Enablement Guide For Keycloak Audit Logging and Events Tracing

This guide explains how to enable Keycloak Audit Logging and Event Tracing. Logging helps us monitor security-related activity and maintain visibility into events within Keycloak. The logs emitted by Keycloak are captured by Fluent Bit and forwarded to a log backend such as OpenSearch. This guide also explains how to verify that the logs are being captured correctly by Fluent Bit.

Prerequisites

• Fluent Bit is deployed/installed on your server or VM. Refer to the Fluent Bit Deployment Guide for instructions.

• A working instance of OpenSearch (or any SIEM tool) is available to receive logs forwarded by Fluent Bit. Refer to the OpenSearch Deployment Guide for setup details.

  • If no SIEM tool is configured, Fluent Bit will only retain logs within its container and will not forward them to any external system.

Types of Logging

Keycloak supports two types of logging:

1. Audit Logging

Audit logging primarily targets admin events. Admin events are actions (create, update and delete) performed by administrators using the Admin Console on various resources. These resources include users, clients, realms, groups, etc.

2. Events Logging

Event logging primarily targets user events. User events are actions performed by end users. These events include LOGIN, LOGIN_ERROR, LOGOUT, LOGOUT_ERROR, INTROSPECT_TOKEN, etc.

Enable Logging in Keycloak

You need to enable Keycloak event logging in the Admin Console to capture all audit logs and user event logs generated by Keycloak in Kubernetes. These logs will then be processed by Fluent Bit and forwarded to a log backend.

Steps:

1. Log in to the Keycloak Admin Console.

2. Select your realm from the left-hand menu (for example, Expertflow).

   

3. Go to Realm Settings → Events. From the Event listeners drop-down menu, select jboss-logging, then click Save.

   

4. In the User events settings section:

   • Ensure that Save events is enabled.

   • The Expiration field defines the number of hours after which the logs will be deleted from the Keycloak database. Set it as per your requirement.

     

5. In the Admin events settings section:

   • Enable Save events.

   • Enable Include representation.

   

You have now successfully enabled logging (both audit and event logging) in Keycloak. After applying these settings, all Keycloak events and audit logs will be emitted to the console (stdout) of the Keycloak pod running in Kubernetes. These logs will then be captured by Fluent Bit and forwarded to the configured log backend.

Logs Verification

To verify that the logs are being generated by Keycloak and captured by Fluent Bit for forwarding to a log backend, check the logs of the Fluent Bit pod in your Kubernetes environment using the following command:

k logs -n expertflow <fluent-bit-pod-name> | grep -E '"service":"KEYCLOAK"'

To follow the logs in real time while performing actions, use following command:

k logs -f -n expertflow <fluent-bit-pod-name> | grep -E '"service":"KEYCLOAK"'

This will help you confirm that Keycloak logs are being captured and processed correctly by Fluent Bit.

Logs Format

Both Audit Logs and Event Logs follow the OTLP format. The structure and expected fields for each type of log are described below.

{
  "action": "UPDATE",  // DELETE, CREATE
  "resource_id": "16ffd262-cce6-4a5f-9b9d-5910c86c3847",
  "source_ip_address": "192.168.X.X",
  "user_id": "3b9ae694-7289-46c0-a507-9edd4c3e351f",
  "user_name": "user",
  "type": "audit_logging",
  "attributes": {
    "service": "KEYCLOAK",
    "tenantId": "ded64546-3787-41b7-a466-3645e969bc94",
    "additionalInfo": {
      "resourcePath": "users/16ffd262-ac43-4a5f-9b9d-5910c85c3847",
      "clientId": "64d30d1d-e5d3-4f03-827d-809ffe1a3265",
      "eventCategory": "ADMIN"
    }
  },
  "level": "INFO",
  "resource": "USER",  // REALM, CLIENT, etc.
  "timestamp": "2026-02-26T10:35:20.214Z"
}

{
  "operation": "LOGIN", // LOGIN_ERROR, LOGOUT, etc.
  "level": "INFO",
  "attributes": {
    "source_ip_address": "192.168.X.X",
    "user_id": "3b9ae694-7289-46c0-c403-9edf8b8e351f",
    "user_name": "admin"
  },
  "timestamp": "2026-02-26T10:28:43.090Z",
  "status": "OK", // ERROR
  "type": "tracing",
  "trace_id": "keycloak-tracing",
  "service": "KEYCLOAK",
  "tenantId": "ded64546-3787-41b7-a466-3645e969bc94",
  "message": ""
}

 {
  "operation": "LOGIN_ERROR",
  "level": "WARN",
  "attributes": {
    "source_ip_address": "192.168.X.X",
    "user_id": "4b8bd859-16e0-3454-a46b-401de10fa297",
    "user_name": "admin"
  },
  "timestamp": "2026-02-24T13:48:04.746Z",
  "status": "ERROR",
  "error": {
    "message": "invalid_user_credentials",
    "error_code": "LOGIN_ERROR",
    "cause": ""
  },
  "type": "tracing",
  "trace_id": "keycloak-tracing",
  "service": "KEYCLOAK",
  "tenantId": "expertflow",
  "message": "invalid_user_credentials"
}