Audit and syslog lightning talk

Audit: data extractors, data generators and integration with Syslog

Iván ArroyoAlfresco Developer

What is the alfresco Audit?

Data Producers

What is a data producer?

Data Producers

PathMapping

Application

• An application define how data is mapped, extracted, and recorded without affecting data required by other applications

• The data generate by “data producers” are passing to application through the path mappings

Audit Component

Data extractors and data generators

Data Generator

• A DataGenerator is a component that produces data without any input i.e. data is produced when a data path is active, but is independent of the values at that path.

• A DataExtractor is a component that uses input data to produce some output, either transforming the data or merely outputting the data verbatim

Data Extractor

AuditQuery

Consult each audit application component by a customizable query

Normal query (all results)

•curl -u <admin user>:<password> "http://<hostname>:<port>/alfresco/service/api/audit/query/<application name>?verbose=true

Optional parameters

•forward (true|false), sorted upward (true)/ downward (false) by date time•limit (true|false), limit the number of results.•toId, return the results until id specified•value, the value to filter•fromTime/toTime, returns the result by the time interval specified (millisecond)

Unifying all of the above in an example

Modify the output of audited messages

• Why?

• Advantages and disadvantages

What is Syslog?

Syslog configuration

• Configuration file: /etc/syslog.conf

1.Facilities

2.Log File

Log4j: syslog appender and additivity

log4j.properties (appender)

log4j.appender.syslog=org.apache.log4j.net.SyslogAppenderlog4j.appender.syslog.syslogHost=localhostlog4j.appender.syslog.layout=org.apache.log4j.PatternLayoutlog4j.appender.syslog.layout.conversionPattern=%m%nlog4j.appender.syslog.Facility=local4

log4j.properties (additivity)

log4j.logger.org.alfresco.audit.LogAuditImpl=INFO,sysloglog4j.additivity.org.alfresco.audit.LogAuditImpl = false

Logrotate: master you log files

• What is?

• How works?

Demo

Thank You!

@ivanscn