I know that I can capture the event of a user being manually added to Alfresco though the Admin Tools page in Share by auditing for a PathMap source of "/alfresco-api/post/PersonService/createPerson".
Users are typically added by an AD LDAP synchronization, however, and I can't see what event is being triggered.
An Alfresco user IS getting created after a synch. Should I be looking for something else, like membership add to a group?
I am setting the log setting of 'org.alfresco.repo.audit.inbound' to DEBUG, but am not seeing anything for that user. Any other log settings to try?