In addition, this log file will contain entries indicating that a user has been added or removed from a group. For instance:
2022-07-19T10:29:41.246Z|5621061bc473eb5e|<IP>|admin|jfrt@01g85htp1s1d621kfxkk310d|test|U|USR|{"removed":{"groups.readers":"UserGroupImpl(name=readers, realm=internal)"}}
2022-07-19T10:29:51.079Z|7fe4790e8baa40bc|<IP>|admin|jfrt@01g85htp1s1d621kfxkk310d|test|U|USR|{"added":{"groups.readers":"UserGroupImpl(name=readers, realm=internal)"} In the above entries, the admin user has removed the “test” user from the “readers” group, then added him back to that group.