What are AGS Audit Logs; which events are recorded?

Short answer

AGS Audit Logs are the audit events that the AGS engine writes for each AGS-enabled vService: authentication attempts and their results, the redirection to the external provider and the return from it, the sending and the verification of the MFA code, lockout warnings, the capture of form information, access decisions and erroneous requests coming to the AGS pages. Each event is recorded with the time, Level (error, warn, success, info), the Event code, Session ID, the client IP, User Agent, the username and the message; the context of the event is seen as JSON in the preview. The events are listed on the Audit Logs tab of the vService according to the selected time range (default the last 24 hours) and the Line Limit value (default 500), and are forwarded to a SIEM with Log Forwarding profiles. Administrator operations performed in the TR7 interface are written not to this record but to the User Logs screen.

How Does It Work?

1. As the user progresses through the access flow, the AGS engine writes each important step as an event; the flow step in which the event was produced appears in the Action row of the preview.
2. On each device, the events are kept in hourly records per vService.
3. When the Audit Logs tab is opened or Refresh is clicked, the events in the selected range are read from the hourly records: the hours are read from the newest to the oldest, and the events of each hour from the beginning of that hour; the list is sorted with the newest event at the top. Line Limit is applied to each device separately; when it is reached, the reading stops, and the last events of the hour in which the limit was reached and the older hours are not taken into the list.
4. If Audit Log Forwarders are selected on the vService, the same events are also sent to the selected syslog destinations.

Level	Meaning	Example
error	An error that occurs in the flow	An address that is not found, a method that is not allowed, a request that cannot be validated
warn	A situation that does not stop the flow but requires attention	A step in which the lockout policy cannot be evaluated
success	A step completed successfully	Successful authentication, OTP verification, access permission
info	A step for information purposes	The start of an attempt, the sending of a code, a notification e-mail

Audit Logs in TR7

• Location: Left Monitor Panel → AGS-Enabled vServices → vService → Audit Logs tab. The screen is read-only; it contains no operation for editing or deleting records.
• Investigation: When Session ID is selected in the Filter strip, all the steps a session went through are seen in order; the list is also filtered with the Username, IP Address, Event and Country cards.
• Cluster: Each device records its own events; the list combines the events of the two devices with the Source column.
• Retention: The records are within the scope of the automatic disk cleanup on the Disk Management screen; they are deleted on a monthly basis with the AGS Audit Logs type in the File Management list.
• Summary view: The event counts are followed over time in the AGS Audit Events panel of the Dashboard.

Common Misconceptions

• "When I Revoke a session or restart the engine, this is written to Audit Logs." Administrator operations are written to the User Logs screen; Audit Logs contains only the events produced by the AGS engine.
• "The Sessions screen and Audit Logs give the same information." Sessions shows the sessions open at that moment; Audit Logs is a historical event record and also contains the steps of expired sessions.
• "The list shows all the events in the range." The list is limited by Line Limit; on a busy vService, the limit is raised to cover the whole range.
• "Audit Logs replaces the Load Balancer access logs." Audit Logs contains only the identity and access events of AGS; HTTP request logs are kept with the Logs profile of the vService.

How it is done in the documentation

• Audit Logs · What Is Audit Logs?
• Audit Logs · Level
• Audit Logs · Event
• Audit Logs · Scope and Limits

Related questions

• Which monitoring screens does AGS have; what does each one show?
• What are log forwarding and notification profiles for in AGS?
• How is an AGS session kept; what does the Sessions screen show?
• What does the AGS Management tab show; how are a vService's AGS settings edited from it?