audit Logs for OpenDistro

**URL:** <https://forum.opensearch.org/t/audit-logs-for-opendistro/3921>\
**Category:** Security\
**Created:** [October 12, 2020, 11:23am UTC](https://forum.opensearch.org/t/audit-logs-for-opendistro/3921 "2020-10-12T11:23:52Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Kain\_Nillian](https://avatars.discourse-cdn.com/v4/letter/k/ce7236/32.png) [@Kain\_Nillian](https://forum.opensearch.org/u/Kain_Nillian)\
**Post date:** [October 12, 2020, 11:23am UTC](https://forum.opensearch.org/t/audit-logs-for-opendistro/3921/1 "2020-10-12T11:23:52Z")

</div>

Hello,

The problem is the following. I have followed the instructions in [Audit Logs - Open Distro Documentation](https://opendistro.github.io/for-elasticsearch-docs/docs/security/audit-logs/)  
But it seems that this part does not work:

> After this initial setup, you can use Kibana to manage your audit log categories and other settings. In Kibana, choose **Security** , **Audit logs**.

I do not have Audit Logs tab in Security window.  
Also I am not able to find Audit Logs.

My elasticsearch.yml has this settings:  
opendistro\_security.audit.type: internal\_elasticsearch  
opendistro\_security.audit.config.index: “'elk-test-audit-'YYYY.MM.dd”  
opendistro\_security.audit.ignore\_users: NONE  
opendistro\_security.audit.enable\_rest: true  
opendistro\_security.audit.enable\_transport: true

I am running OpenDistro version `1.7.0.0`  
Please help.

---

<div class="post-metadata">

**Author:** ![nickname1](https://avatars.discourse-cdn.com/v4/letter/n/5f9b8f/32.png) [@nickname1](https://forum.opensearch.org/u/nickname1)\
**Post date:** [October 12, 2020, 2:26pm UTC](https://forum.opensearch.org/t/audit-logs-for-opendistro/3921/2 "2020-10-12T14:26:18Z")

</div>

> [@Kain\_Nillian](#):
>
> I am running OpenDistro version `1.7.0.0`  
> Please help.

The “Security, Audit logs” tab is only available from 1.10.1 version.

---

<div class="post-metadata">

**Author:** ![Kain\_Nillian](https://avatars.discourse-cdn.com/v4/letter/k/ce7236/32.png) [@Kain\_Nillian](https://forum.opensearch.org/u/Kain_Nillian)\
**Post date:** [October 13, 2020, 6:16am UTC](https://forum.opensearch.org/t/audit-logs-for-opendistro/3921/3 "2020-10-13T06:16:17Z")

</div>

Ok, thanks. But what about Audit Logs? I still don’t have AUTHENTICATED, GRANTED\_PRIVILEGES, etc. logs?

---

<div class="post-metadata">

**Author:** ![Anthony](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/anthony/32/9939_2.png) [@Anthony](https://forum.opensearch.org/u/Anthony)\
**Post date:** [February 18, 2021, 9:01pm UTC](https://forum.opensearch.org/t/audit-logs-for-opendistro/3921/4 "2021-02-18T21:01:27Z")

</div>

@Kain_Nillian The below lines needs to be added to the elasticsearch file:

opendistro\_security.audit.config.disabled\_rest\_categories: NONE  
opendistro\_security.audit.config.disabled\_transport\_categories: NONE

Hope this helps