# SystemConfigurationAuditEventRecordingType (Complex Type)

### Namespace: http://midpoint.evolveum.com/xml/ns/public/common/common-3

Details about creation and recording of audit events.

Item Summary
Name | Type | Multiplicity | Description
--- | --- | --- | ---
recordResourceStageChanges | property boolean | [0,1] | If set to true, midPoint will record audit events for shadow changes on provisioning level.
recordResourceOids | property boolean | [0,1] | If set to true, the resource OIDs will be recorded in the audit event records.
expression | property ExpressionType | [0,1] | Optional expression to be executed to amend AuditEventRecord.
property | container SystemConfigurationAuditEventRecordingPropertyType | [0,-1] | Specifies details how an audit event record property is created.
escapeIllegalCharacters | property boolean | [0,1] | Should illegal characters (like majority of 0x00-0x1F in XML 1.
recordSessionlessAccess | property boolean | [0,1] | There are services in midPoint that are not using concept of access session.
deltaSuccessExecutionResult | property OperationResultDetailLevel | [0,1] | Specifies how the successful operation result from delta execution is stored in the repository.

- ### Items

  - #### recordResourceStageChanges

    Flags: RAM,runtime

    Multiplicity: [0,1]

    Display order:

    If set to true, midPoint will record audit events for shadow changes on provisioning level.

  - #### recordResourceOids

    Flags: RAM,runtime

    Multiplicity: [0,1]

    Display order:

    If set to true, the resource OIDs will be recorded in the audit event records. Recording resource OIDs means additional (storage) overhead. Therefore it is turned off by default.

  - #### expression

    Flags: RAM,runtime

    Multiplicity: [0,1]

    Display order:

    Optional expression to be executed to amend AuditEventRecord. Expression must return the record, return null to skip auditing for this record. Following variables are provided: - auditRecord of type AuditEventRecord (this or null is to be returned) - target (primary object), PrismObject, the type depends on the event

  - #### property

    Flags: RAM,runtime

    Multiplicity: [0,-1]

    Display order:

    Specifies details how an audit event record property is created.

  - #### escapeIllegalCharacters

    Flags: RAM,runtime

    Multiplicity: [0,1]

    Display order:

    Should illegal characters (like majority of 0x00-0x1F in XML 1.0) be escaped? If they occur and are not escaped, audit operation will fail. If they are stored in escaped form, audit operation will succeed but some parts of the audit records will not be correctly machine processable in the future. So the default value is "false".

  - #### recordSessionlessAccess

    Flags: RAM,runtime

    Multiplicity: [0,1]

    Display order:

    There are services in midPoint that are not using concept of access session. No session is created for such services. Therefore there are no audit records about session creation or termination. Access to such services is not recorded in the audit log by default. Setting `recordSessionlessAccess` to `true` will force recording of session start/end events even for session-less services.

  - #### deltaSuccessExecutionResult

    Flags: RAM,runtime,AVals:4

    Multiplicity: [0,1]

    Display order:

    Specifies how the successful operation result from delta execution is stored in the repository. Operation results from delta execution can take a lot of space and are often not that important if the result status is `success`. By default, the result is cleaned up from successful minor results, but there is also option to store only the top level result (root) without any subresults or even nothing at all. Finally, there is also option to store the original full result. [NOTE] This option only works for new Native repository audit.