Auditing searchservice in Alfresco Enterprise v5.1.1

[deshdeepak1947]

I want to audit search parameters used in alfresco search form.

I am using version : Alfresco Enterprise v5.1.1

If i search jbong then in alfresco log i want to see something like this: /alfresco-api/post/SearchService/query/args/searchParameters=jbong*

but it is showing /alfresco-api/pre/SearchService/query/args=null

Any help or suggestion will be highly appriciated. thnaks a lot.

===========================================================

Here is the detail of my steps and configurations

1. suppose i am searching "jbong"

2. But the alfresco log is showing something like below: alfresco.log

    2020-09-08 16:58:20,480  DEBUG [repo.jscript.ScriptLogger] [http-apr-8080-exec-16] Query  :    jbong
    Sortby:
     2020-09-08 16:58:20,483  DEBUG [repo.audit.inbound] [http-apr-8080-exec-16]
    Inbound audit values:
            /alfresco-api/pre/SearchService/query/args=null
     2020-09-08 16:58:20,757  DEBUG [repo.audit.inbound] [http-apr-8080-exec-16]
    Inbound audit values:
            /alfresco-api/post/SearchService/query/args=null
            /alfresco-api/post/SearchService/query/no-error=null
     2020-09-08 16:58:20,761  DEBUG [repo.audit.AuditComponentImpl] [http-apr-8080-exec-16]
    Extracted audit data:
            Application:    AuditApplication[ name=SearchAudit, id=12, disabledPathsId=8473501]
            Values:
                    /searchaudit/query/args=null
                    /searchaudit/query/no-error=null
    
    New Data:
    2020-09-08 16:58:20,761  DEBUG [repo.audit.AuditComponentImpl] [http-apr-8080-exec-16]
    
    Nothing audited:
            Application ID: 12
            Entry ID:       null
            Values:
                    /searchaudit/query/args=null
                    /searchaudit/query/no-error=null
    
     2020-09-08 16:58:20,765  DEBUG [repo.jscript.ScriptLogger] [http-apr-8080-exec-16] Processing resultset of length: 0
     2020-09-08 16:58:20,765  DEBUG [repo.jscript.ScriptLogger] [http-apr-8080-exec-16] Filtered resultset to length: 0. Discarded item count: 0
    

3. Here are my custom audit configuration:

A. alfresco-home/tomcat/shared/classes/alfresco/extension/audit/SearchAudit.xml

 <?xml version='1.0' encoding='UTF-8'?>


<Audit    xmlns="http://www.alfresco.org/repo/audit/model/3.2"    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"    xsi:schemaLocation="http://www.alfresco.org/repo/audit/model/3.2 alfresco-audit-3.2.xsd"
    >

  <DataExtractors>
        <DataExtractor name="simpleValue" registeredName="auditModel.extractor.simpleValue" />
        <DataExtractor name="nullValue" registeredName="auditModel.extractor.nullValue" />
    </DataExtractors>


    <PathMappings>
        <PathMap source="/alfresco-api/post/SearchService/query" target="/searchaudit/query" />
    </PathMappings>
 
    <Application name="SearchAudit" key="searchaudit">
        <AuditPath key="query">
            <RecordValue key="store" dataExtractor="simpleValue"                        dataSource="/searchaudit/query/args/store" dataTrigger="/searchaudit/query/no-error" />
            <RecordValue key="language" dataExtractor="simpleValue"                        dataSource="/searchaudit/query/args/language" dataTrigger="/searchaudit/query/no-error" />
            <RecordValue key="query" dataExtractor="simpleValue"                        dataSource="/searchaudit/query/args/query" dataTrigger="/searchaudit/query/no-error" />
        </AuditPath>
    </Application>
</Audit>

B. alfresco-global.properties

 # Audit configuration
audit.enabled=trueaudit.tagging.enabled=trueaudit.alfresco-access.enabled=trueaudit.alfresco-access.sub-actions.enabled=trueaudit.cmischangelog.enabled=true

[deshdeepak1947]

Can anyone help me please on this issue...

[angelborroy]

Do you want to audit search invocations from Share app?

[deshdeepak1947]

---

@angelborroy wrote:

Do you want to audit search invocations from Share app?

---

Thanks angelborroy,

yes i am using searchform of alfersco share.

[deshdeepak1947]

---

@deshdeepak1947 wrote:

---

@angelborroy wrote:

Do you want to audit search invocations from Share app?

---

Thanks angelborroy,

yes i am using searchform of alfersco share.

---

Here is the form :

search form 

[angelborroy]

The URL for that search queries is something like:

http://127.0.0.1:8080/alfresco/s/slingshot/search?term=jbong

[deshdeepak1947]

---

@angelborroy wrote:

The URL for that search queries is something like:

http://127.0.0.1:8080/alfresco/s/slingshot/search?term=jbong

---

thanks @angelborroy for reply,

The url is :

https://stg-abc.com/share/page/site/testsite/dp/ws/faceted-search#searchTerm=jbong&scope=testsite

i am searching jbong in testsite.

[deshdeepak1947]

---

@deshdeepak1947 wrote:

---

@angelborroy wrote:

The URL for that search queries is something like:

http://127.0.0.1:8080/alfresco/s/slingshot/search?term=jbong

---

thanks @angelborroy for reply,

The url is :

https://stg-abc.com/share/page/site/testsite/dp/ws/faceted-search#searchTerm=jbong&scope=testsite

i am searching jbong in testsite.

---

Using this url: http://127.0.0.1:8080/alfresco/s/slingshot/search?term=jbong

also i am getting same log entry:

 2020-09-09 18:01:52,165  DEBUG [repo.jscript.ScriptLogger] [http-apr-8080-exec-12] Query:
jbong
Sortby:
 2020-09-09 18:01:52,167  DEBUG [repo.audit.inbound] [http-apr-8080-exec-12]
Inbound audit values:
        /alfresco-api/pre/SearchService/query/args=null
 2020-09-09 18:01:52,198  DEBUG [repo.audit.inbound] [http-apr-8080-exec-12]
Inbound audit values:
        /alfresco-api/post/SearchService/query/args=null
        /alfresco-api/post/SearchService/query/no-error=null
 2020-09-09 18:01:52,200  DEBUG [repo.audit.AuditComponentImpl] [http-apr-8080-exec-12]
Extracted audit data:
        Application:    AuditApplication[ name=auditsearch, id=15, disabledPathsId=8487501]
        Values:
                /auditsearch/query/args=null
                /auditsearch/query/no-error=null

        New Data:

 2020-09-09 18:01:52,200  DEBUG [repo.audit.AuditComponentImpl] [http-apr-8080-exec-12]
Nothing audited:
        Application ID: 15
        Entry ID:       null
        Values:
                /auditsearch/query/args=null
                /auditsearch/query/no-error=null

[piyush48]

Hi @deshdeepak1947 ,

Sorry for interrupting in your question trail but i am looking for audit logs in SDK. Are this logs of yours stores into .log file in SDK or you are looking it from command line? as i am able to view log but only through command line and i want to get it in .log file. Please do help out as i am looking to get .log file on my sdk.

Thanks,

Piyush

[deshdeepak1947]

---

@piyush48 wrote:

Hi @deshdeepak1947 ,

Sorry for interrupting in your question trail but i am looking for audit logs in SDK. Are this logs of yours stores into .log file in SDK or you are looking it from command line? as i am able to view log but only through command line and i want to get it in .log file. Please do help out as i am looking to get .log file on my sdk.

Thanks,

Piyush

---

I am not doing anyhting in sdk in this case, i am refereing /opt/<alfresco-home>/alfresco.log or console /opt/<alfresco-log>/tomcat/lgs/catalina.out 

if you want to know the location of alfresco.log in sdk project then it would be your project root folder, location