audit.ini [UserAuditSettings] #

The block [UserAuditSettings] of settings/audit.ini, with 5 setting(s).

Never edit settings/audit.ini itself: an update replaces it. Put the settings you change in an override, which wins over the shipped file:

• settings/override/audit.ini.append.php for every siteaccess,
• settings/siteaccess/<siteaccess>/audit.ini.append.php for one siteaccess,
• extension/<extension>/settings/audit.ini.append.php in an extension (read when the extension is active).

UserAudit #

The user audit log (doc/eng-us/features/6.0/user-audit.md): one row per security event about a
user account or a user group in the table expuser_audit, a copy of the access channel's records
made by the sink useraudit ([AuditChannel_access] Sinks[]). Read on Users > User audit log
(user/audit, policy user/audit), filtered and exported as CSV. enabled | disabled

Default: enabled.

<?php /* #?ini charset="utf-8"?
# settings/override/audit.ini.append.php
[UserAuditSettings]
UserAudit=enabled
*/ ?>

Events #

Which events: patterns as in [AuditEventSettings]; only records naming a user account (the
account changed, signed in or refused, the user a role was assigned to) or a user group are kept.
An event the audit does not record ([AuditEventSettings]) never reaches the table either.

Default: a list of 7: access.user.*, access.role.assign, access.role.unassign, access.session.*, access.passkey.*, access.registration.*, access.permission.refused.

<?php /* #?ini charset="utf-8"?
# settings/override/audit.ini.append.php
[UserAuditSettings]
# an empty "Events[]" first replaces the shipped list; without it the items are added
Events[]
Events[]=access.user.*
Events[]=access.role.assign
Events[]=access.role.unassign
Events[]=access.session.*
Events[]=access.passkey.*
Events[]=access.registration.*
Events[]=access.permission.refused
*/ ?>

RecordIP #

The address of the request, as [AuditPrivacySettings] Field[actor.ip] leaves it (by default
shortened to /24 or /48); disabled: never stored in the table. enabled | disabled

Default: enabled.

<?php /* #?ini charset="utf-8"?
# settings/override/audit.ini.append.php
[UserAuditSettings]
RecordIP=enabled
*/ ?>

RetentionDays #

Rows older than this are removed by the cronjob part useraudit (cronjobs/useraudit.php, in the
infrequent group). 0 keeps them all.

Default: 730.

<?php /* #?ini charset="utf-8"?
# settings/override/audit.ini.append.php
[UserAuditSettings]
RetentionDays=730
*/ ?>

MaxValueLength #

The longest before or after value stored, in bytes of JSON; a longer one is cut.

Default: 2000.

<?php /* #?ini charset="utf-8"?
# settings/override/audit.ini.append.php
[UserAuditSettings]
MaxValueLength=2000
*/ ?>

Related #

• All blocks of audit.ini
• All INI files
• The settings page

Generated by ./console exp:help:examples from settings/audit.ini. Do not edit this page: change the source and generate again (how). Free documentation: GFDL 1.3 or later.