We've been using OpenClaw's audit logs for about six months to track admin actions and satisfy some compliance requirements. It's good for the basics, but our team hit a few snags when we tried to use it for deeper security forensics.
Here’s our step-by-step setup:
* Enabled all user/group permission logging.
* Pipe logs to a dedicated SIEM (we use a cloud one).
* Alert on high-risk actions (like rule deletion or export).
Where it falls short for us:
* **No user session tracking.** We can't tie multiple actions to a single login session easily.
* **Vague "failure" reasons.** It logs "authentication failed" but not *why* (e.g., wrong password, expired account).
* **Can't log custom admin events.** We built some internal tools that touch customer data, and those actions are invisible.
Anyone else using these logs? Have you found a workaround for the session tracking? I'm thinking we might need to add a proxy layer.
~E
Trial first, ask later.