<commit_before>---
title: Auditing Messages
summary: 'Tell NServiceBus where to send messages and it provides built-in message auditing for every endpoint'
tags:
- Auditing
- Forwarding Messages
redirects:
- nservicebus/auditing-with-nservicebus
---

The distributed nature of parallel message-driven systems makes them more difficult to debug than their sequential, synchronous, and centralized counterparts. For these reasons, NServiceBus provides built-in message auditing for every endpoint. Just tell NServiceBus that you want auditing and it will capture a copy of every received message and forward it to a specified audit queue.

It is recommended that you specify a central auditing queue for all related endpoints (i.e. endpoints that belong to the same system). By doing so you can take advantage of central auditing within a distributed system. This is also required by the Particular Service Platform and especially [ServiceControl](/servicecontrol), which consumes messages from these auditing queues. For more information, see [ServicePulse documentation](/servicepulse/).


## Handling Audit messages

What you choose to do with those messages is now up to you: save them in a database, do custom logging, etc. The important thing is that you now have a centralized record of everything that is happening in your system while maintaining all the benefits of keep things distributed.


## Audit configuration options

There two settings that control Auditing.


### Queue Name

The queue name to forward audit messages to

 
### OverrideTimeToBeReceived

By default messages are forwarded to the audit queue with the [TimeToBeReceived](/nservicebus/messaging/discard-old-messages.md) of the original message. If a different TimeToBeReceived is required it have be achieved by setting OverrideTimeToBeReceived. This setting takes a [TimeSpan](https://msdn.microsoft.com/en-us/library/system.timespan.aspx).

Note that while the phrasing is "forwarding a message" in the implementation it is actually "cloning and sending a new message". This is important when considering TimeToBeReceived since the time taken to receive and process the original message is not part of the TimeToBeReceived of the new audit message. So in effect the audit message receives the full time allotment of whatever TimeToBeReceived is used. 


## Configuring auditing


### Using Code

You can configure the target audit queue using the configuration API.

<!-- import AuditWithCode -->


### Using app.config

<!-- import configureAuditUsingXml -->


### Using IProvideConfiguration

The audit settings can also be configured using code via a  [custom configuration provider](/nservicebus/hosting/custom-configuration-providers.md)

<!-- import AuditProvideConfiguration -->


## Machine level configuration

Version 4 and higher support setting the error queue and the audit queue at the machine level in the registry. Use the [Set-NServiceBusLocalMachineSettings](management-using-powershell.md) PowerShell commandlet to set these values at a machine level. When set at machine level, the setting is not required in the endpoint configuration file for messages to be forwarded to the audit queue.


## Turning off auditing

If the auditing settings are in `app.config`, remove them or comment them out.

If the machine level auditing is turned on, clear the value for the string value `AuditQueue` under

    HKEYLOCALMACHINE\\SOFTWARE\\ParticularSoftware\\ServiceBus

If running 64 bit, in addition to the above, also clear the value for `AuditQueue` under

    HKEYLOCALMACHINE\\SOFTWARE\\Wow6432Node\\ParticularSoftware\\ServiceBus


## Message headers

All headers, from the message being forwarded, will be included in the message sent to the audit queue. There are also some custom audit headers appended. See [Message Headers](/nservicebus/operations/auditing.md) for more information.
<commit_msg>Clarify that v6 won't set TTBR on audit messages<commit_after>---
title: Auditing Messages
summary: 'Tell NServiceBus where to send messages and it provides built-in message auditing for every endpoint'
tags:
- Auditing
- Forwarding Messages
redirects:
- nservicebus/auditing-with-nservicebus
---

The distributed nature of parallel message-driven systems makes them more difficult to debug than their sequential, synchronous, and centralized counterparts. For these reasons, NServiceBus provides built-in message auditing for every endpoint. Just tell NServiceBus that you want auditing and it will capture a copy of every received message and forward it to a specified audit queue.

It is recommended that you specify a central auditing queue for all related endpoints (i.e. endpoints that belong to the same system). By doing so you can take advantage of central auditing within a distributed system. This is also required by the Particular Service Platform and especially [ServiceControl](/servicecontrol), which consumes messages from these auditing queues. For more information, see [ServicePulse documentation](/servicepulse/).


## Handling Audit messages

What you choose to do with those messages is now up to you: save them in a database, do custom logging, etc. The important thing is that you now have a centralized record of everything that is happening in your system while maintaining all the benefits of keep things distributed.


## Audit configuration options

There two settings that control Auditing.


### Queue Name

The queue name to forward audit messages to

 
### OverrideTimeToBeReceived

Version 5 and below will default TimeToBeReceived on the message forwarded to the audit queue to the [TimeToBeReceived](/nservicebus/messaging/discard-old-messages.md) of the original message. Starting with V6 no TimeToBeReceived will be set by default.

You can force a TimeToBeReceived on audit messages by setting `OverrideTimeToBeReceived` using the configuration syntax below. 

Note that while the phrasing is "forwarding a message" in the implementation it is actually "cloning and sending a new message". This is important when considering TimeToBeReceived since the time taken to receive and process the original message is not part of the TimeToBeReceived of the new audit message. So in effect the audit message receives the full time allotment of whatever TimeToBeReceived is used. 


## Configuring auditing


### Using Code

You can configure the target audit queue using the configuration API.

<!-- import AuditWithCode -->


### Using app.config

<!-- import configureAuditUsingXml -->

Note: `OverrideTimeToBeReceived` needs to be a valid [TimeSpan](https://msdn.microsoft.com/en-us/library/system.timespan.aspx).
### Using IProvideConfiguration

The audit settings can also be configured using code via a  [custom configuration provider](/nservicebus/hosting/custom-configuration-providers.md)

<!-- import AuditProvideConfiguration -->


## Machine level configuration

Version 4 and higher support setting the error queue and the audit queue at the machine level in the registry. Use the [Set-NServiceBusLocalMachineSettings](management-using-powershell.md) PowerShell commandlet to set these values at a machine level. When set at machine level, the setting is not required in the endpoint configuration file for messages to be forwarded to the audit queue.


## Turning off auditing

If the auditing settings are in `app.config`, remove them or comment them out.

If the machine level auditing is turned on, clear the value for the string value `AuditQueue` under

    HKEYLOCALMACHINE\\SOFTWARE\\ParticularSoftware\\ServiceBus

If running 64 bit, in addition to the above, also clear the value for `AuditQueue` under

    HKEYLOCALMACHINE\\SOFTWARE\\Wow6432Node\\ParticularSoftware\\ServiceBus


## Message headers

All headers, from the message being forwarded, will be included in the message sent to the audit queue. There are also some custom audit headers appended. See [Message Headers](/nservicebus/operations/auditing.md) for more information.

{'fraction_non_alphanumeric': 0.05167667667667668, 'fraction_numerical': 0.0021271271271271273, 'mean_word_length': 4.78783490224475, 'pattern_counts': {'":': 0, '<': 9, '<?xml version=': 0, '>': 9, 'https://': 2, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '7130589', 'n_tokens_mistral': 1942, 'n_tokens_neox': 1856, 'n_words': 1028}