What is an audit log; where are administrator actions recorded in TR7?

Short answer

An audit log is the record that keeps, in chronological order, who did what in a system, when and from where (NIST CSRC); in environments with multiple administrators, it provides the traceability of changes and accountability. In TR7, the audit log of administrator actions is the User Logs screen: vService, Backend Service and Backend Group operations, network and WAF changes (except Enable/Disable performed from the WAF-Protected vService list and Backup & Restore → Export WAF Rules), setting updates, login/logout and failed login attempts are written automatically with category (Field) and operation type (Action Type) information (What Is Logged?). Each record contains the user who performed the operation, the time, the user's IP address and browser, and the device on which the operation was performed (Source). The records can also be sent to a Syslog server or to a SIEM with Log Forwarding; if Send Change Details is on (default), the field-based change list is also sent.

Where It Is Used in TR7

Where	Field / label	What for
Settings → System Logs → User Logs	User Logs list: Date, Source, Username, User IP, User-agent, Changes, Text; the Changes column shows the number of fields changed in the operation	Tracking administrator actions retrospectively; the default range is the last 7 days, loaded with Get Logs
Same screen	Filter: Field, Action type, Subfield, Object, Outcome	Filtering by category, operation type, object and outcome (e.g. only failed operations)
Preview panel of objects	Log tab (e.g. Records preview)	Seeing only the user operations performed on that object
Settings → General Settings → Log Forwarding	Log Sources → User Logs; Send Change Details	Sending the audit log to a Syslog server or to a SIEM
Settings → General Settings → Notification Management → Notifications	Notification Type = User action; Log Type	Notification on specific user operations
Left Monitor Panel → AGS-Enabled vServices → vService → Audit Logs	Audit Logs	Authentication, MFA and lockout events of the end users who enter the application protected with AGS, not of the administrators

Common Misconceptions

• "The audit log keeps only configuration changes." Login/logout and failed login attempts are also recorded; failed logins are filtered with Field = WEB GUI access and Outcome = Failed.
• "In a cluster, it cannot be told on which device a record was made." Each record carries, in the Source column, the device on which the operation was performed.
• "User Logs and AGS Audit Logs are the same record." User Logs keeps the operations of the users who manage TR7, while AGS Audit Logs keeps the events of the end users who access the protected application.

How it is done in the documentation

• User Logs · What Is User Logs?
• User Logs · What Is Logged?
• Log Forwarding · Send Change Details
• AGS · Audit Logs

Related questions

• What is Syslog; how are TR7 logs forwarded with Syslog?
• What is a SIEM; what does sending TR7 logs to a SIEM provide?
• What is the difference between Log Forwarding and File Forwarding?