No description, website, or topics provided.
Switch branches/tags
Nothing to show
Clone or download
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Failed to load latest commit information.

Audit module for Icinga Web 2

Table of Contents

  1. About
  2. License
  3. Support
  4. Requirements
  5. Installation
  6. Configuration



Icinga Web 2 and this Icinga Web 2 module are licensed under the terms of the GNU General Public License Version 2, you will find a copy of this license in the LICENSE file included in the source package.


Join the Icinga community channels for questions.



Extract this module to your Icinga Web 2 modules directory as audit directory.

Git clone:

cd /usr/share/icingaweb2/modules
git clone audit

Tarball download (latest release):

cd /usr/share/icingaweb2/modules
mv icingaweb2-module-audit-1.0.0 audit

Enable Icinga Web 2 module

Enable the module in the Icinga Web 2 frontend in Configuration -> Modules -> audit -> enable. You can also enable the module by using the icingacli command:

icingacli module enable audit


By default the audit module does not log anything. Its logging facilities need to be configured first.

There are currently two choices:

  • Standard Log
  • JSON Log

Standard Log

The standard log is a normal log with human readable messages. It's possible to log to a file and to syslog. The configuration view in the frontend is located here: Configuration -> Modules -> audit -> Configuration


When logging to a file and with the proper permission, this can be viewed in the frontend under System -> Audit Log


The JSON log is supposed to be consumed by other applications. It writes one JSON object per line to a file.

These objects have the following properties:

  • activity_time
    A unix timestamp specifying when the activity occurred.
  • activity
    An arbitrary identifier specifying the type of activity.
  • identity
    An arbitrary name identifying the responsible subject.
  • message
    A human readable message. This is the same that appears in the standard log.
  • data (may be absent)
    An arbitrary number of additional properties dependent on the type of activity.

Please see the documentation of the type of activity for more details. (Icinga Web 2 activities)

An example for Filebeat how this log may be consumed can be found here.