SystemConfigurationAuditEventRecordingType (Complex Type)

Items

• recordResourceOids

  Flags: RAM,runtime

  Multiplicity: [0,1]

  If set to true, the resource OIDs will be recorded in the audit event records. Recording resource OIDs means additional (storage) overhead. Therefore it is turned off by default.

• expression

  Flags: RAM,runtime

  Multiplicity: [0,1]

  Optional expression to be executed to amend AuditEventRecord. Expression must return the record, return null to skip auditing for this record. Following variables are provided: - auditRecord of type AuditEventRecord (this or null is to be returned) - target (primary object), PrismObject, the type depends on the event

• property

  Flags: RAM,runtime

  Multiplicity: [0,-1]

  Specifies details how an audit event record property is created.

• escapeIllegalCharacters

  Flags: RAM,runtime

  Multiplicity: [0,1]

  Should illegal characters (like majority of 0x00-0x1F in XML 1.0) be escaped? If they occur and are not escaped, audit operation will fail. If they are stored in escaped form, audit operation will succeed but some parts of the audit records will not be correctly machine processable in the future. So the default value is "false".

• recordSessionlessAccess

  Flags: RAM,runtime

  Multiplicity: [0,1]

  There are services in midPoint that are not using concept of access session. No session is created for such services. Therefore there are no audit records about session creation or termination. Access to such services is not recorded in the audit log by default. Setting `recordSessionlessAccess` to `true` will force recording of session start/end events even for session-less services.