Viewing audit information for the App Connect Dashboard

Audit events for the App Connect Dashboard are recorded for security, compliance, and troubleshooting purposes. These events provide details about when and by whom specific actions were carried out in a Dashboard instance in a namespace. The user is identified only if identity and access management (IAM) with Keycloak is used to secure access to the Dashboard instance. You can view audit events in the pod log for a Dashboard instance.

Availability:

Audit logging for all actions in a Dashboard instance is available only for Dashboard instances with a spec.version value that resolves to 13.0.1.1-r1 or later.
Audit logging is permanently enabled for Model Context Protocol (MCP) servers in a Dashboard instance at version 13.0.6.1-r1 or later. MCP server audit logging is independent of audit logging for the Dashboard.
An MCP server provides tools and resources, which define specific actions that AI agents can invoke against external systems. For more information, see Creating and managing Model Context Protocol (MCP) servers.
If the IBM® App Connect Enterprise Agent is enabled in a Dashboard instance at version 13.0.7.0-r1 or later, audit logging is permanently enabled for the Agent independently of audit logging for the Dashboard.
The Agent provides a chat window in the Dashboard UI where you can query your container deployments or the IBM knowledge base, and receive formulated responses. For more information, see Using the IBM App Connect Enterprise Agent.

Before you begin

Configure audit logging for the Dashboard instance.
To view audit information for actions in a Dashboard instance, audit logging must be enabled for the instance. When you create a Dashboard instance, audit logging is enabled by default in either of the following ways:
- The Audit log/Disabled switch is set to false in Form view. The following example shows this default setting in Form view for a Dashboard instance that is being created in the Red Hat® OpenShift® web console.
- The spec.auditLog.disabled parameter is set to false in YAML view. The following example shows this default setting in the YAML manifest for a Dashboard instance that is being created from the Red Hat OpenShift or Kubernetes CLI.
```
spec:
  auditLog:
    disabled: false
```
If the IBM App Connect Enterprise Agent is enabled in the Dashboard instance, configure a JSON logging format for the Dashboard. The JSON setting is needed to format the logs with a predefined list of fields that record audit event details for user interactions in the Agent chat window.
Note: Audit logging is always enabled for the Agent and is independent of audit logging for the Dashboard.

Configure a JSON logging format in either of the following ways:
- From the Red Hat OpenShift web console, use the Form view to expand the Advanced configuration section. Then, from the Log Format drop-down list, select json as the format for the container logs that are output to the container's console.
  The following example shows the Log Format setting in Form view for a Dashboard instance that is being created.
- From the Red Hat OpenShift or Kubernetes CLI, set the spec.logFormat parameter to json to use a JSON format for the container logs that are output to the container's console.
  The following example shows this setting in the YAML manifest for a Dashboard instance that is being created from the CLI.
```
spec:
  logFormat: json
```

If you disable audit logging for a Dashboard instance (by setting the Audit log/Disabled switch or the spec.auditLog.disabled parameter to true) when you create a Dashboard, you can enable audit logging later by updating the custom resource (CR) for the deployed instance.

For more information, see Creating an instance or Updating the custom resource settings for an instance in the App Connect Dashboard reference.

About this task

IBM App Connect can generate audit events for all actions that are performed in your Dashboard instance so that you can see who did what, and where and when the actions were initiated. Examples of these actions, which also include CRUD operations, are as follows:

Importing (or uploading), listing, updating (or replacing), deleting, downloading, backing up, and restoring a BAR file
Creating, testing (with the Try it feature), listing, viewing, updating, starting, stopping, and deleting an integration runtime
Enabling and disabling basic authentication for an integration runtime
Listing and viewing metrics for an integration runtime
Stopping and starting the applications in an integration runtime
Creating (starting), collecting, resetting, and deleting (stopping) trace for an integration runtime
Creating, listing, viewing, and deleting a private network agent, and downloading the client for a private network agent
Creating, listing, updating, and deleting a configuration object

If the IBM App Connect Enterprise Agent is enabled in the Dashboard instance, audit events are also generated for the following user interactions to help identify the input, Agent decisions, and output for a given user chat session:

All user supplied questions
A thread ID is generated to uniquely identify a user's chat session and a transaction ID is generated per user query.
All Agent decisions, recommendations, and interactions
All final answers

Procedure

To view audit information for actions in a Dashboard instance, complete the following steps:

Access the log for the Dashboard pod.
For more information, see Realtime log streaming from the Red Hat OpenShift web console, or Retrieving logs from the Red Hat OpenShift or Kubernetes CLI.
Review the log to locate entries that are annotated with [audit].
The content and structure of the information depends on which container the information is emitted from and whether the content is presented in a basic or JSON log format. The JSON format typically includes the information that is displayed for a basic format as well as some additional details, and presents the information in a structure designed for more efficient parsing.

Audit events for managed resources in the Dashboard such as integration runtimes, BAR files, configuration objects, and private network agents are emitted from the control-ui and content-server containers in the Dashboard pod, whereas audit events for the IBM App Connect Enterprise Agent are emitted from the acemcp and langgraph containers in the Agent pod.

For example:
- When a basic log format is specified in the Dashboard CR, audit entries from the Dashboard containers include the timestamp of an audit event, the nature of the event, the namespace where the event occurred, and the user who initiated the action (if available).
  - If IAM with Keycloak is used to manage user access to the Dashboard instance, audit entries are recorded in the following format in the log, where user_name identifies the Keycloak username that was used to log in to the Dashboard. For more information, see Implementing identity and access management for App Connect Designer and App Connect Dashboard instances.
```
timestamp_of_event: [audit] nature_of_event in namespace_name by user_name (user_id)
```
  - If the Dashboard is not secured with Keycloak (and needs no authentication for access), audit entries are recorded in the following format in the log.
```
timestamp_of_event: [audit] nature_of_event in namespace_name
```
- When a JSON log format is specified in the Dashboard CR, audit entries from the Dashboard containers include the following information (with or without a Keycloak username).
```
{
  type: 'message_type',
  ibm_product: 'IBM App Connect Enterprise',
  ibm_recordtype: 'log',
  host: 'dashboard_pod',
  module: 'module_name',
  ibm_serverName: 'ace_dashboard',
  ibm_datetime: 'timestamp_of_event',
  loglevel: level,
  message: '[audit] nature_of_event in namespace_name by user_name (user_id)',
  ibm_sequence: 'sequence_id',
  ibm_correlationId: 'transaction_id'
}
```
- When a JSON log format is specified in the Dashboard CR, audit entries from the langgraph container in the Agent pod include the following information (with or without a Keycloak username).
```
{
    "type": "message_type",
    "ibm_product": "IBM App Connect Enterprise",
    "ibm_recordtype": "log",
    "host": "agent_pod",
    "module": "module_name",
    "ibm_serverName": "ace_dashboard",
    "ibm_datetime": "timestamp_of_event",
    "loglevel": level,
    "message": "[audit] message_text",
    "ibm_sequence": "sequence_id",
    "iam_id": "user_id",
    "ibm_correlationId": "transaction_id",
    "thread_id": "chat_session_id"
}
```
- When a JSON log format is specified in the Dashboard CR, audit entries from the acemcp container in the Agent pod include the following information (with or without a Keycloak username).
```
{
  type: 'message_type',
  ibm_product: 'IBM App Connect Enterprise',
  ibm_recordtype: 'log',
  host: 'agent_pod',
  module: 'module_name',
  ibm_serverName: 'ace_dashboard',
  ibm_datetime: 'timestamp_of_event',
  loglevel: level,
  message: '[audit] message_text',
  ibm_sequence: 'sequence_id',
  ibm_correlationId: 'transaction_id',
  dataObj: '{
        "thread_id": "chat_session_id",
        "iam_id": "user_id"
}
```

Example

Basic log format examples

The following example shows some audit entries that are emitted from the Dashboard containers and presented in a basic log format. The entries relate to actions by the integration-admin user in a Dashboard instance that is secured with Keycloak.

...
2025-07-18 10:15:21.611Z: [audit] attempting integrationRuntime list in ace-fiona by integration-admin (fd00e23c-ccee-49a8-97cc-88e618eb9c07)
...
2025-07-18 10:15:23.690Z: [audit] attempting integrationRuntime open in ace-fiona by integration-admin (fd00e23c-ccee-49a8-97cc-88e618eb9c07)
...
2025-07-18 10:15:23.779Z: [audit] attempting integrationRuntime viewMetrics in ace-fiona
...
2025-07-18 15:12:14.452Z: [audit] attempting integrationRuntime list for ir-01-quickstart in ace-fiona by integration-admin (fd00e23c-ccee-49a8-97cc-88e618eb9c07)
...
2025-07-18 15:12:39.643Z: [audit] attempting integrationRuntime getBasicAuth for ir-01-quickstart in ace-fiona by integration-admin (fd00e23c-ccee-49a8-97cc-88e618eb9c07)
...
2025-07-18 15:42:16.957Z: [audit] attempting configuration list in ace-fiona by integration-admin (fd00e23c-ccee-49a8-97cc-88e618eb9c07)
...
2025-07-18 15:43:12.842Z: [audit] attempting configuration create for aws-account in ace-fiona by integration-admin (fd00e23c-ccee-49a8-97cc-88e618eb9c07)
...
2025-07-18 15:44:19.758Z: [audit] attempting barFile list in ace-fiona by integration-admin (fd00e23c-ccee-49a8-97cc-88e618eb9c07)
...
2025-07-18 15:46:46.371Z: [audit] attempting barFile import for CustomerDatabaseV2/CustomerDatabaseV2 in ace-fiona by integration-admin (fd00e23c-ccee-49a8-97cc-88e618eb9c07)
...
2025-07-18 15:48:20.830Z: [audit] attempting barFile delete for CustomerDatabaseV1 in ace-fiona by integration-admin (fd00e23c-ccee-49a8-97cc-88e618eb9c07)
...
2025-07-18 15:48:51.756Z: [audit] attempting integrationRuntime list for aws-account in ace-fiona by integration-admin (fd00e23c-ccee-49a8-97cc-88e618eb9c07)
...
2025-07-18 15:48:52.259Z: [audit] attempting configuration delete for aws-account in ace-fiona by integration-admin (fd00e23c-ccee-49a8-97cc-88e618eb9c07)
...
2025-07-18 15:54:41.607Z: [audit] attempting integrationRuntime create for ir-fd-audit02 in ace-fiona by integration-admin (fd00e23c-ccee-49a8-97cc-88e618eb9c07)
...
2025-07-18 15:58:32.165Z: [audit] attempting integrationRuntime modify for ir-fd-audit02 in ace-fiona by integration-admin (fd00e23c-ccee-49a8-97cc-88e618eb9c07)
...

The following example shows some audit entries that are emitted from the Dashboard containers and presented in a basic log format. The entries relate to actions by a user with access to a namespace that contains a Dashboard instance that is not secured with Keycloak.

...
2025-07-10 13:33:50.786Z: [audit] attempting integrationRuntime list in ace-fiona
...
2025-07-10 13:33:51.657Z: [audit] attempting integrationRuntime viewMetrics in ace-fiona
...
2025-07-10 13:33:51.740Z: [audit] attempting integrationRuntime open in ace-fiona
...
2025-07-10 13:33:54.788Z: [audit] attempting privateNetworkAgent view for undefined in ace-fiona
...
2025-07-10 13:33:54.800Z: [audit] attempting privateNetworkAgent list in ace-fiona
...
2025-07-10 13:33:55.736Z: [audit] attempting privateNetworkAgent view for default2-privatenetworkagent in ace-fiona
...
2025-07-18 10:18:54.738Z: [audit] attempting integrationRuntime startTrace for ir-01-quickstart in ace-fiona
...
2025-07-18 15:21:25.394Z: [audit] attempting configuration list in ace-fiona
...
2025-07-18 15:37:20.450Z: [audit] attempting configuration create for salesforce-acct in ace-fiona
...
2025-07-18 15:49:09.820Z: [audit] attempting integrationRuntime list for sap-acct in ace-fiona
...
2025-07-18 15:49:10.298Z: [audit] attempting configuration delete for sap-acct in ace-fiona
...
2025-07-18 15:49:30.419Z: [audit] attempting barFile list in ace-fiona
...
2025-07-18 15:49:45.504Z: [audit] attempting barFile import for CustomerDatabaseV2 in ace-fiona
...
2025-07-18 15:50:28.345Z: [audit] attempting barFile delete for CustomerDatabaseV2 in ace-fiona
...
2025-07-18 15:53:09.530Z: [audit] attempting integrationRuntime create for ir-fd-audit01 in ace-fiona
...
2025-07-18 15:55:15.001Z: [audit] attempting integrationRuntime modify for ir-fd-toolkit in ace-fiona
...

JSON log format examples

These examples display audit entries that are emitted from the Dashboard and Agent containers when user integration-admin (with user ID 69674656-91f7-4fa2-aa28-ef33623c851c) types the following question in the Agent chat window within a Dashboard instance that is secured with Keycloak:

What Integration Runtimes do I have?

Sample response in the Agent chat window

The following example shows some entries that are emitted from the Dashboard containers and presented in a JSON log format. The messages depict the attempt to obtain the list of integration runtimes in the Dashboard's namespace (as requested by user integration-admin), and attempts to validate access to the Agent chat.

{
  type: 'ace_message',
  ibm_product: 'IBM App Connect Enterprise',
  ibm_recordtype: 'log',
  host: 'db-01-quickstart-dash-5b5699dff9-2vbvt',
  module: 'ace_control.ace_dashboard',
  ibm_serverName: 'ace_dashboard',
  ibm_datetime: '2026-03-19T10: 56: 30.534Z',
  loglevel: 30,
  message: '[audit] attempting integrationRuntime list in ace-shanna-latest by integration-admin (69674656-91f7-4fa2-aa28-ef33623c851c)',
  ibm_sequence: '135493_49',
  ibm_correlationId: 'missing'
}
{
  type: 'ace_message',
  ibm_product: 'IBM App Connect Enterprise',
  ibm_recordtype: 'log',
  host: 'db-01-quickstart-dash-5b5699dff9-2vbvt',
  module: 'ace_control.ace_dashboard',
  ibm_serverName: 'ace_dashboard',
  ibm_datetime: '2026-03-19T10: 56: 44.605Z',
  loglevel: 30,
  message: 'Validating access to url: /api/v1/ai/chat',
  ibm_sequence: '149564_b9',
  ibm_correlationId: 'db7b808d-dff4-4b86-8e03-c20c52b4a0c5'
}
{
  type: 'ace_message',
  ibm_product: 'IBM App Connect Enterprise',
  ibm_recordtype: 'log',
  host: 'db-01-quickstart-dash-5b5699dff9-2vbvt',
  module: 'ace_control.ace_dashboard',
  ibm_serverName: 'ace_dashboard',
  ibm_datetime: '2026-03-19T10: 56: 44.606Z',
  loglevel: 30,
  message: 'Validating successful (valid J.W.T.) for url: /api/v1/ai/chat',
  ibm_sequence: '149565_ba',
  ibm_correlationId: 'db7b808d-dff4-4b86-8e03-c20c52b4a0c5'
}

The following example shows audit entries, which are emitted from the langgraph container in the Agent pod and presented in a JSON log format.

The ibm_correlationId value (db7b808d-dff4-4b86-8e03-c20c52b4a0c5) matches the value shown in the audit entries that are emitted from the Dashboard containers.
The iam_id value (69674656-91f7-4fa2-aa28-ef33623c851c) matches the user ID of the integration-admin user in the audit entries that are emitted from the Dashboard containers.

{
    "type": "ace_message",
    "ibm_product": "IBM App Connect Enterprise",
    "ibm_recordtype": "log",
    "host": "db-01-quickstart-aiagent-7d45df8875-mpwhd",
    "module": "ace_control.ace_dashboard",
    "ibm_serverName": "ace_dashboard",
    "ibm_datetime": "2026-03-19T10:56:55.315Z",
    "loglevel": 30,
    "message": "[audit] Topic check: IN SCOPE for query: What Integration Runtimes do I have?",
    "ibm_sequence": "1",
    "iam_id": "69674656-91f7-4fa2-aa28-ef33623c851c",
    "ibm_correlationId": "db7b808d-dff4-4b86-8e03-c20c52b4a0c5",
    "thread_id": "088920d6-4eff-4fc8-a20e-35af22cd66e3"
}
{
    "type": "ace_message",
    "ibm_product": "IBM App Connect Enterprise",
    "ibm_recordtype": "log",
    "host": "db-01-quickstart-aiagent-7d45df8875-mpwhd",
    "module": "ace_control.ace_dashboard",
    "ibm_serverName": "ace_dashboard",
    "ibm_datetime": "2026-03-19T10:56:57.435Z",
    "loglevel": 30,
    "message": "[audit] Input_guard_policy check: SAFE for query: What Integration Runtimes do I have?",
    "ibm_sequence": "1",
    "iam_id": "69674656-91f7-4fa2-aa28-ef33623c851c",
    "ibm_correlationId": "db7b808d-dff4-4b86-8e03-c20c52b4a0c5",
    "thread_id": "088920d6-4eff-4fc8-a20e-35af22cd66e3"
}
{
    "type": "ace_message",
    "ibm_product": "IBM App Connect Enterprise",
    "ibm_recordtype": "log",
    "host": "db-01-quickstart-aiagent-7d45df8875-mpwhd",
    "module": "ace_control.ace_dashboard",
    "ibm_serverName": "ace_dashboard",
    "ibm_datetime": "2026-03-19T10:56:57.435Z",
    "loglevel": 30,
    "message": "[audit] Input_guard_integrity check: SAFE for query: What Integration Runtimes do I have?",
    "ibm_sequence": "1",
    "iam_id": "69674656-91f7-4fa2-aa28-ef33623c851c",
    "ibm_correlationId": "db7b808d-dff4-4b86-8e03-c20c52b4a0c5",
    "thread_id": "088920d6-4eff-4fc8-a20e-35af22cd66e3"
}
{
    "type": "ace_message",
    "ibm_product": "IBM App Connect Enterprise",
    "ibm_recordtype": "log",
    "host": "db-01-quickstart-aiagent-7d45df8875-mpwhd",
    "module": "ace_control.ace_dashboard",
    "ibm_serverName": "ace_dashboard",
    "ibm_datetime": "2026-03-19T10:56:57.440Z",
    "loglevel": 30,
    "message": "[audit] Routing query to appropriate agent. query: What Integration Runtimes do I have?. last_message_type: HumanMessage. agent_history: [social, FINISH]",
    "ibm_sequence": "1",
    "iam_id": "69674656-91f7-4fa2-aa28-ef33623c851c",
    "ibm_correlationId": "db7b808d-dff4-4b86-8e03-c20c52b4a0c5",
    "thread_id": "088920d6-4eff-4fc8-a20e-35af22cd66e3"
}
{
    "type": "ace_message",
    "ibm_product": "IBM App Connect Enterprise",
    "ibm_recordtype": "log",
    "host": "db-01-quickstart-aiagent-7d45df8875-mpwhd",
    "module": "ace_control.ace_dashboard",
    "ibm_serverName": "ace_dashboard",
    "ibm_datetime": "2026-03-19T10:56:58.019Z",
    "loglevel": 30,
    "message": "[audit] Supervisor routing decision. intent: User wants list of Integration Runtimes in their environment. next_agent: ace. agent_history: [social, FINISH, ace]. message_count: 3",
    "ibm_sequence": "1",
    "iam_id": "69674656-91f7-4fa2-aa28-ef33623c851c",
    "ibm_correlationId": "db7b808d-dff4-4b86-8e03-c20c52b4a0c5",
    "thread_id": "088920d6-4eff-4fc8-a20e-35af22cd66e3"
}
{
    "type": "ace_message",
    "ibm_product": "IBM App Connect Enterprise",
    "ibm_recordtype": "log",
    "host": "db-01-quickstart-aiagent-7d45df8875-mpwhd",
    "module": "ace_control.ace_dashboard",
    "ibm_serverName": "ace_dashboard",
    "ibm_datetime": "2026-03-19T10:57:01.604Z",
    "loglevel": 30,
    "message": "[audit] Agent answered: I found **2 Integration Runtimes** in your cluster:\n\n| # | Runtime | Status | Replicas | Version |\n|---|---------|--------|----------|---------|\n| 1 | **ir\u2011callable** | Ready | 1 | 13.0 |\n| 2 | **ir\u2011caller**   | Ready | 1 | 13.0 |\n\n**Summary:** Both runtimes are active (Ready) with a single replica each, running ACE version\u202f13.0. Let me know if you\u2019d like details about the applications, message flows, or any other components deployed on these runtimes.",
    "ibm_sequence": "1",
    "iam_id": "69674656-91f7-4fa2-aa28-ef33623c851c",
    "ibm_correlationId": "db7b808d-dff4-4b86-8e03-c20c52b4a0c5",
    "thread_id": "088920d6-4eff-4fc8-a20e-35af22cd66e3"
}
{
    "type": "ace_message",
    "ibm_product": "IBM App Connect Enterprise",
    "ibm_recordtype": "log",
    "host": "db-01-quickstart-aiagent-7d45df8875-mpwhd",
    "module": "ace_control.ace_dashboard",
    "ibm_serverName": "ace_dashboard",
    "ibm_datetime": "2026-03-19T10:57:01.604Z",
    "loglevel": 30,
    "message": "[audit] Supervisor routing decision. intent: ace agent has completed its response. No new user query detected.. next_agent: FINISH. agent_history: [social, FINISH, ace, FINISH]",
    "ibm_sequence": "1",
    "iam_id": "69674656-91f7-4fa2-aa28-ef33623c851c",
    "ibm_correlationId": "db7b808d-dff4-4b86-8e03-c20c52b4a0c5",
    "thread_id": "088920d6-4eff-4fc8-a20e-35af22cd66e3"
}
{
    "type": "ace_message",
    "ibm_product": "IBM App Connect Enterprise",
    "ibm_recordtype": "log",
    "host": "db-01-quickstart-aiagent-7d45df8875-mpwhd",
    "module": "ace_control.ace_dashboard",
    "ibm_serverName": "ace_dashboard",
    "ibm_datetime": "2026-03-19T10:57:02.363Z",
    "loglevel": 30,
    "message": "running on stream endpoint with thread_id of : 088920d6-4eff-4fc8-a20e-35af22cd66e3",
    "ibm_sequence": "1",
    "iam_id": "",
    "ibm_correlationId": "",
    "thread_id": ""
}

The following example shows audit entries, which are emitted from the acemp container in the Agent pod and presented in a JSON log format.

The thread_id value (088920d6-4eff-4fc8-a20e-35af22cd66e3), which uniquely identifies the user's chat session, matches the value shown in the audit entries that are emitted from the langgraph container.
The iam_id value (69674656-91f7-4fa2-aa28-ef33623c851c) matches the user ID of the integration-admin user in the audit entries that are emitted from the Dashboard and langgraph containers.
The ibm_correlationId value (db7b808d-dff4-4b86-8e03-c20c52b4a0c5) also matches the value shown in the audit entries that are emitted from the Dashboard and langgraph containers.

{
  type: 'ace_message',
  ibm_product: 'IBM App Connect Enterprise',
  ibm_recordtype: 'log',
  host: 'db-01-quickstart-aiagent-7d45df8875-mpwhd',
  module: 'ace_control.ace_dashboard',
  ibm_serverName: 'ace_dashboard',
  ibm_datetime: '2026-03-19T10: 56: 58.632Z',
  loglevel: 30,
  message: '[audit] Calling https: //db-01-quickstart-dash.ace-shanna-latest.svc:8400/api/v1/integration-runtimes/',
  ibm_sequence: '165534_c',
  ibm_correlationId: 'db7b808d-dff4-4b86-8e03-c20c52b4a0c5',
  dataObj: '{
        "thread_id": "088920d6-4eff-4fc8-a20e-35af22cd66e3",
        "iam_id": "69674656-91f7-4fa2-aa28-ef33623c851c"
}