# Expression tag script flooding audit log **URL:** \ **Category:** Ignition\ **Tags:** perspective, ignition81\ **Created:** [May 4, 2023, 2:57pm UTC](https://forum.inductiveautomation.com/t/expression-tag-script-flooding-audit-log/73270 "2023-05-04T14:57:08Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![Shawn\_Rieger](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/shawn_rieger/32/46336_2.png) [@Shawn\_Rieger](https://forum.inductiveautomation.com/u/Shawn_Rieger)\ **Post date:** [May 4, 2023, 2:57pm UTC](https://forum.inductiveautomation.com/t/expression-tag-script-flooding-audit-log/73270/1 "2023-05-04T14:57:08Z")
We just upgraded our gateways from 8.1.18 to 8.1.26 as we were told this would stop all tag writes from scripts being written to the audit log. However, we are still flooded with audit log events from basic expression tags that we use to manage heartbeats. We have no need to audit this type of change. Any suggestions? ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/3/5/3503fca4793490715c89426e5fcb5cda7e08416a.png) ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/f/3/f3601144e56638f1e813eaa4bacfeab81ec078a5.png) ---
**Author:** ![paul-griffith](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/paul-griffith/32/37249_2.png) [@paul-griffith](https://forum.inductiveautomation.com/u/paul-griffith)\ **Post date:** [May 4, 2023, 4:37pm UTC](https://forum.inductiveautomation.com/t/expression-tag-script-flooding-audit-log/73270/2 "2023-05-04T16:37:11Z")
I would contact support. The bug you're mentioning was supposed to be fixed in 8.1.19; only writes originating from Perspective scripts should go into the audit log. ---
**Author:** ![Shawn\_Rieger](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/shawn_rieger/32/46336_2.png) [@Shawn\_Rieger](https://forum.inductiveautomation.com/u/Shawn_Rieger)\ **Post date:** [May 4, 2023, 4:50pm UTC](https://forum.inductiveautomation.com/t/expression-tag-script-flooding-audit-log/73270/3 "2023-05-04T16:50:57Z")
Would we have to restart the edge gateway for this change to change effect? ---
**Author:** ![paul-griffith](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/paul-griffith/32/37249_2.png) [@paul-griffith](https://forum.inductiveautomation.com/u/paul-griffith)\ **Post date:** [May 4, 2023, 4:52pm UTC](https://forum.inductiveautomation.com/t/expression-tag-script-flooding-audit-log/73270/4 "2023-05-04T16:52:31Z")
Well, upgrading implies a system restart? Whatever gateway is running this script needs to be on 8.1.19 or higher for the bug to be fixed. ---
**Author:** ![Shawn\_Rieger](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/shawn_rieger/32/46336_2.png) [@Shawn\_Rieger](https://forum.inductiveautomation.com/u/Shawn_Rieger)\ **Post date:** [May 4, 2023, 4:54pm UTC](https://forum.inductiveautomation.com/t/expression-tag-script-flooding-audit-log/73270/5 "2023-05-04T16:54:20Z")
To clarify, we upgraded the gateway and yes we restarted the service. We did not restart the edge machine itself however. ---
**Author:** ![paul-griffith](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/paul-griffith/32/37249_2.png) [@paul-griffith](https://forum.inductiveautomation.com/u/paul-griffith)\ **Post date:** [May 4, 2023, 4:55pm UTC](https://forum.inductiveautomation.com/t/expression-tag-script-flooding-audit-log/73270/6 "2023-05-04T16:55:08Z")
That shouldn't be relevant for the issue you're describing here, unless the actual source of the audit entries isn't what you think it is. ---
**Author:** ![Shawn\_Rieger](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/shawn_rieger/32/46336_2.png) [@Shawn\_Rieger](https://forum.inductiveautomation.com/u/Shawn_Rieger)\ **Post date:** [May 4, 2023, 4:56pm UTC](https://forum.inductiveautomation.com/t/expression-tag-script-flooding-audit-log/73270/7 "2023-05-04T16:56:49Z")
No this is definitely the source ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/0/a/0a261bea9c6143d16a5ecefb5f6bdb2366b6a4bb.png) ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [May 4, 2023, 5:04pm UTC](https://forum.inductiveautomation.com/t/expression-tag-script-flooding-audit-log/73270/8 "2023-05-04T17:04:32Z")
A couple items to check next: - Visit that gateway's status page and check what version it is reporting. - Open the designer tag browser to the suspect tags and temporarily disable the events. See if the audit stream really does stop. ---
**Author:** ![Shawn\_Rieger](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/shawn_rieger/32/46336_2.png) [@Shawn\_Rieger](https://forum.inductiveautomation.com/u/Shawn_Rieger)\ **Post date:** [May 4, 2023, 11:54pm UTC](https://forum.inductiveautomation.com/t/expression-tag-script-flooding-audit-log/73270/9 "2023-05-04T23:54:52Z")
You guys are correct once again! 😄 After further investigation, it appears we missed an edge in the upgrade and the audit log is coming from that gateway. Thanks for insisting I check!