“Who removed this user from the administrators group, and when?” To answer questions like that in an OBIEE 11g bifoundation_domain (WebLogic 10.3.6) environment, I turned on WebLogic auditing and analyzed the logs. WebLogic has two features for this:
- An Auditing provider (the WebLogic Auditing provider, shown as DefaultAuditor in the console) records security events such as successful and failed logins in
DefaultAuditRecorder.log. - Configuration auditing sends domain configuration changes and management operations (adding or removing group members, for example) to the Administration Server log, to the Auditing provider, or to both.
This post combines three notes I wrote in Notion in August and September 2024. In October 2026 I checked every point against Oracle’s documentation (the 12.2.1.4 and 14.1.2 editions of “Configuring the WebLogic Auditing Provider”, plus the 14.1.2 MBean reference) and corrected what was wrong.
The original notes had 13 screenshots of the WebLogic 10.3.6 Administration Console. I left them out: the Administration Console was removed in 14.1.2 in favor of the WebLogic Remote Console, and the 12.2.1.4 console looks different. Instead, this post gives the menu path for each tool and WLST commands that work regardless of version.
Tools by version
| Version | UI | Scripting |
|---|---|---|
| 10.3.6 to 12.2.1.4, 14.1.1 | WebLogic Server Administration Console (/console) | WLST |
| 14.1.2 and later | WebLogic Remote Console (installed separately; the Administration Console was removed) | WLST |
1. Check the current settings
The default security realm (myrealm) does not include an Auditing provider. Start by checking where you are.
- Auditing provider
- Administration Console: Security Realms > myrealm > Providers > Auditing. An empty list means none is configured.
- Remote Console (14.1.2): Edit Tree > Security > Realms > myrealm > Auditors
- Configuration Audit Type
- Administration Console: domain name > Configuration > General > Advanced > Configuration Audit Type
- Remote Console (14.1.2): Edit Tree > Environment > Domain > Show Advanced Fields > Configuration Audit Type
- The default is
none(nothing is recorded).
WLST reads the same MBean attributes on any version:
# $ORACLE_HOME/oracle_common/common/bin/wlst.sh
connect('weblogic', '<password>', 't3://<admin-host>:7001')
realm = cmo.getSecurityConfiguration().getDefaultRealm()
print([a.getName() for a in realm.getAuditors()]) # empty list = no Auditing provider
print(cmo.getConfigurationAuditType()) # none / log / audit / logaudit
disconnect()My original note said that auditing is on if DefaultAuditRecorder.log exists in the server’s log directory. The file can remain after auditing has been turned off, though, so go by the settings above instead.
2. Add an Auditing provider
Administration Console (12.2.1.4 and earlier)
- In the Change Center, click Lock & Edit.
- Go to Security Realms > myrealm > Providers > Auditing and click New.
- Enter a name (for example,
MyAuditProvider), chooseDefaultAuditoras the type, and click OK. - Open the new provider, go to Configuration > Provider Specific, set the values, and click Save (see “Key settings” below).
- Click Activate Changes.
Remote Console (14.1.2): In the Edit Tree, go to Security > Realms > myrealm > Auditors, click New, enter a Name, choose DefaultAuditor as the Type, and click Create. Then set the values on the Default Auditor Parameters tab and click Save.
WLST
connect('weblogic', '<password>', 't3://<admin-host>:7001')
edit()
startEdit()
realm = cmo.getSecurityConfiguration().getDefaultRealm()
aud = realm.createAuditor('MyAuditProvider', 'weblogic.security.providers.audit.DefaultAuditor')
aud.setSeverity('ERROR') # see "Key settings"
aud.setRotationMinutes(1440) # new file once a day
save()
activate()
disconnect()Restart: Changing the realm’s provider list is not a dynamic change (the MBean reference says “Changes take effect after you redeploy the module or restart the server”). If the realm has Automatically Restart after Non-Dynamic Changes enabled, the realm restarts itself; otherwise, restart the servers. In the 10.3.6 console, activating the change showed “2 items must be restarted”.
Key settings
Severity: The provider records events of the chosen severity and every severity ranked above it. The default is ERROR.
| Severity | Rank |
|---|---|
| INFORMATION | 1 |
| WARNING | 2 |
| ERROR | 3 |
| SUCCESS | 4 |
| FAILURE | 5 |
Setting it to INFORMATION, for example, records every event. To pick specific severities, set it to CUSTOM and enable only the ones you need; the WLST attributes are InformationAuditSeverityEnabled, WarningAuditSeverityEnabled, ErrorAuditSeverityEnabled, SuccessAuditSeverityEnabled, and FailureAuditSeverityEnabled. The 14.1.2 MBean reference lists CUSTOM as the secure value, with WARNING, ERROR, and FAILURE enabled.
Rotation Minutes: How often (in minutes) a new DefaultAuditRecorder.log is started. The default is 1440 (one day). The previous file stays in the same directory as DefaultAuditRecorder.YYYYMMDDHHMM.log.
Active ContextHandler Entries: Which ContextHandler entries attached to an audit event are recorded. By default, none are.
Log location: The Auditing provider is configured per security realm, but each server writes its own file in its own directory. The default is <DOMAIN_HOME>/servers/<SERVER_NAME>/logs/DefaultAuditRecorder.log. To change it, use the startup option -Dweblogic.security.audit.auditLogDir=/audit; the file then goes to /audit/<SERVER_NAME>/logs/DefaultAuditRecorder.log.
3. Turn on configuration auditing
| Value | Behavior |
|---|---|
none (default) | Nothing is recorded |
log | Written to the Administration Server log file only |
audit | Audit events only (handled by the Auditing provider) |
logaudit | Written to the Administration Server log and emitted as audit events |
audit and logaudit need the Auditing provider from step 2 to receive the events. The 14.1.2 MBean reference lists audit as the secure value. I used log or logaudit so the records also land in the Administration Server log, where people can read them directly.
- Administration Console: domain name > Configuration > General > Advanced > Configuration Audit Type, then Save and Activate Changes. The list shows labels such as “Change Log” and “Change Log and Audit”.
- Remote Console (14.1.2): Edit Tree > Environment > Domain > Show Advanced Fields > Configuration Audit Type, then Save.
- WLST:
connect('weblogic', '<password>', 't3://<admin-host>:7001')
edit()
startEdit()
cmo.setConfigurationAuditType('logaudit')
save()
activate()
disconnect()You can also start the Administration Server with -Dweblogic.domain.ConfigurationAuditType="logaudit". My original note said to restart the server after saving, but the MBean reference does not mark this attribute as requiring a restart.
4. Read the configuration audit log
The Administration Server writes configuration auditing messages to its own log file (<DOMAIN_HOME>/servers/AdminServer/logs/AdminServer.log); by default they are not written to the domain-wide log. Their message IDs fall in the range 159900–159910 and appear in the log as BEA-1599xx.
| ID | Message format |
|---|---|
| 159900 | USER username CREATED MBean-name |
| 159904 | USER username MODIFIED MBean-name ATTRIBUTE attribute-name FROM old-value TO new-value |
| 159907 | USER username INVOKED ON MBean-name METHOD operation-name PARAMS specified-parameters |
Here is an entry from that environment (host name and user ID changed). It records the weblogic account removing user01 from the BIAdministrators group.
<Sep 16, 2024 9:54:38 PM EDT> <Info> <Configuration Audit> <host01> <AdminServer> <[ACTIVE] ExecuteThread: '0' for queue: 'weblogic.kernel.Default (self-tuning)'> <weblogic> <> <...> <1726538078198> <BEA-159907> <USER weblogic INVOKED ON Security:Name=myrealmDefaultAuthenticator METHOD removeMemberFromGroup PARAMS BIAdministrators; user01>When the logs are large, this script pulls out only the configuration audit lines as “time | message ID | message”. Pass a search term (for example, addMemberToGroup) as the second argument to keep only matching lines.
#!/bin/bash
# Usage: ./config_audit_report.sh <AdminServer log directory> [search term]
# Example: ./config_audit_report.sh $DOMAIN_HOME/servers/AdminServer/logs MemberFromGroup
LOG_DIR=${1:?log directory required}
FILTER=${2:-}
ls "$LOG_DIR"/AdminServer.log* >/dev/null 2>&1 || { echo "No logs in: $LOG_DIR"; exit 1; }
# Read rotated AdminServer.log00001... first and the current AdminServer.log last
cat "$LOG_DIR"/AdminServer.log[0-9]* "$LOG_DIR"/AdminServer.log 2>/dev/null \
| grep -E '<BEA-1599(0[0-9]|10)>' \
| grep -F -- "$FILTER" \
| sed -E 's/^(####)?<([^>]*)>.*<(BEA-1599[0-9]{2})> <(.*)>$/\2 | \3 | \4/'Sep 16, 2024 9:54:38 PM EDT | BEA-159907 | USER weblogic INVOKED ON Security:Name=myrealmDefaultAuthenticator METHOD removeMemberFromGroup PARAMS BIAdministrators; user01My original script searched for AdminServer*.log, which misses rotated files such as AdminServer.log00001, and only extracted two group-membership operations. This version includes rotated files and covers every configuration auditing message in the 159900–159910 range.
Things to watch
- Performance: Oracle notes that an Auditing provider affects performance even if only a few events are logged. Choose the severity and check the load before using it in production.
- External LDAP: When an external LDAP such as OID is the authentication provider, changes made directly in the LDAP, without going through WebLogic, don’t appear in WebLogic configuration auditing. Track those with the LDAP server’s own auditing.
- Retention:
DefaultAuditRecorder.*.logandAdminServer.log*keep growing, so plan retention and disk cleanup along with them. - WLST examples: The names and values in the WLST commands above were checked against Oracle’s MBean reference (
RealmMBean.createAuditor,DomainMBean.ConfigurationAuditType) and the 12.2.1.4 and 14.1.2 MBean metadata. Run them in a test domain before using them on a production domain.
Summary
Security events go to DefaultAuditRecorder.log through an Auditing provider (DefaultAuditor); configuration changes and management operations go to the Administration Server log through configuration auditing. From 14.1.2 there is no Administration Console, so use the Remote Console or WLST. Collecting the BEA-1599xx messages shows who changed what, and when, for things like group membership.
To start WebLogic without the password prompt, see WebLogic boot.properties: Start Servers Without the Password Prompt. For a case where only the weblogic account signs in slowly, see OAS Sign-In Delays: When AD Users Are Fast but weblogic Is Slow.
