# Netconf audit log

**URL:** https://dmap-community.ductus.global/t/netconf-audit-log/957
**Category:** Other Northbound Interfaces
**Created:** [January 17, 2017, 10:12am UTC](https://dmap-community.ductus.global/t/netconf-audit-log/957 "2017-01-17T10:12:09Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![yi\_z\_zhao](https://avatars.discourse-cdn.com/v4/letter/y/45deac/32.png) [@yi\_z\_zhao](https://dmap-community.ductus.global/u/yi_z_zhao)
#### Post date: [January 17, 2017, 10:12am UTC](https://dmap-community.ductus.global/t/netconf-audit-log/957/1 "2017-01-17T10:12:10Z")

</div>

It seems that only CLI history commands can be recorded in ConfD auditLog.

/confdConfig/cli/auditLogMode and /confdConfig/logs/auditLogCommit can be used to control auditLog content, but no Netconf audit control options.

I assume NetconfTraceLog is used as Netconf audit log from ConfD perspective?

Could you share ConfD’s view on Netconf audit? Thanks.

---

<div class="post-metadata">

### Author: ![cohult](https://yyz2.discourse-cdn.com/flex010/user_avatar/dmap-community.ductus.global/cohult/32/221_2.png) [@cohult](https://dmap-community.ductus.global/u/cohult)
#### Post date: [January 17, 2017, 3:24pm UTC](https://dmap-community.ductus.global/t/netconf-audit-log/957/2 "2017-01-17T15:24:17Z")

</div>

> [@yi\_z\_zhao](#):
>
> It seems that only CLI history commands can be recorded in ConfD auditLog.

auditLog is an audit log recording successful and failed logins to the ConfD backplane. All northbound interfaces logins to ConfD are logged in the audit log.

---

<div class="post-metadata">

### Author: ![yi\_z\_zhao](https://avatars.discourse-cdn.com/v4/letter/y/45deac/32.png) [@yi\_z\_zhao](https://dmap-community.ductus.global/u/yi_z_zhao)
#### Post date: [January 18, 2017, 3:01am UTC](https://dmap-community.ductus.global/t/netconf-audit-log/957/3 "2017-01-18T03:01:01Z")

</div>

audit log can also record all the CLIs that user executed on ConfD CLI as /confdConfig/cli/auditLogMode default value is ‘all’, while the netconf messages that were issued from netconf client are not recorded in auditLog, so I wonder if ConfD only takes the audit log as recording for login/logout and CLI history? What’s ConfD’s view on the Netconf audit?

---

<div class="post-metadata">

### Author: ![cohult](https://yyz2.discourse-cdn.com/flex010/user_avatar/dmap-community.ductus.global/cohult/32/221_2.png) [@cohult](https://dmap-community.ductus.global/u/cohult)
#### Post date: [January 19, 2017, 12:26am UTC](https://dmap-community.ductus.global/t/netconf-audit-log/957/4 "2017-01-19T00:26:38Z")

</div>

Hi,  
If you want to add for example NETCONF log entries to the audit log too, you can register for receiving CONFD\_NOTIF\_NETCONF notificaions and put them into a merged audit log.  
See confd\_lib\_events(3) man page and ConfD 6.3 UG Chapter 12. Notifications
