ankurja Could you please share:

• a sample of the entry you see
• the pattern you use

I am forwarding all logs to Splunk. Here is how it shows up there:

ankurja are you sure those logs are coming from the audit trail plugin? I would expect the plugin to log an url (path), I don't think "logged out" is an output coming from the audit trail plugin.

• Do you have evidence showing that those are logs coming from the Audit Trail plugin? 
• Splunk is not natively supported by the plugin, could you please check the logs generated by the Audit Trail plugin and look for "logged out"? Maybe there is a transformation at Splunk level?

Other hypothesis I have is that you are in fact looking at logs generated by Jenkins itself, namely this one: https://github.com/jenkinsci/jenkins/blob/fdb6faed00ef73c98e2f69c133d8c9a87a0ca9b0/core/src/main/java/jenkins/security/SecurityListener.java#L143

I also did further investigation into this and it does not look like the messages are originating from Audit Trail plugin. Splunk was putting the messages under "Audit Trail" section, which led me to believe earlier that audit trail plugin is sending that data. But that's not the case.

I will have to do further investigation on the source of those messages, and will also look at the link you shared.

Can you close this issue or should I be doing it ?

ankurja thanks for the feedback. Closing.