Comment 3 for bug 1822135

Creating a project also emits a CADF notification which can be consumed by things like ceilometer:

https://docs.openstack.org/keystone/latest/admin/event_notifications.html

This is designed specifically for auditing and doesn't require scanning the logs.