Skip to main content
This guide explains how to install and configure the Audit Trail plugin for Jenkins to capture an auditable record of administrative and job-related actions (for example, job configuration changes, system configuration updates, or job executions). Audit Trail can write logs to a local file (with rotation), send them to syslog, print to the Jenkins console, or forward events to an external Elasticsearch server.
Use Audit Trail to maintain an auditable record of administrative and job-related actions. Choose the logging destination that fits your operational and compliance requirements (local file, syslog, or Elasticsearch).

​
Install the plugin

  1. In Jenkins go to Manage Jenkins → Manage Plugins.
  2. Install from the Available tab (or check Installed if you already have it).
  3. After installation, open Manage Jenkins → Configure System and scroll to the Audit Trail section.
The plugin provides the following logger options:
A screenshot of a Jenkins plugin documentation page showing sections for "Console logger" and "Elastic Search logger" with configuration screenshots. A dark-themed layout has a right sidebar listing previous security warnings (e.g., XSS vulnerability).

​
Configure Audit Trail (example: Log file with daily rotation)

This example configures Audit Trail to write rotated daily logs to /var/log/jenkins/custom-audit-%g.log.
  1. Open Manage Jenkins → Configure System → Audit Trail.
  2. Enable Log file (daily rotation).
  3. Set the log file name pattern. Use %g for rotated file numbering, for example:
  1. Optionally set the number of rotated files to keep (file count).
  2. Provide a regular expression to match Jenkins endpoints/actions you want to capture. Example:
The pattern above captures common administrative and job actions such as configuration submissions, deletes, enabling/disabling items, stopping builds, creating jobs/views, and restarting or shutting down Jenkins. After saving, Audit Trail will begin writing events to the configured file(s), using the rotation and retention settings you specified.
Ensure the Jenkins process has write permissions to the configured log directory (for example /var/log/jenkins). On systems with SELinux or custom permissions, you may need to adjust policies or folder ownership (chown jenkins:jenkins /var/log/jenkins) to allow logging.

​
Test and verify logging

To verify the configuration:
  1. Make a small change to a job (for example, update a step that echoes messages).
  2. Trigger a build for that job.
  3. Check the log directory for the rotated audit files.
Example: a pipeline job named monitor-jenkins is modified and a build is triggered.
A screenshot of a Jenkins pipeline page (dark theme) for a job named "monitor-jenkins," showing recent pipeline runs with stage progress (Start, Echo Message, Echo Message2, End) and a left sidebar containing actions like Build Now, Configure, and Open Blue Ocean. The top bar shows the logged-in user and search/notifications.
Example shell session showing the log files and recent logged events:
Inspect the contents of the audit log:
Interpretation of these log entries:
  • The first line shows a configuration submission for the job monitor-jenkins by user siddharth from IP 124.123.186.17.
  • The next lines show job #29 being started and then completed successfully, with timestamps and node information.
  • Subsequent entries show Manage Jenkins configuration changes.

​
Adapting Audit Trail to your environment

  • Syslog: Forward events to your centralized syslog collector for aggregation and retention.
  • Elasticsearch: Send events to an Elasticsearch cluster for indexing, search, and visualization (useful with Kibana).
  • Local files: Use rotated files for local retention and offline audits.
Useful links and references: You have now installed the Audit Trail plugin, configured it for daily log rotation to /var/log/jenkins/custom-audit-%g.log, and verified that configuration changes and job executions are recorded.

Watch Video