When behind a proxy, the auditing will refer to the proxy IP address, usually an unhelpful 127.0.0.1, apparently this from https://jira.atlassian.com/browse/JRA-22399 can help:

(info) this needs testing!

<Engine name="Catalina" defaultHost="localhost">
 <Valve 
   className="org.apache.catalina.valves.RemoteIpValve"
   internalProxies="127\.0\.0\.1"
   remoteIpHeader="x-forwarded-for"
   remoteIpProxiesHeader="x-forwarded-by"
   protocolHeader="x-forwarded-proto"
   />
<Host name="localhost" appBase="webapps" unpackWARs="true" autoDeploy="true">