Audit Log Service

The Audit Log Service writes and can write system and user actions—such as "User 'xyz' deleted a database connection"—to an OpenSearch index. The BPC provides a prebuilt Process Monitor for querying the entries.

The Audit Log Service offers the following features:

OpenSearch is used as the target
New loggers can be added with minimal effort
Log levels can be set individually for each logger
All bundles/modules can use the service
Third-party developers can register their own loggers if needed
In the core, the most important actions are "audit-logged"
Can also be accessed via an endpoint

Audit Log Data

Field	Content
level	DEBUG, INFO, WARNING, ERROR
originator	<Username> , [SYSTEM], or [UNKNOWN]
action	Keyword for grouping
description	Description of the action
old	The old data
new	The new data
timestamp	The timestamp when the action was executed

Field

Content

level

DEBUG, INFO, WARNING, ERROR

originator

<Username> , [SYSTEM], or [UNKNOWN]

action

Keyword for grouping

description

Description of the action

old

The old data

new

The new data

timestamp

The timestamp when the action was executed

OpenSearch Logger

Is enabled by default and writes its data to the OpenSearch index with the alias 'BPC-auditlog'. The default log level is 'INFO'.

By default, old entries are not deleted. This can be enabled via the two settings in the configuration file [karaf]/etc/de.virtimo.bpc.core.cfg.

Example: Every 60 minutes, entries older than 1 year are deleted

...
de.virtimo.bpc.core.auditlog.OpenSearchAuditLogger.auditlog.cleanupPeriodInMinutes=60
de.virtimo.bpc.core.auditlog.OpenSearchAuditLogger.auditlog.deleteEntriesOlderThan=1 year ago
...

Deletion only occurs if both settings are configured. Other useful values for 'deleteEntriesOlderThan': 14 days ago, 3 weeks ago, 1 month ago, 3 months ago, 6 years ago

By default, backups/snapshots are created every day (since the last backup was performed), and all backups older than 30 days are deleted. This can be adjusted via the backup job core:audit-logger.

Set Log Level

This is done via the configuration file [karaf]/etc/de.virtimo.bpc.core.cfg. There is a naming convention for this that is also used for other loggers: The full class name is extended with the suffix .auditlog.level.

Example:

Our OpenSearch logger has the class name de.virtimo.bpc.core.auditlog.OpenSearchAuditLogger and is then set to the log level DEBUG, for example.

...
de.virtimo.bpc.core.auditlog.OpenSearchAuditLogger.auditlog.level=DEBUG
...

Usage in Code

In the core as well as in other bundles, audit logs can be accessed via static methods of the classes SystemAuditLog and UserAuditLog.

The methods of the ` SystemAuditLog ` class are used for system-triggered actions. The ` UserAuditLog ` class is used for user-triggered actions.

import de.virtimo.bpc.api.auditlog.SystemAuditLog;
...
SystemAuditLog.info("UserDeleted", "User deleted due to too many login failures");
...
UserAuditLog.debug("<username>", "ProcessUpdated", "Process updated", "old values", "new values");

Endpoint

Method Endpoint

POST

/cxf/bpc-auditlog/auditlog/log

Description

To create a new audit log entry, send a JSON message with the following structure:

{
    "level": "INFO",
    "originator": "[INUBIT]",
    "action": "TESTACTION",
    "description": "Only a test",
    "oldValues": "5",
    "newValues": "10",
    "externalReference": {
        "workflow": "update_units",
        "engine": "IS8"
    }
}

Note: 'externalReference' is optional and must be a JSON object when used.

For calls from IGUASU, the following HTTP headers are used, and their values are written to the following 'externalReference' object fields:

HTTP Header

'externalReference' field

IGUASU System ID

externalReference.system

IGUASU Instance ID

externalReference.instance

IGUASU Processor ID

externalReference.processor

IGUASU-Service-ID

externalReference.service

Returns

HTTP Status Code

200: OK
400: The transferred data is not valid
401: Authentication could not be performed

Required Access Rights

The logged-in user or API key must have either the following role or permission.

Role: AUDIT_LOG_USER
Right: AUDIT_LOG_CREATE_ENTRY

GET

/cxf/bpc-auditlog/auditlog/open/monitor

Description

Redirects the user to the monitor using the audit log OpenSearch index.

All provided query parameters are used to build a monitor filter on fields of the 'externalReference' object.

For IGUASU, the following query parameters can be used to access the HTTP header values from when the entry was created.

Query parameter

HTTP header

system

IGUASU System ID

instance

IGUASU Instance ID

processor

IGUASU Processor ID

service

IGUASU Service ID

Returns

The requested data as JSON.

HTTP Status Code

200: OK
401: Authentication could not be performed
404: Module instance was not found
500: BPC deeplink could not be created
503: BPC or instance are currently in maintenance mode

Content-Type

application/json

Required Access Rights

Can be used without a user session.

Core Audit Logs

User

level	originator	action	description	old	new
DEBUG	<Username>	UserAuthenticated	Login was successful	-	-
WARNING	<Username>	UserAuthenticationFailed	Login failed	-	-
ERROR	<Username>	UserAuthenticationFailed	Login failed: <Reason>	-	-
DEBUG	<Username>	UserLogout	Logout	-	-

level

originator

action

description

old

new

DEBUG

UserAuthenticated

WARNING

UserAuthenticationFailed

ERROR

UserAuthenticationFailed

DEBUG

UserLogout

Logout

Backups

level	originator	action	description	old	new
INFO	<Username>	BackupCreated	Backup with the snapshot name '<name> created	-	-
INFO		BackupCreated	Backup with the snapshot name '<name>' created	-	-
INFO	<Username>	BackupDeleted	Backup with the snapshot name '<name>' deleted	-	-
INFO		BackupDeleted	Backup with the snapshot name '<name>' deleted	-	-
INFO	<Username>	BackupRestored	Backup with the snapshot name '<name>' restored	-	-
INFO	<Username>	BackupRestored	Backup with the snapshot name '<name>' restored to the index '<name>'	-	-

level

originator

action

description

old

new

INFO

BackupCreated

Backup with the snapshot name '<name> created

INFO

BackupCreated

Backup with the snapshot name '<name>' created

INFO

BackupDeleted

Backup with the snapshot name '<name>' deleted

INFO

BackupDeleted

Backup with the snapshot name '<name>' deleted

INFO

BackupRestored

Backup with the snapshot name '<name>' restored

INFO

BackupRestored

Backup with the snapshot name '<name>' restored to the index '<name>'

Module and Module Component Configurations

level	originator	action	description	old	new
INFO	<Username>	ConfigurationUploaded	Configuration uploaded and imported	-	-
INFO	<Username>	ModuleInstanceCreated	Module instance '<instance name>' (<instance id>) of module '<name>' (<id>) created	-	-
INFO	<Username>	ModuleUpdated	Settings of module '<name>' (<id>) updated: <setting names>	+	+
INFO	<Username>	ModuleInstanceUpdated	Settings of module instance '<instance name>' (<instance id>) of module '<name>' (<id>) updated: <setting names>	+	+
INFO	<Username>	ModuleInstanceDeleted	Module instance '<instance name>' (<instance id>) of module '<name>' (<id>) deleted	-	-
INFO	<Username>	ModuleSettingDeleted	Setting of module '<name>' (<id>) deleted: <setting name>	+	-
INFO	<Username>	ModuleInstanceSettingDeleted	Setting of module instance '<instance name>' (<instance id>) of module '<name>' (<id>) deleted: <setting name>	+	-

level

originator

action

description

old

new

INFO

ConfigurationUploaded

Configuration uploaded and imported

INFO

ModuleInstanceCreated

Module instance '<instance name>' (<instance id>) of module '<name>' (<id>) created

INFO

ModuleUpdated

Settings of module '<name>' (<id>) updated: <setting names>

INFO

ModuleInstanceUpdated

Settings of module instance '<instance name>' (<instance id>) of module '<name>' (<id>) updated: <setting names>

INFO

ModuleInstanceDeleted

Module instance '<instance name>' (<instance id>) of module '<name>' (<id>) deleted

INFO

ModuleSettingDeleted

Setting of module '<name>' (<id>) deleted: <setting name>

INFO

ModuleInstanceSettingDeleted

Setting of module instance '<instance name>' (<instance id>) of module '<name>' (<id>) deleted: <setting name>

Replication

level originator action description old new

level	originator	action	description	old	new
INFO	<Username>	ReplicationJobRestart	Restarted the replication job with the ID: <id> When called via the endpoint `/replication/lastupdatetimestamp/{replicationJobId}`.	-	-

INFO

ReplicationJobRestart

Restarted the replication job with the ID: <id>

When called via the endpoint /replication/lastupdatetimestamp/{replicationJobId}.

Deployment

level	originator	action	description	old	new
INFO	<Username>	Deployment	Deployment to target '<deployment system name>' (<deployment system id>) started	-	-
INFO	<Username>	Deployment	Deployment to target '<deployment system name>' (<deployment system id>) done	-	-
ERROR	<Username>	Deployment	Deployment to target '<deployment system name>' (<deployment system id>) failed:<reason>	-	-
INFO	<Username>	BackupCreated	Backup with the snapshot name '<name>' created	-	-
INFO	<Username>	BackupRestored	Backup with the snapshot name '<name>' restored	-	-
INFO	<Username>	Deployment	Deployment import start	-	-
INFO	<Username>	Deployment	Deployment import complete	-	-
ERROR	<Username>	Deployment	Deployment import failed: <reason>	-	-
INFO	<Username>	ModuleInstanceDeleted	Module instance '<module instance name>' (<module instance id>) of module '<module name>' (<module id>) deleted	-	-
INFO	<Username>	ModuleSettingDeleted	Setting of module '<module name>' (<module id>) deleted: <setting name>	+	-
INFO	<Username>	ModuleSettingDeleted	Setting of module '<module name>' (<module id>) to be deleted does not exist: <setting name>	-	-
INFO	<Username>	ModuleInstanceSettingDeleted	Setting for module instance '<module instance name>' (<module instance id>) and module '<module name>' (<module id>) deleted: <setting name>	+	-
INFO	<Username>	ModuleInstanceSettingDeleted	Setting for module instance '<module instance name>' (<module instance id>) and module '<module name>' (<module id>) to be deleted does not exist: <setting name>	-	-
INFO	<Username>	ModuleUpdated	Settings of module '<module name>' (<module id>) updated: <setting names>	+	+
INFO	<Username>	ModuleInstanceCreated	Module instance '<module instance name>' (<module instance id>) of module '<module name>' (<module id>) created	-	-
INFO	<Username>	ModuleInstanceUpdated	Settings of module instance '<module instance name>' (<module instance id>) of module '<module name>' (<module id>) updated: <setting names>	+	+

level

originator

action

description

old

new

INFO

Deployment

Deployment to target '<deployment system name>' (<deployment system id>) started

INFO

Deployment

Deployment to target '<deployment system name>' (<deployment system id>) done

ERROR

Deployment

Deployment to target '<deployment system name>' (<deployment system id>) failed:<reason>

INFO

BackupCreated

Backup with the snapshot name '<name>' created

INFO

BackupRestored

Backup with the snapshot name '<name>' restored

INFO

Deployment

Deployment import start

INFO

Deployment

Deployment import complete

ERROR

Deployment

Deployment import failed: <reason>

INFO

ModuleInstanceDeleted

Module instance '<module instance name>' (<module instance id>) of module '<module name>' (<module id>) deleted

INFO

ModuleSettingDeleted

Setting of module '<module name>' (<module id>) deleted: <setting name>

INFO

ModuleSettingDeleted

Setting of module '<module name>' (<module id>) to be deleted does not exist: <setting name>

INFO

ModuleInstanceSettingDeleted

Setting for module instance '<module instance name>' (<module instance id>) and module '<module name>' (<module id>) deleted: <setting name>

INFO

ModuleInstanceSettingDeleted

Setting for module instance '<module instance name>' (<module instance id>) and module '<module name>' (<module id>) to be deleted does not exist: <setting name>

INFO

ModuleUpdated

Settings of module '<module name>' (<module id>) updated: <setting names>

INFO

ModuleInstanceCreated

Module instance '<module instance name>' (<module instance id>) of module '<module name>' (<module id>) created

INFO

ModuleInstanceUpdated

Settings of module instance '<module instance name>' (<module instance id>) of module '<module name>' (<module id>) updated: <setting names>

Maintenance Mode

level	originator	action	description	old	new
WARNING		MaintenanceModeEnabled	Requested while reaching the file system limit of <limit> MB	-	-
INFO	<Username>	MaintenanceModeEnabled	Requested while performing a deployment	-	-
INFO		MaintenanceModeEnabled	Requested from another BPC server (Active/Active)	-	-
INFO		MaintenanceModeDisabled	Requested from another BPC server (Active/Active)	-	-
INFO	<Username>	MaintenanceModeEnabled	Requested via the configuration endpoint (e.g., BPC Frontend)	-	-
INFO	<Username>	MaintenanceModeDisabled	Requested via the configuration endpoint (e.g., BPC Frontend)	-	-
INFO		MaintenanceMode	Maintenance mode configuration setting updated: [karaf]/etc/de.Virtimo.BPC.core.cfg	+	+

level

originator

action

description

old

new

WARNING

MaintenanceModeEnabled

Requested while reaching the file system limit of <limit> MB

INFO

MaintenanceModeEnabled

Requested while performing a deployment

INFO

MaintenanceModeEnabled

Requested from another BPC server (Active/Active)

INFO

MaintenanceModeDisabled

Requested from another BPC server (Active/Active)

INFO

MaintenanceModeEnabled

Requested via the configuration endpoint (e.g., BPC Frontend)

INFO

MaintenanceModeDisabled

Requested via the configuration endpoint (e.g., BPC Frontend)

INFO

MaintenanceMode

Maintenance mode configuration setting updated: [karaf]/etc/de.Virtimo.BPC.core.cfg

Keywords: