Audit and Access Logging¶
QIE records security-relevant events to log files in $QIE_HOME/logs/ and to the database revision history (Envers audit trail). Use the table below to find where a given event lands.
| Event | Recorded in | Notes |
|---|---|---|
| Failed login | qie.log and access.log |
Logged with user ID, host, and IP address. Excessive failures trigger admin email alerts and can lock the account (see User Login Information). |
| Successful login | qie.log and access.log |
Logged with user, user ID, and IP for every authentication path (password, first-factor 2FA, second-factor 2FA, remember-device). |
| LDAP authentication failure | ldap.log |
Separate file for LDAP-specific authentication errors; see LDAP Authentication. |
| OIDC authentication and initialization | oidc.log |
Separate file for OpenID Connect events; see OpenID Connect (OIDC) Authentication. |
| User account changes (create / disable / role change / password change / account lock) | Database revision history | Tracked by Envers on the user record. View via the history icon on Manage Users; see Revision History. |
| Configuration changes (channels, connections, system variables, etc.) | Database revision history | All audited configuration entities. View per object via its history icon; see Revision History. |
| Channel and message processing | qie.log and the per-channel log view |
Channel activity, errors, and per-message events. See Monitoring Server Resources. |
| Administrative engine actions (QIE update download and install, service restart, external-library update, clear shared cache, clear error-management overrides, scheduled-script Run Now) | access.log |
Logged with the user ID on the instance that received the request. |
The log files in $QIE_HOME/logs/ roll at 10 MB. They contain plain text and can be tailed in real time, exported, or shipped to a SIEM. Database revision history persists indefinitely (subject to the Message Retention Policy) and is queried through the QIE Console.
Account events that QIE does not log as separate file entries (password changes, session expiry, account-lock state transitions) are still recoverable from the revision history of the user record.