Not getting Audit events . Only EM events.
The introscope.apm.feature.enabled parameter set to true is mandatory for auditing.
<root level="INFO">
<appender-ref ref="CONSOLE"/>
<appender-ref ref="AUDIT_FILE"/>
</root>
This extra root element override the correct one:
<root level="${APM_LOG_LEVEL_EM}">
<appender-ref ref="CONSOLE"/>
<appender-ref ref="FILE"/>
</root>
and all log messages are written to APMAudit.log instead IntroscopeEnterpriseManager.log
The APMAudit.log then contains WARN messages "No mapping for POST /apm/appmap/ats/graph/store", which are caused by "introscope.apm.feature.enabled=false" (ATC services are not being loaded.).