...

• Kafka publish does not happen in a transaction, so there is a chance that the audit log feed from Kafka may be inconsistent compared to what actually happened. CDAP-5109 has more discussion on it.
• There is no access control on who can publish audit information to Kafka (CDAP-5130).
• Messages in Kafka are transient. They will be deleted after a few days in most setups. The subscribers will have to consume the messages before they are deleted.

Audit Message Format

Audit feed will be a stream of audit messages as defined below.

...