Event logging

EID Server records a structured audit trail of significant lifecycle events — credential issuance, application review, authentication outcomes — in Common Event Format (CEF). Event logs are separate from the system log and intended for security monitoring, audit, and SIEM ingestion.

Enabling event logging

Event logging requires the CefEventModule to be present in config/modules/:

{
    "name": "CefEventModule"
}

Without this module, no CEF events are produced.

Log file

logs/event.log — rotated daily, with previous days kept as logs/event.YYYY-MM-DD.log.

In container deployments with the -c flag, event output is written to stdout alongside system log output.

Event format

Events follow the CEF standard:

CEF:0|Fortified ID|EID|<version>|<event-id>|<event-name>|<severity>|<extensions>

Field	Description
CEF:0	CEF version
Fortified ID	Vendor
EID	Product
<version>	Server version
<event-id>	Unique event type identifier
<event-name>	Human-readable event description
<severity>	Integer 0–10
<extensions>	Key-value pairs with event-specific context

Example:

CEF:0|Fortified ID|EID|2026.232|EID_100001|Credential issued|5|src=10.0.0.1 orgId=org-example credentialId=abc123

Log4j2 configuration

The event logger is an async logger named EVENT. In the default configuration it routes to the console (stdout). To write events to a dedicated file, wire the EVENT appender in log4j2.xml:

<AsyncLogger name="EVENT" level="INFO" additivity="false">
    <AppenderRef ref="EVENT"/>
</AsyncLogger>

The EVENT rolling file appender is already defined in the default log4j2.xml — only the AppenderRef needs to be added to the logger.

Note

CEF event lines use a bare %m%n pattern — no timestamp or thread prefix. The timestamp is embedded in the CEF payload itself.