Thank you and livehybrid for the assistance. I went ahead and made a local folder and copy pasted the inputs.conf file and replaced the passAuth variable with passAuth = sc_admin as I believe that's the admin user. I also added all the available roles I could just for testing purposes. Unfortunately I haven't received any events so I'm wondering if I did something wrong and if there's a debug/log somewhere if there were something wrong. The audit is set for every 60 seconds so I should be getting something every minute but it just stopped entirely. I did restart the service, refreshed, and toggled the audit input on and off. Screenshots attached.       ... View more