When you perform operations in Ambari, such as user login/logout, stopping/starting a service, and adding/removing a service, Ambari creates entries in an audit log. Using the audit log, you can determine who performed the operation and when the operation was performed as well as other, operation-specific information. You can find the Ambari Audit log at:/var/log/ambari-server/ambari-audit.log

	Note
	Making a Service Configuration change creates an entry in the audit log, and creates a specific log file ambari-config-changes.log for configuration changes that provides even more detail on the change. For example: 2016-05-25 18:31:26,242 INFO - Cluster 'MyCluster' changed by: 'admin'; service_name='HDFS' config_group='default' config_group_id='-1' version='2'