# Auditing of RBAC requests - confirmation and example log

**URL:** <https://community.replicated.com/t/auditing-of-rbac-requests-confirmation-and-example-log/534>\
**Category:** Supporting your customers\
**Created:** [June 21, 2021, 1:32pm UTC](https://community.replicated.com/t/auditing-of-rbac-requests-confirmation-and-example-log/534 "2021-06-21T13:32:21Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Karl\_Funk](https://yyz2.discourse-cdn.com/flex030/user_avatar/community.replicated.com/karl_funk/32/205_2.png) [@Karl\_Funk](https://community.replicated.com/u/Karl_Funk)\
**Post date:** [June 21, 2021, 1:32pm UTC](https://community.replicated.com/t/auditing-of-rbac-requests-confirmation-and-example-log/534/1 "2021-06-21T13:32:21Z")

</div>

I am in research mode. Can someone confirm that RBAC authorisations are logged to the Audit log; and if possible provide a example of an audit log entry for a denied operation pls?

---

<div class="post-metadata">

**Author:** ![dmitriy](https://yyz2.discourse-cdn.com/flex030/user_avatar/community.replicated.com/dmitriy/32/16_2.png) [@dmitriy](https://community.replicated.com/u/dmitriy)\
**Post date:** [June 21, 2021, 2:28pm UTC](https://community.replicated.com/t/auditing-of-rbac-requests-confirmation-and-example-log/534/2 "2021-06-21T14:28:02Z")

</div>

Audit log should only contain successful actions. Which audit log or product is this about?

---

<div class="post-metadata">

**Author:** ![Karl\_Funk](https://yyz2.discourse-cdn.com/flex030/user_avatar/community.replicated.com/karl_funk/32/205_2.png) [@Karl\_Funk](https://community.replicated.com/u/Karl_Funk)\
**Post date:** [June 21, 2021, 4:26pm UTC](https://community.replicated.com/t/auditing-of-rbac-requests-confirmation-and-example-log/534/3 "2021-06-21T16:26:02Z")

</div>

I can see (from public examples) that the audit log contains successful and unsuccessful Authentication events. I want to understand if RBAC events are similarly logged.

I would like to understand if a control is configured that specifies, for some resource “foo”

Alice : allow : read foo  
Bob : deny : read foo

Then both Alice and Bob attempt to read foo - will I see audit logs for both?

---

<div class="post-metadata">

**Author:** ![dmitriy](https://yyz2.discourse-cdn.com/flex030/user_avatar/community.replicated.com/dmitriy/32/16_2.png) [@dmitriy](https://community.replicated.com/u/dmitriy)\
**Post date:** [June 22, 2021, 9:24pm UTC](https://community.replicated.com/t/auditing-of-rbac-requests-confirmation-and-example-log/534/4 "2021-06-22T21:24:15Z")

</div>

No, actions blocked by RBAC are generally aren’t audit logged. Which product is this in regards to?