By default all actions on managed or system objects that may change data/state should be logged.
Test and verify that adding
patch and action
to the audit filter works as expected.
Include them in the default config file after testing.
verify query also can be added, but do not log by default.