I am working on Audit logs for an ERP project and searching for all kind of events to be logged.
In this project, session, timeouts on inactivity. I was wondering if logout by session-timeout should be logged.
I was referring to OWASP - Which events to be logged and couldn't find a clear answer on whether a session timeout event should be captured in audit logs or any other log.
Is there any clear requirement / guideline for session-timeout events to be logged ?
(Logout by user is added in the logs)
(Also, since the implementation is timeout based and utilizing the TTL property of session_storage, it would require extra resource to implement the logging for session timeout. I am not sure if session-timeout events are worth the extra resources for its implementation. Please share your opinion / suggestion.)