# Auditing

Auditing is done using a capability, as described in [Capabilities](https://help.sonatype.com/en/capabilities.html "Capabilities") called _Audit_. For your convenience, this capability is created and enabled by default.

When the _Audit_ capability is enabled, Sonatype Nexus Repository updates a log file located in `$data-dir/log/audit/audit.log` each time a user or internal process modifies Nexus Repository configuration or adds or removes an asset or component. Nexus Repository rotates this log file daily and retains a maximum of 90 days' worth of files.

## [Nexus Repository Audit Log Attributes](https://help.sonatype.com/en/auditing.html#nexus-repository-audit-log-attributes_body)

Each line of the audit log contains an unformatted JSON message representing a single audit item. The table below provides a list of attributes available in these JSON messages:

| Attribute | Description | Example |
| --- | --- | --- |
| timestamp | The date and time this event occurred | 2019-02-04 18:12:07,856-0500 |
| nodeId | The instance's nodeId (used to correlate audit logs across multiple instances) | 5DF0F434-88A6F4B7-AEDCE785-CAD9628C-8AD86154 |
| initiator | The event initiator often represented as a username/host combination unless it is an internally generated event | admin/172.16.0.10 |
| domain | Functional area of the system | ```<br>"security.user";<br>"repository.component";<br>"repository.asset";<br>"tasks";<br>"security.user-role-mapping";<br>"security.sslcertificate";<br>"security.role";<br>"security.realm";<br>"security.privilege";<br>"security.ldap";<br>"security.crowd";<br>"security.anonymous";<br>"script";<br>"repository-view";<br>"repository-content-selector";<br>"repository-admin";<br>"repository";<br>"replication";<br>"logging";<br>"license";<br>"httpclient";<br>"email";<br>"capability";<br>"blobstore";<br>"database-migration";<br>"firewall.quarantine"<br>                        <br>``` |
| type | Action performed in this domain | created |
| context | Identifying details of the event | mynewusername |
| thread | Thread name of the event initiator. Thread name can help correlate related log lines from other log files. | quartz-7-thread-1 |
| attributes | Map of key:value pairs that contain more details about the event | {"id":"mynewusername","name":"John Doe","email":"jdoe@emailserver.com","source":"default","status":"active","roles":"nx-admin"} |

## [Nexus Repository Audit Log Available Types](https://help.sonatype.com/en/auditing.html#nexus-repository-audit-log-available-types_body)

The table below lists available Nexus Repository audit log Java constants and their type values:

| Java Constant | Type Value |
| --- | --- |
| SYSTEM_CONTEXT | system |
| CREATED_TYPE | created |
| UPDATED_TYPE | updated |
| DELETED_TYPE | deleted |
| PURGE_TYPE | purged |
| CHANGED_TYPE | changed |

## [Available Nexus Repository Audit Log Event Types per Domain](https://help.sonatype.com/en/auditing.html#available-nexus-repository-audit-log-event-types-per-domain_body)

The table below lists available Nexus Repository audit log event types per domain:

| Domain | Event Types per Domain |
| --- | --- |
| CleanupPolicy | created, updated, deleted |
| capability | created, updated, deleted |
| email | changed, context |
| httpclient | changed, context |
| logging | changed, context |
| tasks | deleted, scheduled, started, finished, failed, cancel-requested, canceled |
| script | created, updated, deleted |
| security.sslcertificate | created, deleted |
| DataStore | deleted |
| blobstore | created, updated, deleted, started, stopped |
| RoutingRule | created, updated, deleted |
| repository.asset | created, updated, deleted |
| repository.component | created, updated, deleted |
| security.anonymous | changed, context |
| security.user | User_not_found, Password_empty, Incorrect_credentials, Disabled_account, License_limitation, Expired_credentials, Unknown |
| security.privilege | created, updated, deleted |
| security.realm | changed, context |
| security.role | created, updated, deleted |
| security.user | created, updated, deleted |
| security.user-role-mapping | created, updated, deleted |
| ContentSelector | created, updated, deleted |
| license | changed, context |
| security.crowd | changed, context |
| security.ldap | created, updated, deleted, changedOrder, cacheInvalidated |
| replication | created, updated, deleted |
| SamlRealm | configChanged |