Allow audit logging to be turned on/off without server restart by ankit--sethi · Pull Request #147333 · elastic/elasticsearch

ankit--sethi · 2026-04-23T18:00:30Z

Currently the setting xpack.security.audit.enabled requires a server restart to flip on/off since AuditTrailService is initialized in Security.java with a null/non-null LoggingAuditTrail instance based on the setting value.

This change updates AuditTrailService to always hold a reference to a working LoggingAuditTrail instance; whether it gets used or not is gated by the current value of the setting.

The setting itself is updated to be Setting.Property.Dynamic and AuditTrailService will now check its current value to switch between regular audit logging or a no-op.

Various tests are adjusted to work with this change, plus three new integration tests that cover an ES server turning on with the setting on/off/unset respectively, and then flipping its value back and forth. Each integration tests uses the PUT /_cluster/settings API to update xpack.security.audit.enabled, and uses the GET /_security/_authenticate API to trigger an access_granted audit event (or lack thereof).

…rt since AuditTrailService is initialized or not based on its value during server start. This change updates the code to always have AuditTrailService/LoggingAuditTrail ready to go, gated by current value of the setting. The setting is updated to be dynamic and AuditTrailService is updated to check its current value to switch between regular audit operations or a no-op. Various tests are adjusted to work with this change, plus three new integration tests that cover an ES server turning on with the setting on/off/unset respectively, and then flipping its value back and forth.

elasticsearchmachine · 2026-04-23T18:01:54Z

Pinging @elastic/es-security (Team:Security)

…thout-restart' into feature/change-audit-settings-without-restart

ebarlas

Nice work overall. Gating at AuditTrailService.get() is a tidy solution. End-to-end coverage of the three startup states and the runtime toggle is good.

I offered a handful of suggestions, ranging from docs to code clean-up and organization.

ebarlas · 2026-04-27T19:56:00Z

+        if (isAuditEnabled == false) {
+            return NOOP_AUDIT_TRAIL;
+        }
        if (auditTrail != null) {


Since auditTrail is no longer nullable, this branching logic can be removed.

ebarlas · 2026-04-27T19:58:17Z

 /**
- * Manages the lifecycle, mapping and data upgrades/migrations of the {@code RestrictedIndicesNames#SECURITY_MAIN_ALIAS}
- * and {@code RestrictedIndicesNames#SECURITY_MAIN_ALIAS} alias-index pair.
+ * Manages the lifecycle, mapping and data upgrades/migrations of the {@link SecuritySystemIndices#SECURITY_MAIN_ALIAS}


This seems unrelated. Was it intended?

ebarlas · 2026-04-27T20:14:45Z

+public class AuditLoggingDefaultAtStartupDynamicSwitchingTests extends AuditLoggingOffAtStartupDynamicSwitchingTests {
+
+    @Override
+    protected boolean addMockHttpTransport() {


This override isn't needed. It's a duplicate of AuditLoggingOffAtStartupDynamicSwitchingTests.

the abstract base class change covers these and the rest of the issues

ebarlas · 2026-04-27T20:14:55Z

+        return Settings.builder().put(super.nodeSettings(nodeOrdinal, otherSettings)).remove(XPackSettings.AUDIT_ENABLED.getKey()).build();
+    }
+
+    public void testFlippingAuditLogFalseToTrueToFalse() throws IOException {


Missing @Override.

ebarlas · 2026-04-27T20:15:26Z

+public class AuditLoggingOnAtStartupDynamicSwitchingTests extends AuditLoggingOffAtStartupDynamicSwitchingTests {
+
+    @Override
+    protected boolean addMockHttpTransport() {


This override isn't needed. It's a duplicate of AuditLoggingOffAtStartupDynamicSwitchingTests.

ebarlas · 2026-04-27T20:15:35Z

+            .build();
+    }
+
+    public void testFlippingAuditLogFalseToTrueToFalse() throws IOException {


Missing @Override.

ebarlas · 2026-04-27T20:18:25Z

+import java.io.IOException;
+
+@ESIntegTestCase.ClusterScope(scope = ESIntegTestCase.Scope.TEST, numDataNodes = 1)
+public class AuditLoggingOffAtStartupDynamicSwitchingTests extends SecurityIntegTestCase {


For clarity, you might consider a slightly different arrangement with an abstract base class and three concrete subclasses. The off-at-start concrete base class with test method overrides is somewhat surprising.

For example:

public abstract class AbstractAuditLoggingDynamicSwitchingTestCase extends SecurityIntegTestCase { ... @Override protected final Settings nodeSettings(int nodeOrdinal, Settings otherSettings) { ... startupAuditEnabled().ifPresent(value -> builder.put(XPackSettings.AUDIT_ENABLED.getKey(), value)); ... } ... protected abstract Optional<Boolean> startupAuditEnabled(); ... }

agreed, I was getting lazy here, thanks!

ebarlas · 2026-04-27T20:41:10Z

        false,
-        Setting.Property.NodeScope
+        Setting.Property.NodeScope,
+        Setting.Property.Dynamic


Consider including corresponding edits in docs/reference/elasticsearch/configuration-reference/auding-settings.md

ooh yeah that was a miss. There might also be some other doc updates downstream of merging this. I'll check.

ebarlas · 2026-04-27T20:45:05Z

+    public AuditTrailService(AuditTrail auditTrail, XPackLicenseState licenseState, ClusterService clusterService) {
        this.auditTrail = auditTrail;
        this.licenseState = licenseState;
+        clusterService.getClusterSettings().initializeAndWatch(XPackSettings.AUDIT_ENABLED, newValue -> isAuditEnabled = newValue);


Consider adding a log statement in the settings callback to highlight the audit change.

github-actions · 2026-05-05T16:30:42Z

🔍 Preview links for changed docs

docs/reference/elasticsearch/configuration-reference/auding-settings.md

github-actions · 2026-05-05T16:33:08Z

ℹ️ Important: Docs version tagging

👋 Thanks for updating the docs! Just a friendly reminder that our docs are now cumulative. This means all 9.x versions are documented on the same page and published off of the main branch, instead of creating separate pages for each minor version.

We use applies_to tags to mark version-specific features and changes.

Expand for a quick overview

When to use applies_to tags:

✅ At the page level to indicate which products/deployments the content applies to (mandatory)
✅ When features change state (e.g. preview, ga) in a specific version
✅ When availability differs across deployments and environments

What NOT to do:

❌ Don't remove or replace information that applies to an older version
❌ Don't add new information that applies to a specific version without an applies_to tag
❌ Don't forget that applies_to tags can be used at the page, section, and inline level

🤔 Need help?

Check out the cumulative docs guidelines
Reach out in the #docs Slack channel

…thout-restart' into feature/change-audit-settings-without-restart

docs update Co-authored-by: shainaraskas <58563081+shainaraskas@users.noreply.github.com>

…thout-restart' into feature/change-audit-settings-without-restart

ebarlas

LGTM! I added a few additional comments about docs and PR labels.

ebarlas · 2026-05-08T15:40:00Z

The section needs to be updated as well to reflect the dynamic setting change.

ebarlas · 2026-05-08T15:55:18Z

+
+    This setting can be changed at runtime using the [cluster update settings API](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-cluster-put-settings) without requiring a node restart.
+
+    :::{note} 


I believe this PR is an "enhancement", which means it will only be available in the next release, 9.5.0.

elasticsearchmachine · 2026-05-08T16:07:23Z

Hi @ankit--sethi, I've created a changelog YAML for you.

…thout-restart' into feature/change-audit-settings-without-restart

…ic#147333) * Currently the setting `xpack.security.audit.enabled` requires a restart since AuditTrailService is initialized or not based on its value during server start. This change updates the code to always have AuditTrailService/LoggingAuditTrail ready to go, gated by current value of the setting. The setting is updated to be dynamic and AuditTrailService is updated to check its current value to switch between regular audit operations or a no-op. Various tests are adjusted to work with this change, plus three new integration tests that cover an ES server turning on with the setting on/off/unset respectively, and then flipping its value back and forth. * [CI] Auto commit changes from spotless * fix tests * [CI] Auto commit changes from spotless * fix without breaking other things * code review feedback * fix tests * Apply suggestions from code review docs update Co-authored-by: shainaraskas <58563081+shainaraskas@users.noreply.github.com> * fix tests * Update docs/changelog/147333.yaml * tweak language and update versions to reflect this is an enhancement * fix error * fix - doc changes are cumulative so not deleting the sentence. * fix - doc changes are cumulative so not deleting the sentence. --------- Co-authored-by: elasticsearchmachine <infra-root+elasticsearchmachine@elastic.co> Co-authored-by: shainaraskas <58563081+shainaraskas@users.noreply.github.com>

## Summary Companion Docs PR to the update [here](elastic/elasticsearch#147333). The audit logging enabled/disabled setting has changed from static to dynamic for version 9.5+. ## Generative AI disclosure  1. Did you use a generative AI (GenAI) tool to assist in creating this contribution? - [x] Yes - [ ] No Claude Opus --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Vlada Chirmicci <vlada.chirmicci@elastic.co>

ankit--sethi requested a review from a team April 23, 2026 18:00

ankit--sethi self-assigned this Apr 23, 2026

ankit--sethi added :Security/Audit X-Pack Audit logging >non-issue labels Apr 23, 2026

Merge branch 'main' into feature/change-audit-settings-without-restart

b267fd6

elasticsearchmachine added the Team:Security Meta label for security team label Apr 23, 2026

ankit--sethi added v9.5.0 auto-backport Automatically create backport pull requests when merged v8.19.16 v9.3.5 v9.4.1 labels Apr 23, 2026

elasticsearchmachine and others added 3 commits April 23, 2026 18:07

[CI] Auto commit changes from spotless

aaad513

fix tests

572024f

Merge remote-tracking branch 'origin/feature/change-audit-settings-wi…

1f9d550

…thout-restart' into feature/change-audit-settings-without-restart

ankit--sethi changed the title ~~Allow audit logging to turned on/off without server restart~~ Allow audit logging to be turned on/off without server restart Apr 23, 2026

elasticsearchmachine and others added 3 commits April 23, 2026 21:23

[CI] Auto commit changes from spotless

56ad211

fix without breaking other things

cbc8ca6

Merge remote-tracking branch 'origin/feature/change-audit-settings-wi…

d1c0b5f

…thout-restart' into feature/change-audit-settings-without-restart

ebarlas reviewed Apr 27, 2026

View reviewed changes

code review feedback

95a6699

ankit--sethi requested a review from a team as a code owner May 5, 2026 16:27

Merge branch 'main' into feature/change-audit-settings-without-restart

8a18406

shainaraskas reviewed May 5, 2026

View reviewed changes

Comment thread docs/reference/elasticsearch/configuration-reference/auding-settings.md

Ankit Sethi added 3 commits May 5, 2026 13:00

fix tests

1c99256

Merge remote-tracking branch 'origin/feature/change-audit-settings-wi…

bb07279

…thout-restart' into feature/change-audit-settings-without-restart

Merge branch 'main' into feature/change-audit-settings-without-restart

6ae2c2f

ankit--sethi and others added 4 commits May 5, 2026 13:27

Apply suggestions from code review

e2b61d8

docs update Co-authored-by: shainaraskas <58563081+shainaraskas@users.noreply.github.com>

fix tests

2ebca50

Merge remote-tracking branch 'origin/feature/change-audit-settings-wi…

f70a6bb

…thout-restart' into feature/change-audit-settings-without-restart

Merge branch 'main' into feature/change-audit-settings-without-restart

a9820ac

ankit--sethi requested a review from ebarlas May 6, 2026 21:03

Merge branch 'main' into feature/change-audit-settings-without-restart

7d3ea50

ebarlas reviewed May 8, 2026

View reviewed changes

ankit--sethi added >enhancement and removed >non-issue auto-backport Automatically create backport pull requests when merged v9.4.1 v9.3.5 v8.19.16 labels May 8, 2026

ebarlas approved these changes May 8, 2026

View reviewed changes

Update docs/changelog/147333.yaml

0de6ba5

Ankit Sethi added 8 commits May 8, 2026 11:10

tweak language and update versions to reflect this is an enhancement

24e7a20

Merge remote-tracking branch 'origin/feature/change-audit-settings-wi…

3f8da8c

…thout-restart' into feature/change-audit-settings-without-restart

fix error

a43c99e

Merge branch 'main' into feature/change-audit-settings-without-restart

69ee516

fix - doc changes are cumulative so not deleting the sentence.

4884171

fix - doc changes are cumulative so not deleting the sentence.

82cc4d7

Merge remote-tracking branch 'origin/feature/change-audit-settings-wi…

805519b

…thout-restart' into feature/change-audit-settings-without-restart

Merge branch 'main' into feature/change-audit-settings-without-restart

7309c76

ankit--sethi merged commit 6a6d6ab into elastic:main May 11, 2026
43 checks passed

ankit--sethi deleted the feature/change-audit-settings-without-restart branch May 11, 2026 16:51

ankit--sethi mentioned this pull request May 14, 2026

audit log enabled/disabled becomes dynamic elastic/docs-content#6506

Merged

1 of 2 tasks


		This setting can be changed at runtime using the [cluster update settings API](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-cluster-put-settings) without requiring a node restart.

		:::{note}

Conversation

ankit--sethi commented Apr 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

elasticsearchmachine commented Apr 23, 2026

Uh oh!

ebarlas left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented May 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔍 Preview links for changed docs

Uh oh!

github-actions Bot commented May 5, 2026

ℹ️ Important: Docs version tagging

When to use applies_to tags:

What NOT to do:

🤔 Need help?

Uh oh!

Uh oh!

ebarlas left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

elasticsearchmachine commented May 8, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

ankit--sethi commented Apr 23, 2026 •

edited

Loading

github-actions Bot commented May 5, 2026 •

edited

Loading

ebarlas left a comment •

edited

Loading