If you made any policy changes, click Apply to save the changes. For Java

Configuring and Managing Auditing 12-19 The following invocation of setAuditPolicy performs this task: setAuditPolicy filterPreset=None,addSpecialUsers=user2,user3,removeSpecialUsers=user1

12.3.3.4 Example 2: Configuring an Audit Policy for Events with WLST

In this scenario, the domain’s current policy audits user logout events. We would like to remove the logout events from the policy and instead, audit login events. The following invocation of setAuditPolicy performs this task: setAuditPolicy filterPreset=Custom,addCustomEvents=OHS:UserLogin, removeCustomEvents=OHS:UserLogout Notice that we had to set the Custom filter preset to add and remove events.

12.3.3.5 Custom Configuration is Retained when the Audit Level Changes

When auditing is configured at the custom audit level, and you subsequently use WLST to switch to a different non-custom audit level, the custom audit settings are retained unless you explicitly remove those custom settings. An example illustrates this behavior:

1. Custom audit level is set for a components policy. An audit filter is specified as

part of the configuration.

2. At run-time, audit data is collected according to the specified filter.

3. The components audit policy is now changed from custom audit level to, say, the

low audit level using the WLST setauditpolicy command. However, the filter that was set up as part of the custom audit level persists in the audit configuration.

4. Audit data is now collected based on the low audit level, not the custom level.

5. The components audit policy is changed back to custom level. An additional filter

is added; this filter is appended to the originally configured filter. Unless the original filter is explicitly deleted, it remains part of the configuration.

6. At run-time, audit data is collected based on all prevailing filters at the custom

level. See Also: Section C.4.3, setAuditPolicy Note: This example uses the component type OHS for Oracle HTTP Server. Substitute the relevant component type when using the command. Note: This behavior only occurs when using WLST; if you use Fusion Middleware Control to manage audit configuration, the custom audit settings are cleared when you switch from the custom audit level to a different audit level.