AnsweredAssumed Answered

Audit Alfresco 3.4.c: Nothing audited

Question asked by othlen on Jan 27, 2011
Latest reply on Sep 26, 2013 by eric.soto
I'm trying to set up Alfresco Community 3.4.c 's Audit.

I've enabled the audit audit serice:  audit.enabled=true in alfresco-global.properties file.

After this, I created two xml file with my audit application definitions:

The first file contains login/logout audit application:


<?xml version='1.0' encoding='UTF-8'?>
<Audit
    xmlns="http://www.alfresco.org/repo/audit/model/3.2"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.alfresco.org/repo/audit/model/3.2 alfresco-audit-3.2.xsd"
>
    <DataExtractors>
       <DataExtractor name="simpleValue" registeredName="auditModel.extractor.simpleValue" />
    </DataExtractors>
    <DataGenerators>
        <DataGenerator name="currentUser" registeredName="auditModel.generator.user" />
        <DataGenerator name="systemTime" registeredName="auditModel.generator.time" />
    </DataGenerators>
    <PathMappings>
        <PathMap source="/alfresco-api/post/AuthenticationService/authenticate" target="/login/login" />
      <PathMap source="/alfresco-api/post/AuthenticationService/clearCurrentSecurityContext" target="/logout/logout" />
    </PathMappings>
    <Application name="Login" key="login">
        <AuditPath key="login">
            <AuditPath key="no-error">
                <RecordValue key="username" dataExtractor="simpleValue" dataSource="/auditexamplelogin1/login/args/userName" />
            <GenerateValue key="systime" dataGenerator="systemTime" />
            </AuditPath>
         <AuditPath key="error">
            <GenerateValue key="systime" dataGenerator="systemTime" />
            </AuditPath>
        </AuditPath>
    </Application>
    <Application name="Logout" key="logout">
        <AuditPath key="logout">
            <AuditPath key="no-error">
            <GenerateValue key="username" dataGenerator="currentUser" />
            <GenerateValue key="systime" dataGenerator="systemTime" />
         </AuditPath>
        </AuditPath>
    </Application>
</Audit>

The second file contains node related audit applications:


<?xml version='1.0' encoding='UTF-8

<Audit
    xmlns="http://www.alfresco.org/repo/audit/model/3.2"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.alfresco.org/repo/audit/model/3.2 alfresco-audit-3.2.xsd"
>

    <DataExtractors>
       <DataExtractor name="simpleValue" registeredName="auditModel.extractor.simpleValue" />
       <DataExtractor name="nodeType" registeredName="auditModel.extractor.nodeType" />
    </DataExtractors>

    <DataGenerators>
        <DataGenerator name="currentUser" registeredName="auditModel.generator.user" />
        <DataGenerator name="systemTime" registeredName="auditModel.generator.time" />      
        <DataGenerator name="personFullName" registeredName="auditModel.generator.personFullName" />
    </DataGenerators>

    <PathMappings>
                <PathMap source="/alfresco-api/post/FileFolderService/copy" target="/nodecopy/copy" />
      <PathMap source="/alfresco-api/post/FileFolderService/create" target="/nodecreate/create" />
      <PathMap source="/alfresco-api/post/FileFolderService/delete" target="/nodedelete/delete" />
                <PathMap source="/alfresco-api/post/FileFolderService/move" target="/nodemove/move" />
      <PathMap source="/alfresco-api/post/FileFolderService/rename" target="/noderename/rename" />
    </PathMappings>   
   
    <Application name="NodeCopy" key="nodecopy">
        <AuditPath key="copy">
                <RecordValue key="sourcenode" dataExtractor="nodeType" dataSource="/auditexamplelogin1/login/args/sourceNodeRef" />
                <RecordValue key="targetparent" dataExtractor="nodeType" dataSource="/auditexamplelogin1/login/args/targetParentRef" />
                <RecordValue key="newname" dataExtractor="simpleValue" dataSource="/auditexamplelogin1/login/args/newName" />
        </AuditPath>
    </Application>   

    <Application name="NodeCreate" key="nodecreate">
        <AuditPath key="create">
       <RecordValue key="parentNode" dataExtractor="simpleValue" dataSource="/auditexamplelogin1/login/args/parentNodeRef" />
            <RecordValue key="name" dataExtractor="simpleValue" dataSource="/auditexamplelogin1/login/args/name" />
            <RecordValue key="type" dataExtractor="simpleValue" dataSource="/auditexamplelogin1/login/args/typeQName" />
        </AuditPath>
    </Application>
   
    <Application name="NodeDelete" key="nodedelete">
        <AuditPath key="delete">
                <RecordValue key="node" dataExtractor="simpleValue" dataSource="/auditexamplelogin1/login/args/nodeRef" />
        </AuditPath>
    </Application>
      
    <Application name="NodeMove" key="nodemove">
        <AuditPath key="move">
                <RecordValue key="sourcenode" dataExtractor="simpleValue" dataSource="/auditexamplelogin1/login/args/sourceNodeRef" />
                <RecordValue key="targetparent" dataExtractor="simpleValue" dataSource="/auditexamplelogin1/login/args/targetParentRef" />
                <RecordValue key="newname" dataExtractor="simpleValue" dataSource="/auditexamplelogin1/login/args/newName" />
        </AuditPath>
    </Application>
   
    <Application name="NodeRename" key="noderename">
        <AuditPath key="rename">      
            <RecordValue key="filefolder" dataExtractor="simpleValue" dataSource="/auditexamplelogin1/login/args/fileFolderRef" />
                                <RecordValue key="newname" dataExtractor="simpleValue" dataSource="/auditexamplelogin1/login/args/newName" />
            <GenerateValue key="username" dataGenerator="currentUser" />
            <GenerateValue key="systime" dataGenerator="systemTime" />
       </AuditPath>
    </Application>   
</Audit>

Using "/alfresco/service/api/audit/control" service i can see all seven audit application enabled,
but except the login audit application (it traces correctly login informations) the others singles queries services return an empty json:


{
   "count":0,
   "entries":
   [
   ]
}

In the tomcat log file I can see the Extracted of audit data but in the line below, log reports "Nothing audited".
An example from my Tomcat log:


2011-01-27 17:52:10,784 User:System DEBUG [org.alfresco.repo.audit.AuditComponentImpl]
Extracted audit data:
   Application:    AuditApplication[ name=NodeCreate, id=19, disabledPathsId=24410]
   Values:        
      /nodecreate/create/args/typeQName={http://www.alfresco.org/model/content/1.0}folder
      /nodecreate/create/args/name=pqoe
      /nodecreate/create/result=FileInfo[name=pqoe, isFolder=true, nodeRef=workspace://SpacesStore/6ddb10ab-b04e-4be8-99b3-24b2cf53659d]
      /nodecreate/create/args/parentNodeRef=workspace://SpacesStore/330bf3c9-5b37-430d-8e54-353e6b2405fd
      /nodecreate/create/no-error=null

   New Data:

2011-01-27 17:52:10,784 User:paglialu DEBUG [org.alfresco.repo.audit.AuditComponentImpl]
Nothing audited:
   Application ID: 19
   Entry ID:       null
   Values:        
      /nodecreate/create/args/typeQName={http://www.alfresco.org/model/content/1.0}folder
      /nodecreate/create/args/name=pqoe
      /nodecreate/create/result=FileInfo[name=pqoe, isFolder=true, nodeRef=workspace://SpacesStore/6ddb10ab-b04e-4be8-99b3-24b2cf53659d]
      /nodecreate/create/args/parentNodeRef=workspace://SpacesStore/330bf3c9-5b37-430d-8e54-353e6b2405fd
      /nodecreate/create/no-error=null

There are some error in xml configurations or this is the right behaviour of alfresco audit?

Outcomes