@Sunny93 as this is an older post, you would have a better chance of receiving a resolution by starting a new thread. This will also be an opportunity to provide details specific to your environment that could aid others in assisting you with a more accurate answer to your question. You can link this thread as a reference in your new post. ... View more

This is the remote ip > The address I saw in the log was not the IP of either the knox's curl client or even the LB that is in the path between the client and knox. So not sure how this field is supposed to help in auditing. It could possibly be due to - cluster's network is NAT-ed before hitting LB. event time is not followed by a | > So it does seem like a cosmetic bug in AuditLayout code I dont think knox will try to interpret the actual response > Thanks for the confirmation Felix. Just a thought, this seems counter-intuitive considering audit's purpose should be to record whether the operation was allowed or denied. Seems like it is lacking some context. Thanks for your inputs. ... View more