Enable Audit Logging

Overview

The audit logger component captures and logs events from the Event Bus service to a Log4j 2 file. Events received from the Event Bus are serialized as JSON strings and written at the info level to an SLF4J logger. By default, the CMS posts workflow actions, CMS log-in, and log-out events to the Event Bus. Events generated by custom plugins or applications and posted to the Event Bus are also logged.

When to Use

Enable audit logging to record workflow actions and authentication events for security monitoring, compliance, or debugging purposes.

Prerequisites

  • A Bloomreach Experience Manager project.
  • Access to the project’s Log4j 2 configuration file (conf/log4j2-dist.xml).

Implementation Steps

1. Verify Default Configuration

If you created your project using a recent Maven archetype, audit logging is enabled by default. No further configuration is required.

2. Configure Log4j 2 for Audit Logging

If audit logging is not already configured, update your Log4j 2 configuration:

a. Add the Audit Appender

Add the following appender to conf/log4j2-dist.xml to log audit information to audit.log:

<!-- audit.log -->
<RollingFile name="audit" fileName="${sys:catalina.base}/logs/audit.log"
             filePattern="${sys:catalina.base}/logs/audit.log.%d{yyyy-MM-dd}">
  <PatternLayout pattern="%d{dd.MM.yyyy HH:mm:ss} [%t] %-5p [%C.%M():%L] %m%n"/>
  <Policies>
    <TimeBasedTriggeringPolicy/>
  </Policies>
</RollingFile>

b. Add Audit Loggers

Add the following logger definitions to route audit events to the audit appender:

<!-- audit logging -->
<Logger additivity="false" name="org.hippoecm.repository.api.Workflow" level="info">
  <AppenderRef ref="audit"/>
</Logger>
<Logger additivity="false" name="org.onehippo.audit" level="info">
  <AppenderRef ref="audit"/>
</Logger>

Verification

After you configure audit logging, perform a workflow action or log in to the CMS. Then, check the audit.log file located at ${sys:catalina.base}/logs/audit.log for new entries.

Sample Output

19.02.2013 16:02:05 INFO  [org.hippoecm.repository.audit.AuditLogger.logHippoEvent():39] {"message":"login successful","timestamp":1361286125920,"category":"security","application":"cms","remoteAddress":"0:0:0:0:0:0:0:1","action":"login","user":"admin","success":true}
19.02.2013 16:02:34 INFO  [org.hippoecm.repository.audit.AuditLogger.logHippoEvent():39] {"result":"document[uuid=cc4b3805-43f8-408c-81b5-466d1cb6f3f9,path='/content/documents/hippogogreen/news/2012/10/report-green-technology-trends-2013-copy/report-green-technology-trends-2013-copy']","application":"repository","interactionId":"0bc97c5e-5336-4e36-be91-8b98e1bd36c2","returnValue":"document[uuid=cc4b3805-43f8-408c-81b5-466d1cb6f3f9,path='/content/documents/hippogogreen/news/2012/10/report-green-technology-trends-2013-copy/report-green-technology-trends-2013-copy']","documentPath":"/content/documents/hippogogreen/news/2012/10","interaction":"default:reviewedactions:copy","returnType":"document","timestamp":1361286154745,"category":"workflow","arguments":["org.hippoecm.repository.api.Document[uuid=3d481407-4328-4107-b28b-d5dc8e47211e]","org.hippoecm.repository.reviewedactions.PublishableDocument[uuid=963e88f2-7a45-48a9-9b40-00e72389ff57]","report-green-technology-trends-2013-copy","<null>"],"workflowName":"folder-extended","action":"org.hippoecm.repository.standardworkflow.FolderWorkflowImpl.copyTo","className":"org.hippoecm.repository.standardworkflow.FolderWorkflowImpl","user":"admin","methodName":"copyTo","workflowCategory":"embedded"}
19.02.2013 16:02:34 INFO  [org.hippoecm.repository.audit.AuditLogger.logHippoEvent():39] {"result":"document[uuid=cbdbcc58-20ea-4352-9441-59904a401d27,path='/jcr:system/jcr:versionStorage/cc/4b/38/cc4b3805-43f8-408c-81b5-466d1cb6f3f9/1.0']","application":"repository","interactionId":"0bc97c5e-5336-4e36-be91-8b98e1bd36c2","returnValue":"document[uuid=cbdbcc58-20ea-4352-9441-59904a401d27,path='/jcr:system/jcr:versionStorage/cc/4b/38/cc4b3805-43f8-408c-81b5-466d1cb6f3f9/1.0']","documentPath":"/content/documents/hippogogreen/news/2012/10/report-green-technology-trends-2013-copy/report-green-technology-trends-2013-copy","interaction":"default:reviewedactions:copy","returnType":"document","timestamp":1361286154837,"category":"workflow","workflowName":"version","action":"org.hippoecm.repository.standardworkflow.VersionWorkflowImpl.version","handleUuid":"1ccf10a4-b324-4cd7-9d28-58cf3fdded70","className":"org.hippoecm.repository.standardworkflow.VersionWorkflowImpl","user":"workflowuser","methodName":"version","workflowCategory":"versioning"}
19.02.2013 16:02:34 INFO  [org.hippoecm.repository.audit.AuditLogger.logHippoEvent():39] {"timestamp":1361286154837,"category":"workflow","application":"repository","workflowName":"reviewedactions","interactionId":"0bc97c5e-5336-4e36-be91-8b98e1bd36c2","documentPath":"/content/documents/hippogogreen/news/2012/10/report-green-technology-trends-2013-copy/report-green-technology-trends-2013-copy","action":"org.hippoecm.repository.reviewedactions.FullReviewedActionsWorkflowImpl.depublish","handleUuid":"1ccf10a4-b324-4cd7-9d28-58cf3fdded70","interaction":"default:reviewedactions:copy","className":"org.hippoecm.repository.reviewedactions.FullReviewedActionsWorkflowImpl","methodName":"depublish","user":"admin","workflowCategory":"default"}
19.02.2013 16:02:34 INFO  [org.hippoecm.repository.audit.AuditLogger.logHippoEvent():39] {"application":"repository","interactionId":"0bc97c5e-5336-4e36-be91-8b98e1bd36c2","documentPath":"/content/documents/hippogogreen/news/2012/10/report-green-technology-trends-2013/report-green-technology-trends-2013","interaction":"default:reviewedactions:copy","timestamp":1361286154837,"category":"workflow","arguments":["org.hippoecm.repository.api.Document[uuid=3d481407-4328-4107-b28b-d5dc8e47211e]","report-green-technology-trends-2013-copy"],"workflowName":"reviewedactions","action":"org.hippoecm.repository.reviewedactions.FullReviewedActionsWorkflowImpl.copy","handleUuid":"4c7bcc24-f8a1-4f23-ab46-ab92bfaf7900","className":"org.hippoecm.repository.reviewedactions.FullReviewedActionsWorkflowImpl","user":"admin","methodName":"copy","workflowCategory":"default"}
19.02.2013 16:02:34 INFO  [org.hippoecm.repository.audit.AuditLogger.logHippoEvent():39] {"application":"repository","interactionId":"9fc6efea-5764-4cdd-9839-5b68fb70b295","documentPath":"/content/documents/hippogogreen/news/2012/10/report-green-technology-trends-2013-copy/report-green-technology-trends-2013-copy","interaction":"core:default:localizeName","timestamp":1361286154942,"category":"workflow","arguments":["Report: Green Technology Trends 2013 (copy)"],"workflowName":"default","action":"org.hippoecm.repository.standardworkflow.DefaultWorkflowImpl.localizeName","handleUuid":"1ccf10a4-b324-4cd7-9d28-58cf3fdded70","className":"org.hippoecm.repository.standardworkflow.DefaultWorkflowImpl","user":"admin","methodName":"localizeName","workflowCategory":"core"}
19.02.2013 16:02:38 INFO  [org.hippoecm.repository.audit.AuditLogger.logHippoEvent():39] {"result":"document[uuid=75070051-64af-47cd-93fc-b2c694748deb,path='/jcr:system/jcr:versionStorage/cc/4b/38/cc4b3805-43f8-408c-81b5-466d1cb6f3f9/1.1']","application":"repository","interactionId":"8d1088d4-a781-4729-bcd5-2f9cc14e2037","returnValue":"document[uuid=75070051-64af-47cd-93fc-b2c694748deb,path='/jcr:system/jcr:versionStorage/cc/4b/38/cc4b3805-43f8-408c-81b5-466d1cb6f3f9/1.1']","documentPath":"/content/documents/hippogogreen/news/2012/10/report-green-technology-trends-2013-copy/report-green-technology-trends-2013-copy","interaction":"default:reviewedactions:publish","returnType":"document","timestamp":1361286158292,"category":"workflow","workflowName":"version","action":"org.hippoecm.repository.standardworkflow.VersionWorkflowImpl.version","handleUuid":"1ccf10a4-b324-4cd7-9d28-58cf3fdded70","className":"org.hippoecm.repository.standardworkflow.VersionWorkflowImpl","user":"workflowuser","methodName":"version","workflowCategory":"versioning"}
19.02.2013 16:02:38 INFO  [org.hippoecm.repository.audit.AuditLogger.logHippoEvent():39] {"timestamp":1361286158292,"category":"workflow","application":"repository","workflowName":"reviewedactions","interactionId":"8d1088d4-a781-4729-bcd5-2f9cc14e2037","documentPath":"/content/documents/hippogogreen/news/2012/10/report-green-technology-trends-2013-copy/report-green-technology-trends-2013-copy","action":"org.hippoecm.repository.reviewedactions.FullReviewedActionsWorkflowImpl.publish","handleUuid":"1ccf10a4-b324-4cd7-9d28-58cf3fdded70","interaction":"default:reviewedactions:publish","className":"org.hippoecm.repository.reviewedactions.FullReviewedActionsWorkflowImpl","methodName":"publish","user":"admin","workflowCategory":"default"}

Troubleshooting

If you do not see audit log entries after performing workflow actions or authentication events:

  • Confirm that the appender and logger definitions are present in conf/log4j2-dist.xml.
  • Verify that the application has write permissions to the logs directory.
  • Check for errors in the main application log that may indicate configuration issues.
Share Feedback
Page: /deploy/security-logging/enable-audit-logging
Section: Deploy
Category *