Hi there,
with SORMAS-Foundation/SORMAS-Project#8900 being merged, please follow the instructions provided here i.e.,
To enable audit loging, please copy the files from sormas-base/setup/keycloak/audit-logging/ to /opt/jboss/startup-scripts/ to /opt/jboss/startup-scripts/ inside your Keycloak server and restart the server.
I'm not certain on which Keycloak server config file you rely (standalone.xml or standalone-ha.xml) so I provided logger files for both here .