Users searches in Audit Log

Graylog Central (peer support)
1

Hello,

I want to see searches done by graylog users.

  • In my graylog servers using version 4.2.1 (enterprise), it seems to be activated by default.
    => I do a search with an user and with a query. After this search I see in Enterprise - Audit Log menu a line with my search job and details with query string etc.
  • In my graylog servers using version 3.1.2 (enterprise) I don’t see the searches trace in Enterprise - Audit Log menu. I see only “session created” for users.

==> How can I activate audit log for graylog users searches in my graylog server version 3.1.2?
However In the v3.1 documentation it seems to be activated by default:
https://archivedocs.graylog.org/en/3.1/pages/auditlog/setup.html#configuration

Have I to do upgrade to v4.2.1 to activate this functionality?

Thanks for your responses,
Thomas

2

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.