The way I'm currently implementing it is that there's two interfaces: * AuditListener * AuditProvider An AuditListener listenes for audit events, but doesn't provide a way to read them. So far I've added an implementation using jboss-logging for this. An AuditProvider listens for audit events, but also provides a way to query for events. This is used by the admin console and the account management to view audit events. I haven't done any implementations of this yet. The idea was that a realm could have one or more listeners, but only a single provider. Main issue with parsing rolling files would be to find events associated with particular users, or applications. Not sure we need to support finding events by-app, but we certainly need to be able to display events for a specific user. ----- Original Message -----