11.6.9. About the Audit Log

If the LogAuditProvider module is enabled, JBoss EAP 6 maintains an audit log which records authentication and authorization in applications and login modules. The file is named audit.log by default and stored in the log subdirectory of the EAP_HOME directory. This behavior is determined by the configuration of the logging subsystem's log handlers. The output of the LogAuditProvider module could be sent to a syslog server in addition to or instead of a file, by using the syslog log handler.
By default, the LogAuditProvider module outputs only to cumulative audit.log file. To implement a periodic rotating file handler called AUDIT, enter the following management CLI command.
/subsystem=logging/periodic-rotating-file-handler=AUDIT/:add(suffix=.yyyy-MM-dd,formatter=%d{HH:mm:ss,SSS} %-5p [%c] (%t) %s%E%n,level=TRACE,file={"relative-to" => "jboss.server.log.dir","path" => "audit.log"})