In order to meet security requirements for a customer who is using RTC 3.0 we need to trace authentification errors and authorizations errors in logs in order to collect them in a security log analyser named Qradar.

We managed to trace the authentification errors (wrong password for example) but we did not managed to trace the autorization errors (not authorized to deliver code for exemple, not authorized to access the workitem).

Is there a way to trace theses errors in logs ?

example of log we want to trace :

Problem
You don't have permission to Save Build Definition [server].

Reason

In order to carry out this operation, you would need permission to perform the following additional actions:
Action:	ID:
Modify Build Definition	modify

Problem You don't have permission to Save Stream [server]. Reason In order to carry out this operation, you would need permission to perform the following additional actions: Action: ID: Create a stream modify/stream/create