How to enable Audit Logging in Qlik Sense Enterprise on Windows

[Sonja_Bauernfeind]

Qlik Sense Audit logging allows tracking of additional information, such as user actions in the Qlik Sense Management Console.

Audit logging can be enabled individually on services and audit logs are stored in the \Audit log subfolder. 

Example: AuditActivity_Repository.txt log, located by default in %ProgramData%\Qlik\Sense\Log\Repository\Audit

Environment

Qlik Sense Enterprise on Windows 

To enable (by service):

1. Open the Qlik Sense Management Console
2. Navigate to the Service
3. Open the node to configure
4. Select Logging from the Properties menu on the right-hand side
5. Choose your desired Audit logging level

Additional logging levels

In addition to default audit logging, you can increase the Engine logging level to include user selection capture. 

1. Stop the Qlik Sense Engine service
2. Navigate to C:\ProgramData\Qlik\Sense\Engine\
3. Open the settings.ini file
4. Edit the file to add:
   

   [Settings 7]
   AuditLogAllSelection=1
   AuditLogMessageLimit=10000
   MaxCurSelEntries=6​

    
   You need an empty row after a setting in settings.ini for it to take effect. i. e. press enters after the last line.  The parameter MaxCurSelEntries is optional but can be used to increase the number of actually selected entries to be captured in the log. The default value is 6.

5. Restart the Engine service and Service Dispatcher.
6. Make selections on an application in the hub. 
7. Go to C:\ProgramData\Qlik\Sense\Log\Engine\Trace and look for a ServerName_Audit_Engine.txt.

Related Content:

Qlik Sense: Working with audit logs to check user activity on sheet/app level 
How to audit who deleted apps in the Qlik Sense Management Console  

[Sonja_Bauernfeind]

Hello @JHuis You can change the logging level in the Management Console, yes. However, you cannot bump the level all the way up to include these for the engine:

AuditLogAllSelection=1
AuditLogMessageLimit=10000
MaxCurSelEntries=6​

That needs to be done in the settings.ini file. 

All the best,
Sonja 

[JHuis]

@Sonja_Bauernfeind ,

thanks!

[stijn_verhoeff]

Hi @Sonja_Bauernfeind,

Is there any way to further specify the Audit Activity log level, beyond 'Basic' and 'Off'?

We have about 38gb of Engine AuditActivity log files for 2023 alone. Below is a summary of the amount of records per command for a single day (19 log files).

While we would definitely like insight in most of these commands, the 'Get layout' command just generates an absurd amount of records. 

[Sonja_Bauernfeind]

Hello @stijn_verhoeff, I assume you mean specifically the activity log, correct? 

This would mean these settings:

AuditLogAllSelection=1
AuditLogMessageLimit=10000
MaxCurSelEntries=6​

Please confirm if that's the one you mean. In the meantime, I will see what I can find for you. 

All the best,
Sonja 

[stijn_verhoeff]

@Sonja_Bauernfeind well, yes and no. I did mean the audit activity logs, yes. However, my question is whether we can decrease the logging level, not increase it further. 

The 'Basic' level generates a ton of log files, but we don't want to turn it 'Off' entirely either. 

[Sonja_Bauernfeind]

Aha! Thanks for clarifying, @stijn_verhoeff 

In this case, the answer is a relatively simple "currently not possible". There is no setting between off and basic for the audit log levels. 

This feedback is great though! I'd like to invite you to put together an idea and to post it here (Suggest and Browse Ideas) so our product teams can review it.

All the best,
Sonja 

[stijn_verhoeff]

@Sonja_Bauernfeind got it, thanks for the confirmation. 

I submitted it as an idea 🙂