---
title: Entries in the Audit Log
slug: ps/help/en_us/vwaf/ag/entries-in-the-audit-log
docTags:
createdAt: 2026-08-02T10:05:41.597Z
---
This reference lists all possible messages of the Audit Log. Variable texts are printed in italics. At runtime, they’re replaced by specific data.
For a description on how to view and filter the Audit Log, please refer to [Audit Log](docId:4C1BB4dZs8UzfIN3__wPG).
:::hint{type="info"}
For more information regarding monitoring and log files, see[Monitoring Attacks, Statistics, Log Files, Reports](docId:1NE-_LwJkIvGOrOiLMowI).
:::
| Entries in the Action, Result, and Data columns | relates to / for configuration see |
| ------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Authentication** | |
| login; FAILED; failed to login as user `cid="1OGi5S">username` | [Starting ](docId\:P2BW3jWoRfV-rf95L6pgG)[Administration](docId\:P2BW3jWoRfV-rf95L6pgG)
[User M](docId\:NoTMWE8NOiIduc6YfoqGA)[anagement](docId\:NoTMWE8NOiIduc6YfoqGA) |
| login; OK; using `cid="2HyNgz">authbackend`backend | [Starting](docId\:P2BW3jWoRfV-rf95L6pgG)[ Administration](docId\:P2BW3jWoRfV-rf95L6pgG) |
| **Application Mapping** | |
| application `cid="2HHyYv">applicationname`- add application mapping to position `cid="26zDug">number` | [Editin](docId\:rLuz-mFEsovgD1-d2n2bI)[g Application Mapping](docId\:rLuz-mFEsovgD1-d2n2bI) |
| application `cid="1b6C9s">applicationname`- move application mapping from position `cid="1PpmVi">number`to position `cid="9GtPM">number` | [Editing Application Mapping](docId\:rLuz-mFEsovgD1-d2n2bI) |
| application `cid="1zWFGk">applicationname`- added hosts: `cid="3w5hI">hostnames` | [Editing App](docId\:rLuz-mFEsovgD1-d2n2bI)[lication Mapping](docId\:rLuz-mFEsovgD1-d2n2bI) |
| application `cid="1ytf68">applicationname`- added prefixes: `cid="1zvJoK">prefixes` | [Editing Application Mapp](docId\:rLuz-mFEsovgD1-d2n2bI)[ing](docId\:rLuz-mFEsovgD1-d2n2bI) |
| application: `cid="1FUvuM">applicati``onname`- removed prefixes: `cid="1VClw9">prefixes` | [Editi](docId\:rLuz-mFEsovgD1-d2n2bI)[ng Application Mapping](docId\:rLuz-mFEsovgD1-d2n2bI) |
| customer key `cid="1GI``xDD">keyname`- removed customer key | [Edit](docId\:rLuz-mFEsovgD1-d2n2bI)[ng Application Mapping](docId\:rLuz-mFEsovgD1-d2n2bI) |
| **Application** | |
| reduced argument logging on/off; OK; application `cid="1zU8kq">applicationname` | [Editing Applications](docId\:cLT-s9nkkyQGiZHDYfFzU) |
| traffic allowed/blocked; OK; application `cid="1R9tAQ">applicationname` | [Application Control](docId\:Du0uq2ck2fOnY4mFZp9gM) |
| bypass ruleset on/off; OK; application `cid="CtakV"``>applicationname` | [Application Control](docId\:Du0uq2ck2fOnY4mFZp9gM) |
| changed value; OK; changed value of reduced logging hosts from `cid="1PKt9s">oldvalue`to `cid="ymaOY">newvalue`for application `cid="1E9GDn">applicationname` | [Editing ](docId\:cLT-s9nkkyQGiZHDYfFzU)[Applications](docId\:cLT-s9nkkyQGiZHDYfFzU) |
| changed value; OK; changed value of hosts from `cid=``"2JzwEW">oldvalue`to `cid="1LRJZ8">newvalue`for application `cid="WMNMr">applicationname` | [Editing Applications](docId\:cLT-s9nkkyQGiZHDYfFzU) |
| changed value; OK; changed value of default charset from `cid="1bIeDo">oldvalue`to `cid="1HEiow">newvalue`for application `cid="FTOCU">applicationname` | [Editing Applications](docId\:cLT-s9nkkyQGiZHDYfFzU) |
| add application; OK; `cid="1VeJ1L">applicationname` | [Editing Application](docId\:cLT-s9nkkyQGiZHDYfFzU)[s](docId\:cLT-s9nkkyQGiZHDYfFzU) |
| delete application; OK; `cid="1gwQsr">applicationname` | [Editing Applicat](docId\:cLT-s9nkkyQGiZHDYfFzU)[ions](docId\:cLT-s9nkkyQGiZHDYfFzU) |
| rename application; OK; `cid="1E4M5A">oldapplicationname`to `cid="AWH4">newapplicationname` | [Editing Applications](docId\:cLT-s9nkkyQGiZHDYfFzU) |
| **User Management** | |
| add user; OK; `cid="73cQc">username` | [User ](docId\:NoTMWE8NOiIduc6YfoqGA)[Management](docId\:NoTMWE8NOiIduc6YfoqGA) |
| delete user; OK; `cid="P1Z8E">username` | [User](docId\:NoTMWE8NOiIduc6YfoqGA)[ Management](docId\:NoTMWE8NOiIduc6YfoqGA) |
| set password; OK/FAILED; `cid="c6Ljb">username` | [User M](docId\:NoTMWE8NOiIduc6YfoqGA)[anagement](docId\:NoTMWE8NOiIduc6YfoqGA) |
| enable account; OK; `cid="22tu29">username` | [User ](docId\:NoTMWE8NOiIduc6YfoqGA)[Management](docId\:NoTMWE8NOiIduc6YfoqGA) |
| disable account; OK; `cid="1dvzhI">username` | [User ](docId\:NoTMWE8NOiIduc6YfoqGA)[Management](docId\:NoTMWE8NOiIduc6YfoqGA) |
| change email for user; OK; `cid="zxTgu">username` | [User](docId\:NoTMWE8NOiIduc6YfoqGA)[ Management](docId\:NoTMWE8NOiIduc6YfoqGA) |
| change full name for user; OK; `cid="24MLOr">username` | [User ](docId\:NoTMWE8NOiIduc6YfoqGA)[Management](docId\:NoTMWE8NOiIduc6YfoqGA) |
| change default mode for user; OK; `cid="XEfGO">username` | [User M](docId\:NoTMWE8NOiIduc6YfoqGA)[anagement](docId\:NoTMWE8NOiIduc6YfoqGA) |
| change groups for user; OK; `cid="Lb9ou">username` | [User ](docId\:NoTMWE8NOiIduc6YfoqGA)[Management](docId\:NoTMWE8NOiIduc6YfoqGA) |
| save logfilter; OK; changed `cid="1wBem9">logfiltername`logfilter for user `cid="1VxGDA">username`(` cid="1U9tQm">panelname`) | [Log Files](docId\:hXJcPv0dhaJrz60fwFaV5)
[Default Error Log](docId\:gS-A-FCs9WyR7l1bCCw1N) |
| delete logfilter; OK; deleted `cid="a9hlz">logfiltername`logfilter for user `cid="JY42y">username`(` cid="``10ALgw">panelname`) | [User ](docId\:NoTMWE8NOiIduc6YfoqGA)[Management](docId\:NoTMWE8NOiIduc6YfoqGA) |
| **Group Management** | |
| add group; OK; `cid="10wJ03">gro``upname` | [Group Ma](docId\:H35EqAwFWaHKcMu3_w5_9)[nagement](docId\:H35EqAwFWaHKcMu3_w5_9) |
| modify group; OK; `cid="1LaQJl">gr``oupname` | [Gro](docId\:H35EqAwFWaHKcMu3_w5_9)[up Management](docId\:H35EqAwFWaHKcMu3_w5_9) |
| delete group; OK; `cid="1GAR0e"``>groupname` | [Gro](docId\:H35EqAwFWaHKcMu3_w5_9)[up Management](docId\:H35EqAwFWaHKcMu3_w5_9) |
| add user to group; OK; `cid="J9r3Q``">username`- `cid="1tCyZX">groupname` | [User ](docId\:NoTMWE8NOiIduc6YfoqGA)[Management](docId\:NoTMWE8NOiIduc6YfoqGA) |
| remove user from group; OK; username - groupname | [User M](docId\:NoTMWE8NOiIduc6YfoqGA)[anagement](docId\:NoTMWE8NOiIduc6YfoqGA) |
| **Cluster Configuration** | |
| cluster config; OK/FAILED; enable node `cid="WOpyK">IP` | [Ma](docId\:n0rwAJ44X0Yd2g2s7Hszr)[naging Deciders](docId\:n0rwAJ44X0Yd2g2s7Hszr) |
| cluster config; OK/FAILED; disable node `cid="1ktNT2">IP` | [Group Mana](docId\:H35EqAwFWaHKcMu3_w5_9)[gement](docId\:H35EqAwFWaHKcMu3_w5_9) |
| cluster config; OK/FAILED; add node `cid="HwYjd">IP` | [Grou](docId\:H35EqAwFWaHKcMu3_w5_9)[p Management](docId\:H35EqAwFWaHKcMu3_w5_9) |
| cluster config; OK/FAILED; remove node `cid="1f4RJp">IP` | [Grou](docId\:H35EqAwFWaHKcMu3_w5_9)[p Management](docId\:H35EqAwFWaHKcMu3_w5_9) |
| Global Configuration | |
| global config; OK; use X-Forwarded-For header allowed/denied | [Glob](docId:1MQYcDX4InoZN7IdY-iIB)[al Configuration](docId:1MQYcDX4InoZN7IdY-iIB) |
| global config; OK; traffic for unconfigured hosts allowed/denied | [Global Configuration](docId:1MQYcDX4InoZN7IdY-iIB) |
| global config; OK; allow unencoded spaces in the url allowed/denied | [Glob](docId:1MQYcDX4InoZN7IdY-iIB)[al Configuration](docId:1MQYcDX4InoZN7IdY-iIB) |
| global config; OK; changed value of request time limit from `cid="1s9IdO">oldvalue`to `cid="2pOWK">newvalue` | [Global Configuration](docId:1MQYcDX4InoZN7IdY-iIB) |
| global config; OK; statistics enabled/disabled | [Glob](docId:1MQYcDX4InoZN7IdY-iIB)[al Configuration](docId:1MQYcDX4InoZN7IdY-iIB) |
| global config; OK; changed value of session cookie name from `cid="1lc0K8">oldvalue`to `cid="fzKL7">newvalue` | [Global Configuration](docId:1MQYcDX4InoZN7IdY-iIB) |
| global config; OK; traffic for unparsable requests allowed/denied | [Glo](docId:1MQYcDX4InoZN7IdY-iIB)[bal Configuration](docId:1MQYcDX4InoZN7IdY-iIB) |
| global config; OK; traffic for hosts without a license allowed/denied | [Glo](docId:1MQYcDX4InoZN7IdY-iIB)[bal Configuration](docId:1MQYcDX4InoZN7IdY-iIB) |
| **System** | |
| master server started; OK; using config `cid="2FW65O">filename`
| [St](docId\:iXXTJVw7bfDmV1wppBgrl)[arting and Stopping the Software](docId\:iXXTJVw7bfDmV1wppBgrl) |