topic Re: Audit Alfresco 3.4.c: Nothing audited in Alfresco Archive

Audit Alfresco 3.4.c: Nothing audited

othlen — Thu, 27 Jan 2011 17:27:26 GMT

I'm trying to set up Alfresco Community 3.4.c 's Audit.I've enabled the audit audit serice: audit.enabled=true in alfresco-global.properties file.After this, I created two xml file with my audit application definitions:The first file contains login/logout audit application:<?xml version='1.0' en

Re: Audit Alfresco 3.4.c: Nothing audited

kiddinho — Tue, 01 Mar 2011 05:16:00 GMT

@ othlen

<Application name="NodeCopy" key="nodecopy">
<AuditPath key="copy">
<RecordValue key="sourcenode" dataExtractor="nodeType" dataSource="/auditexamplelogin1/login/args/sourceNodeRef" />

I think it must be:
<Application name="NodeCopy" key="nodecopy">
         <AuditPath key="copy">
                 <RecordValue key="sourcenode" dataExtractor="nodeType" dataSource="/nodecopy/copy/args/sourceNodeRef" />

I have a question. I try to get auditing information with url:
http://localhost:8080/alfresco/service/api/audit/query/DTSCAuditContent with DTSCAuditContent is name attribute of Application tag. But I only get following information:
{
   "count":17,
   "entries":
   [
      {
         "id":146,
         "application"TSCAuditContent,
         "user"ystem,
         "time":"2011-03-01T09:15:06.437+07:00",
         "values":
null
      },
      …
      {
         "id":232,
         "application"TSCAuditContent,
         "user":admin,
         "time":"2011-03-01T10:36:22.750+07:00",
         "values":
null
      }
   ]
}

It does'nt have any information that I audited.
Here is my auditing config:
<Audit
    xmlns="http://www.alfresco.org/repo/audit/model/3.2"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.alfresco.org/repo/audit/model/3.2 alfresco-audit-3.2.xsd"
    >

    <DataExtractors>
       <DataExtractor name="simpleValue" registeredName="auditModel.extractor.simpleValue"/>
      <DataExtractor name="nodeRefExtractor" registeredName="auditModel.extractor.nodeType"/>
    </DataExtractors>

    <DataGenerators>
      <DataGenerator name="personFullName" registeredName="auditModel.generator.personFullName"/>
      <DataGenerator name="user" registeredName="auditModel.generator.user"/>
    </DataGenerators>

    <PathMappings>
        <PathMap source="/alfresco-api/post/ContentService/getReader" target="/dtscAuditContent/read" />
        <PathMap source="/alfresco-api/post/ContentService/getWriter" target="/dtscAuditContent/write" />
    </PathMappings>

    <Application name="DTSCAuditContent" key="dtscAuditContent">
        <AuditPath key="read">
         <AuditPath key="no-error">
            <RecordValue key="nodeRef" dataExtractor="nodeRefExtractor" dataSource="/dtscAuditContent/read/args/nodeRef" />
            <RecordValue key="result" dataExtractor="simpleValue" dataSource="/dtscAuditContent/read/result" />
         </AuditPath>
         <AuditPath key="error">
            <RecordValue key="nodeRef" dataExtractor="nodeRefExtractor" dataSource="/dtscAuditContent/read/args/nodeRef" />
            <RecordValue key="result" dataExtractor="simpleValue" dataSource="/dtscAuditContent/read/result" />
         </AuditPath>
      </AuditPath>
      <AuditPath key="write">
         <AuditPath key="no-error">
            <RecordValue key="nodeRef" dataExtractor="nodeRefExtractor" dataSource="/dtscAuditContent/write/args/nodeRef" />
         </AuditPath>
         <AuditPath key="error">
            <RecordValue key="nodeRef" dataExtractor="nodeRefExtractor" dataSource="/dtscAuditContent/write/args/nodeRef" />
         </AuditPath>
        </AuditPath>
    </Application>

</Audit>

Can anyone help me?

Re: Audit Alfresco 3.4.c: Nothing audited

dallaz — Tue, 29 Mar 2011 12:12:08 GMT

@ othlen:

have you been able to get your audit working with the corrections suggested by kiddinho? I've been trying implementing the same solution, but I keep getting no audits

Re: Audit Alfresco 3.4.c: Nothing audited

davidfg85 — Wed, 04 May 2011 08:43:52 GMT

Works for me

http://localhost:8080/alfresco/service/api/audit/query/DTSCAuditContent?verbose=true&user=admin&forward=false

I have other problems with the audit
http://forums.alfresco.com/en/viewtopic.php?f=9&t=38605

Re: Audit Alfresco 3.4.c: Nothing audited

robinflow — Tue, 02 Aug 2011 10:14:58 GMT

Hi!

I will try to give a working example of a complete audit mechanism with DB query here.
When I started writing my audit scripts, I searched up & down the wiki and the forum,
and did not find a complete auditing example, so here you can find my results.

My main source was:
http://wiki.alfresco.com/wiki/Auditing_%28from_V3.4%29

Based on the sample codes and the example above I managed to get my auditing process working.
I used the audit trail as a source. To enable audit trail, add the following lines to "\WEB-INF\classes\log4j.properties":

### Enable Audit Trail
# log4j.logger.org.alfresco.repo.audit.AuditComponentImpl=DEBUG
# log4j.logger.org.alfresco.repo.audit.inbound=DEBUG   
‍‍‍‍

To enable auditing, add the following code to "\WEB-INF\classes\alfresco-global.properties":

### Enable Audit
audit.enabled=true‍‍

Then I created 3 XML files, to enable login-, node- and action-related auditing.

First XML is located at: "WEB-INF\classes\alfresco\audit\alfresco-audit-login.xml" and it's purpose is to enable auditing the login processes.
(If you take a look at the commented code, you will find that I tried to audit "logout" process as well, but when someone logs out, I found that 2 things happen: a "validate" and a "guest login" - both actions happen at other occasions too, so I could not identify a single "logout". If someone can help me with auditing the "logout" process, I would really appreciate it, but the audit trail didn't show anything relevant about it.)

<?xml version='1.0' encoding='UTF-8'?>

<!– Login/GuestLogin(=Logout)/Validate –>

<Audit
    xmlns="http://www.alfresco.org/repo/audit/model/3.2"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.alfresco.org/repo/audit/model/3.2 alfresco-audit-3.2.xsd"
    >

    <DataExtractors>
       <DataExtractor name="simpleValue" registeredName="auditModel.extractor.simpleValue"/>
    </DataExtractors>

    <DataGenerators>
       <DataGenerator name="personFullName" registeredName="auditModel.generator.personFullName"/>
       <DataGenerator name="currentUser" registeredName="auditModel.generator.user"/>
       <DataGenerator name="systemTime" registeredName="auditModel.generator.time"/>
    </DataGenerators>

    <PathMappings>
        <PathMap source="/alfresco-api/post/AuthenticationService/authenticate" target="/auditlogin/login"/>
        <!– <PathMap source="/alfresco-api/post/AuthenticationService/validate" target="/auditvalidate/validate"/>
        <PathMap source="/alfresco-api/post/AuthenticationService/guestUserAuthenticationAllowed" target="/auditguestlogin/guestlogin"/> –>
    </PathMappings>

    <Application name="AuditLogin" key="auditlogin">
        <AuditPath key="login">
            <AuditPath key="no-error">
                <RecordValue key="user" dataExtractor="simpleValue" dataSource="/auditlogin/login/args/userName"/>
                <GenerateValue key="personFullName" dataGenerator="personFullName" />
                <GenerateValue key="currentUser" dataGenerator="currentUser" />
                <GenerateValue key="systemTime" dataGenerator="systemTime" />
            </AuditPath>
            <AuditPath key="error">
                <RecordValue key="user" dataExtractor="simpleValue" dataSource="/auditlogin/login/args/userName"/>
                <RecordValue key="error" dataExtractor="simpleValue" dataSource="/auditlogin/login/error"/>
                <GenerateValue key="personFullName" dataGenerator="personFullName" />
                <GenerateValue key="currentUser" dataGenerator="currentUser" />
                <GenerateValue key="systemTime" dataGenerator="systemTime" />
            </AuditPath>
        </AuditPath>
    </Application>

    <!– <Application name="AuditValidate" key="auditvalidate">
        <AuditPath key="validate">
            <AuditPath key="no-error">
                <GenerateValue key="personFullName" dataGenerator="personFullName" />
                <GenerateValue key="currentUser" dataGenerator="currentUser" />
                <GenerateValue key="systemTime" dataGenerator="systemTime" />
            </AuditPath>
            <AuditPath key="error">
                <RecordValue key="error" dataExtractor="simpleValue" dataSource="/auditvalidate/validate/error"/>
                <GenerateValue key="personFullName" dataGenerator="personFullName" />
                <GenerateValue key="currentUser" dataGenerator="currentUser" />
                <GenerateValue key="systemTime" dataGenerator="systemTime" />
            </AuditPath>
        </AuditPath>
    </Application>
    
    <Application name="AuditGuestLogin" key="auditguestlogin">
        <AuditPath key="guestlogin">
            <AuditPath key="no-error">
                <RecordValue key="result" dataExtractor="simpleValue" dataSource="/auditguestlogin/guestlogin/result"/>
                <GenerateValue key="personFullName" dataGenerator="personFullName" />
                <GenerateValue key="currentUser" dataGenerator="currentUser" />
                <GenerateValue key="systemTime" dataGenerator="systemTime" />
            </AuditPath>
            <AuditPath key="error">
                <RecordValue key="error" dataExtractor="simpleValue" dataSource="/auditguestlogin/guestlogin/error"/>
                <GenerateValue key="personFullName" dataGenerator="personFullName" />
                <GenerateValue key="currentUser" dataGenerator="currentUser" />
                <GenerateValue key="systemTime" dataGenerator="systemTime" />
            </AuditPath>
        </AuditPath>
    </Application> –>    

</Audit>
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

The second XML is located at: "WEB-INF\classes\alfresco\audit\alfresco-audit-node.xml", and it audits node actions (create/copy/move/delete/rename/contentRead/contentWrite).
(There are 2 kind of "create" calls: NodeService.createNode and FileFolderService.create - both were used in the application, so I decided to audit both calls).

<?xml version='1.0' encoding='UTF-8'?>

<!– Node Functions –>

<Audit
    xmlns="http://www.alfresco.org/repo/audit/model/3.2"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.alfresco.org/repo/audit/model/3.2 alfresco-audit-3.2.xsd"
    >

    <DataExtractors>
       <DataExtractor name="simpleValue" registeredName="auditModel.extractor.simpleValue"/>
    </DataExtractors>

    <DataGenerators>
       <DataGenerator name="personFullName" registeredName="auditModel.generator.personFullName"/>
       <DataGenerator name="currentUser" registeredName="auditModel.generator.user"/>
       <DataGenerator name="systemTime" registeredName="auditModel.generator.time"/>
    </DataGenerators>

    <PathMappings>
        <PathMap source="/alfresco-api/post/NodeService/createNode" target="/node/createNode"/>
        <PathMap source="/alfresco-api/post/FileFolderService/copy" target="/node/copy"/>
        <PathMap source="/alfresco-api/post/FileFolderService/move" target="/node/move"/>
        <PathMap source="/alfresco-api/post/NodeService/deleteNode" target="/node/delete"/>
        <PathMap source="/alfresco-api/post/FileFolderService/rename" target="/node/rename"/>
        <PathMap source="/alfresco-api/post/FileFolderService/create" target="/node/create"/>
        <PathMap source="/alfresco-api/post/ContentService/getWriter" target="/node/write"/>
        <PathMap source="/alfresco-api/post/ContentService/getReader" target="/node/read"/>
    </PathMappings>

    <Application name="Node" key="node">
        
        <AuditPath key="createNode">
            <AuditPath key="no-error">
                <RecordValue key="nodeTypeQName" dataExtractor="simpleValue" dataSource="/node/createNode/args/nodeTypeQName"/>
                <RecordValue key="parentRef" dataExtractor="simpleValue" dataSource="/node/createNode/args/parentRef"/>
                <RecordValue key="assocQName" dataExtractor="simpleValue" dataSource="/node/createNode/args/assocQName"/>
                <RecordValue key="assocTypeQName" dataExtractor="simpleValue" dataSource="/node/createNode/args/assocTypeQName"/>
                <RecordValue key="properties" dataExtractor="simpleValue" dataSource="/node/createNode/args/properties"/>
                <RecordValue key="result" dataExtractor="simpleValue" dataSource="/node/createNode/result"/>
                <GenerateValue key="personFullName" dataGenerator="personFullName"/>
                <GenerateValue key="currentUser" dataGenerator="currentUser"/>
                <GenerateValue key="systemTime" dataGenerator="systemTime"/>
            </AuditPath>
            <AuditPath key="error">
                <RecordValue key="error" dataExtractor="simpleValue" dataSource="/node/createNode/error"/>
                <GenerateValue key="personFullName" dataGenerator="personFullName" />
                <GenerateValue key="currentUser" dataGenerator="currentUser" />
                <GenerateValue key="systemTime" dataGenerator="systemTime" />
            </AuditPath>
        </AuditPath>
        
        <AuditPath key="copy">
            <AuditPath key="no-error">
                <RecordValue key="targetParentRef" dataExtractor="simpleValue" dataSource="/node/copy/args/targetParentRef"/>
                <RecordValue key="sourceNodeRef" dataExtractor="simpleValue" dataSource="/node/copy/args/sourceNodeRef"/>
                <RecordValue key="newName" dataExtractor="simpleValue" dataSource="/node/copy/args/newName"/>
                <RecordValue key="result" dataExtractor="simpleValue" dataSource="/node/copy/result"/>
                <GenerateValue key="personFullName" dataGenerator="personFullName"/>
                <GenerateValue key="currentUser" dataGenerator="currentUser"/>
                <GenerateValue key="systemTime" dataGenerator="systemTime"/>
            </AuditPath>
            <AuditPath key="error">
                <RecordValue key="targetParentRef" dataExtractor="simpleValue" dataSource="/node/copy/args/targetParentRef"/>
                <RecordValue key="sourceNodeRef" dataExtractor="simpleValue" dataSource="/node/copy/args/sourceNodeRef"/>
                <RecordValue key="newName" dataExtractor="simpleValue" dataSource="/node/copy/args/newName"/>
                <RecordValue key="error" dataExtractor="simpleValue" dataSource="/node/copy/error"/>
                <GenerateValue key="personFullName" dataGenerator="personFullName" />
                <GenerateValue key="currentUser" dataGenerator="currentUser" />
                <GenerateValue key="systemTime" dataGenerator="systemTime" />
            </AuditPath>
        </AuditPath>
        
        <AuditPath key="move">
            <AuditPath key="no-error">
                <RecordValue key="targetParentRef" dataExtractor="simpleValue" dataSource="/node/move/args/targetParentRef"/>
                <RecordValue key="sourceNodeRef" dataExtractor="simpleValue" dataSource="/node/move/args/sourceNodeRef"/>
                <RecordValue key="newName" dataExtractor="simpleValue" dataSource="/node/move/args/newName"/>
                <RecordValue key="result" dataExtractor="simpleValue" dataSource="/node/move/result"/>
                <GenerateValue key="personFullName" dataGenerator="personFullName"/>
                <GenerateValue key="currentUser" dataGenerator="currentUser"/>
                <GenerateValue key="systemTime" dataGenerator="systemTime"/>
            </AuditPath>
            <AuditPath key="error">
                <RecordValue key="targetParentRef" dataExtractor="simpleValue" dataSource="/node/move/args/targetParentRef"/>
                <RecordValue key="sourceNodeRef" dataExtractor="simpleValue" dataSource="/node/move/args/sourceNodeRef"/>
                <RecordValue key="newName" dataExtractor="simpleValue" dataSource="/node/move/args/newName"/>
                <RecordValue key="error" dataExtractor="simpleValue" dataSource="/node/move/error"/>
                <GenerateValue key="personFullName" dataGenerator="personFullName" />
                <GenerateValue key="currentUser" dataGenerator="currentUser" />
                <GenerateValue key="systemTime" dataGenerator="systemTime" />
            </AuditPath>
        </AuditPath>        
        
        <AuditPath key="delete">
            <AuditPath key="no-error">
                <RecordValue key="nodeRef" dataExtractor="simpleValue" dataSource="/node/delete/args/nodeRef"/>
                <GenerateValue key="personFullName" dataGenerator="personFullName"/>
                <GenerateValue key="currentUser" dataGenerator="currentUser"/>
                <GenerateValue key="systemTime" dataGenerator="systemTime"/>
            </AuditPath>
            <AuditPath key="error">
                <RecordValue key="nodeRef" dataExtractor="simpleValue" dataSource="/node/delete/args/nodeRef"/>
                <RecordValue key="error" dataExtractor="simpleValue" dataSource="/node/delete/error"/>
                <GenerateValue key="personFullName" dataGenerator="personFullName" />
                <GenerateValue key="currentUser" dataGenerator="currentUser" />
                <GenerateValue key="systemTime" dataGenerator="systemTime" />
            </AuditPath>
        </AuditPath>        
        
        <AuditPath key="rename">
            <AuditPath key="no-error">
                <RecordValue key="fileFolderRef" dataExtractor="simpleValue" dataSource="/node/rename/args/fileFolderRef"/>
                <RecordValue key="newName" dataExtractor="simpleValue" dataSource="/node/rename/args/newName"/>
                <RecordValue key="result" dataExtractor="simpleValue" dataSource="/node/rename/result"/>
                <GenerateValue key="personFullName" dataGenerator="personFullName"/>
                <GenerateValue key="currentUser" dataGenerator="currentUser"/>
                <GenerateValue key="systemTime" dataGenerator="systemTime"/>
            </AuditPath>
            <AuditPath key="error">
                <RecordValue key="fileFolderRef" dataExtractor="simpleValue" dataSource="/node/rename/args/fileFolderRef"/>
                <RecordValue key="newName" dataExtractor="simpleValue" dataSource="/node/rename/args/newName"/>
                <RecordValue key="error" dataExtractor="simpleValue" dataSource="/node/rename/error"/>
                <GenerateValue key="personFullName" dataGenerator="personFullName" />
                <GenerateValue key="currentUser" dataGenerator="currentUser" />
                <GenerateValue key="systemTime" dataGenerator="systemTime" />
            </AuditPath>
        </AuditPath>          

        <AuditPath key="create">
            <AuditPath key="no-error">
                <RecordValue key="parentNodeRef" dataExtractor="simpleValue" dataSource="/node/create/args/parentNodeRef"/>
                <RecordValue key="name" dataExtractor="simpleValue" dataSource="/node/create/args/name"/>
                <RecordValue key="typeQName" dataExtractor="simpleValue" dataSource="/node/create/args/typeQName"/>
                <RecordValue key="result" dataExtractor="simpleValue" dataSource="/node/create/result"/>
                <GenerateValue key="personFullName" dataGenerator="personFullName"/>
                <GenerateValue key="currentUser" dataGenerator="currentUser"/>
                <GenerateValue key="systemTime" dataGenerator="systemTime"/>
            </AuditPath>
            <AuditPath key="error">
                <RecordValue key="error" dataExtractor="simpleValue" dataSource="/node/create/error"/>
                <GenerateValue key="personFullName" dataGenerator="personFullName" />
                <GenerateValue key="currentUser" dataGenerator="currentUser" />
                <GenerateValue key="systemTime" dataGenerator="systemTime" />
            </AuditPath>
        </AuditPath>        

        <AuditPath key="write">
            <AuditPath key="no-error">
                <RecordValue key="update" dataExtractor="simpleValue" dataSource="/node/write/args/update"/>
                <RecordValue key="nodeRef" dataExtractor="simpleValue" dataSource="/node/write/args/nodeRef"/>
                <RecordValue key="propertyQName" dataExtractor="simpleValue" dataSource="/node/write/args/propertyQName"/>
                <RecordValue key="result" dataExtractor="simpleValue" dataSource="/node/write/result"/>
                <GenerateValue key="personFullName" dataGenerator="personFullName"/>
                <GenerateValue key="currentUser" dataGenerator="currentUser"/>
                <GenerateValue key="systemTime" dataGenerator="systemTime"/>
            </AuditPath>
            <AuditPath key="error">
                <RecordValue key="update" dataExtractor="simpleValue" dataSource="/node/write/args/update"/>
                <RecordValue key="nodeRef" dataExtractor="simpleValue" dataSource="/node/write/args/nodeRef"/>
                <RecordValue key="propertyQName" dataExtractor="simpleValue" dataSource="/node/write/args/propertyQName"/>
                <RecordValue key="error" dataExtractor="simpleValue" dataSource="/node/write/error"/>
                <GenerateValue key="personFullName" dataGenerator="personFullName" />
                <GenerateValue key="currentUser" dataGenerator="currentUser" />
                <GenerateValue key="systemTime" dataGenerator="systemTime" />
            </AuditPath>
        </AuditPath>
        
        <AuditPath key="read">
            <AuditPath key="no-error">
                <RecordValue key="nodeRef" dataExtractor="simpleValue" dataSource="/node/read/args/nodeRef"/>
                <RecordValue key="propertyQName" dataExtractor="simpleValue" dataSource="/node/read/args/propertyQName"/>
                <RecordValue key="result" dataExtractor="simpleValue" dataSource="/node/read/result"/>
                <GenerateValue key="personFullName" dataGenerator="personFullName"/>
                <GenerateValue key="currentUser" dataGenerator="currentUser"/>
                <GenerateValue key="systemTime" dataGenerator="systemTime"/>
            </AuditPath>
            <AuditPath key="error">
                <RecordValue key="nodeRef" dataExtractor="simpleValue" dataSource="/node/read/args/nodeRef"/>
                <RecordValue key="propertyQName" dataExtractor="simpleValue" dataSource="/node/read/args/propertyQName"/>
                <RecordValue key="error" dataExtractor="simpleValue" dataSource="/node/read/error"/>
                <GenerateValue key="personFullName" dataGenerator="personFullName" />
                <GenerateValue key="currentUser" dataGenerator="currentUser" />
                <GenerateValue key="systemTime" dataGenerator="systemTime" />
            </AuditPath>
        </AuditPath>        
                
    </Application>

</Audit>
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Finally my third XML, located at "WEB-INF\classes\alfresco\audit\alfresco-audit-action.xml", auditing the checkin/checkout/executeAction/search/ticket-request processes:

<?xml version='1.0' encoding='UTF-8'?>

<!– Node Functions –>

<Audit
    xmlns="http://www.alfresco.org/repo/audit/model/3.2"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.alfresco.org/repo/audit/model/3.2 alfresco-audit-3.2.xsd"
    >

    <DataExtractors>
       <DataExtractor name="simpleValue" registeredName="auditModel.extractor.simpleValue"/>
    </DataExtractors>

    <DataGenerators>
       <DataGenerator name="personFullName" registeredName="auditModel.generator.personFullName"/>
       <DataGenerator name="currentUser" registeredName="auditModel.generator.user"/>
       <DataGenerator name="systemTime" registeredName="auditModel.generator.time"/>
    </DataGenerators>

    <PathMappings>
        <PathMap source="/alfresco-api/post/CheckoutCheckinService/checkin" target="/action/checkin"/>
        <PathMap source="/alfresco-api/post/CheckoutCheckinService/checkout" target="/action/checkout"/>
        <PathMap source="/alfresco-api/post/CheckoutCheckinService/cancelCheckout" target="/action/cancelCheckout"/>
        <PathMap source="/alfresco-api/post/ActionService/executeAction" target="/action/executeAction"/>
        <PathMap source="/alfresco-api/post/SearchService/query" target="/action/searchQuery"/>
        <PathMap source="/alfresco-api/post/FileFolderService/searchSimple" target="/action/searchSimple"/>
        <PathMap source="/alfresco-api/post/AuthenticationService/getCurrentTicket" target="/action/getCurrentTicket"/>
    </PathMappings>

    <Application name="Action" key="action">
        
        <AuditPath key="checkin">
            <AuditPath key="no-error">
                <RecordValue key="contentUrl" dataExtractor="simpleValue" dataSource="/action/checkin/args/contentUrl"/>
                <RecordValue key="versionProperties" dataExtractor="simpleValue" dataSource="/action/checkin/args/versionProperties"/>
                <RecordValue key="keepCheckedOut" dataExtractor="simpleValue" dataSource="/action/checkin/args/keepCheckedOut"/>
                <RecordValue key="workingCopyNodeRef" dataExtractor="simpleValue" dataSource="/action/checkin/args/workingCopyNodeRef"/>
                <RecordValue key="result" dataExtractor="simpleValue" dataSource="/action/checkin/result"/>
                <GenerateValue key="personFullName" dataGenerator="personFullName"/>
                <GenerateValue key="currentUser" dataGenerator="currentUser"/>
                <GenerateValue key="systemTime" dataGenerator="systemTime"/>
            </AuditPath>
            <AuditPath key="error">
                <RecordValue key="contentUrl" dataExtractor="simpleValue" dataSource="/action/checkin/args/contentUrl"/>
                <RecordValue key="versionProperties" dataExtractor="simpleValue" dataSource="/action/checkin/args/versionProperties"/>
                <RecordValue key="keepCheckedOut" dataExtractor="simpleValue" dataSource="/action/checkin/args/keepCheckedOut"/>
                <RecordValue key="workingCopyNodeRef" dataExtractor="simpleValue" dataSource="/action/checkin/args/workingCopyNodeRef"/>
                <RecordValue key="error" dataExtractor="simpleValue" dataSource="/action/checkin/error"/>
                <GenerateValue key="personFullName" dataGenerator="personFullName" />
                <GenerateValue key="currentUser" dataGenerator="currentUser" />
                <GenerateValue key="systemTime" dataGenerator="systemTime" />
            </AuditPath>
        </AuditPath>
        
        <AuditPath key="checkout">
            <AuditPath key="no-error">
                <RecordValue key="nodeRef" dataExtractor="simpleValue" dataSource="/action/checkout/args/nodeRef"/>
                <RecordValue key="result" dataExtractor="simpleValue" dataSource="/action/checkout/result"/>
                <GenerateValue key="personFullName" dataGenerator="personFullName"/>
                <GenerateValue key="currentUser" dataGenerator="currentUser"/>
                <GenerateValue key="systemTime" dataGenerator="systemTime"/>
            </AuditPath>
            <AuditPath key="error">
                <RecordValue key="nodeRef" dataExtractor="simpleValue" dataSource="/action/checkout/args/nodeRef"/>
                <RecordValue key="error" dataExtractor="simpleValue" dataSource="/action/checkout/error"/>
                <GenerateValue key="personFullName" dataGenerator="personFullName" />
                <GenerateValue key="currentUser" dataGenerator="currentUser" />
                <GenerateValue key="systemTime" dataGenerator="systemTime" />
            </AuditPath>
        </AuditPath>
        
        <AuditPath key="cancelCheckout">
            <AuditPath key="no-error">
                <RecordValue key="workingCopyNodeRef" dataExtractor="simpleValue" dataSource="/action/cancelCheckout/args/workingCopyNodeRef"/>
                <RecordValue key="result" dataExtractor="simpleValue" dataSource="/action/cancelCheckout/result"/>
                <GenerateValue key="personFullName" dataGenerator="personFullName"/>
                <GenerateValue key="currentUser" dataGenerator="currentUser"/>
                <GenerateValue key="systemTime" dataGenerator="systemTime"/>
            </AuditPath>
            <AuditPath key="error">
                <RecordValue key="workingCopyNodeRef" dataExtractor="simpleValue" dataSource="/action/cancelCheckout/args/workingCopyNodeRef"/>
                <RecordValue key="error" dataExtractor="simpleValue" dataSource="/action/cancelCheckout/error"/>
                <GenerateValue key="personFullName" dataGenerator="personFullName" />
                <GenerateValue key="currentUser" dataGenerator="currentUser" />
                <GenerateValue key="systemTime" dataGenerator="systemTime" />
            </AuditPath>
        </AuditPath>            
        
        <AuditPath key="executeAction">
            <AuditPath key="no-error">
                <RecordValue key="actionedUponNodeRef" dataExtractor="simpleValue" dataSource="/action/executeAction/args/actionedUponNodeRef"/>
                <RecordValue key="action" dataExtractor="simpleValue" dataSource="/action/executeAction/args/action"/>
                <GenerateValue key="personFullName" dataGenerator="personFullName"/>
                <GenerateValue key="currentUser" dataGenerator="currentUser"/>
                <GenerateValue key="systemTime" dataGenerator="systemTime"/>
            </AuditPath>
            <AuditPath key="error">
                <RecordValue key="actionedUponNodeRef" dataExtractor="simpleValue" dataSource="/action/executeAction/args/actionedUponNodeRef"/>
                <RecordValue key="action" dataExtractor="simpleValue" dataSource="/action/executeAction/args/action"/>
                <RecordValue key="error" dataExtractor="simpleValue" dataSource="/action/executeAction/error"/>
                <GenerateValue key="personFullName" dataGenerator="personFullName" />
                <GenerateValue key="currentUser" dataGenerator="currentUser" />
                <GenerateValue key="systemTime" dataGenerator="systemTime" />
            </AuditPath>
        </AuditPath>        
        
        <AuditPath key="searchQuery">
            <AuditPath key="no-error">
                <RecordValue key="language" dataExtractor="simpleValue" dataSource="/action/searchQuery/args/language"/>
                <RecordValue key="query" dataExtractor="simpleValue" dataSource="/action/searchQuery/args/query"/>
                <RecordValue key="store" dataExtractor="simpleValue" dataSource="/action/searchQuery/args/store"/>
                <GenerateValue key="personFullName" dataGenerator="personFullName"/>
                <GenerateValue key="currentUser" dataGenerator="currentUser"/>
                <GenerateValue key="systemTime" dataGenerator="systemTime"/>
            </AuditPath>
            <AuditPath key="error">
                <RecordValue key="language" dataExtractor="simpleValue" dataSource="/action/searchQuery/args/language"/>
                <RecordValue key="query" dataExtractor="simpleValue" dataSource="/action/searchQuery/args/query"/>
                <RecordValue key="store" dataExtractor="simpleValue" dataSource="/action/searchQuery/args/store"/>
                <RecordValue key="error" dataExtractor="simpleValue" dataSource="/action/searchQuery/error"/>
                <GenerateValue key="personFullName" dataGenerator="personFullName" />
                <GenerateValue key="currentUser" dataGenerator="currentUser" />
                <GenerateValue key="systemTime" dataGenerator="systemTime" />
            </AuditPath>
        </AuditPath>                        

        <AuditPath key="searchSimple">
            <AuditPath key="no-error">
                <RecordValue key="name" dataExtractor="simpleValue" dataSource="/action/searchSimple/args/name"/>
                <RecordValue key="contextNodeRef" dataExtractor="simpleValue" dataSource="/action/searchSimple/args/contextNodeRef"/>
                <GenerateValue key="personFullName" dataGenerator="personFullName"/>
                <GenerateValue key="currentUser" dataGenerator="currentUser"/>
                <GenerateValue key="systemTime" dataGenerator="systemTime"/>
            </AuditPath>
            <AuditPath key="error">
                <RecordValue key="name" dataExtractor="simpleValue" dataSource="/action/searchSimple/args/name"/>
                <RecordValue key="contextNodeRef" dataExtractor="simpleValue" dataSource="/action/searchSimple/args/contextNodeRef"/>
                <RecordValue key="error" dataExtractor="simpleValue" dataSource="/action/searchSimple/error"/>
                <GenerateValue key="personFullName" dataGenerator="personFullName" />
                <GenerateValue key="currentUser" dataGenerator="currentUser" />
                <GenerateValue key="systemTime" dataGenerator="systemTime" />
            </AuditPath>
        </AuditPath>                        

        <AuditPath key="getCurrentTicket">
            <AuditPath key="no-error">
                <RecordValue key="result" dataExtractor="simpleValue" dataSource="/action/getCurrentTicket/result"/>
                <GenerateValue key="personFullName" dataGenerator="personFullName"/>
                <GenerateValue key="currentUser" dataGenerator="currentUser"/>
                <GenerateValue key="systemTime" dataGenerator="systemTime"/>
            </AuditPath>
            <AuditPath key="error">
                <RecordValue key="error" dataExtractor="simpleValue" dataSource="/action/getCurrentTicket/error"/>
                <GenerateValue key="personFullName" dataGenerator="personFullName" />
                <GenerateValue key="currentUser" dataGenerator="currentUser" />
                <GenerateValue key="systemTime" dataGenerator="systemTime" />
            </AuditPath>
        </AuditPath>                        
        
    </Application>

</Audit>
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Now it all works and fine, and I can see the alf_audit_entry table growing with every action I carry out, but this single table doesn't give us any information about what's happening really. So I found an old script in the Alfresco wiki, which I configured a little bit, to get as much information as possible from the audit:

    select

      /*Data extract*/
        entry.id                    as Entry_ID,
            entry.audit_app_id               as Application_ID,
            sv_entry.string_value            as Entry_String_Value,
            sv_app.string_value               as Application_String_Value,
            sv_pl.string_value               as ALF_PROP_LINK_String_Value,
            sv_pl2.string_value               as ALF_PROP_LINK_String_Value,

      /*alf_audit_entry TABLE as entry*/
        entry.id                    as alf_audit_entry___id,
            entry.audit_app_id               as alf_audit_entry___audit_app_id,
        entry.audit_time            as alf_audit_entry___audit_time,
        entry.audit_user_id         as alf_audit_entry___audit_user_id,
        entry.audit_values_id       as alf_audit_entry___audit_values_id,

      /*alf_audit_app TABLE as app*/
        app.id                                  as alf_audit_app___id,
        app.version                         as alf_audit_app___version,
            app.app_name_id                     as alf_audit_app___app_name_id,
            app.audit_model_id                as alf_audit_app___audit_model_id,
            app.disabled_paths_id          as alf_audit_app___disabled_paths_id,

      /*alf_audit_model TABLE as model*/
            model.id                               as alf_audit_model___id,
            model.content_data_id          as alf_audit_model___content_data_id,
            model.content_crc                as alf_audit_model___content_crc,

      /*alf_content_data TABLE as dat*/
            dat.id                                  as alf_content_data___id, 
            dat.version                         as alf_content_data___version,
            dat.content_url_id               as alf_content_data___content_url_id,
            dat.content_mimetype_id         as alf_content_data___content_mimetype_id,
            dat.content_encoding_id         as alf_content_data___content_encoding_id,
            dat.content_locale_id            as alf_content_data___content_locale_id,

      /*alf_prop_link TABLE as pl*/
        pl.root_prop_id             as alf_prop_link___root_prop_id,
        pl.prop_index               as alf_prop_link___prop_index,
        pl.contained_in             as alf_prop_link___contained_in,
        pl.key_prop_id              as alf_prop_link___key_prop_id,
        pl.value_prop_id            as alf_prop_link___value_prop_id,

      /*alf_prop_value TABLE as pv*/
        pv.actual_type_id           as alf_prop_value___actual_type_id,
        pv.persisted_type           as alf_prop_value___persisted_type,
        pv.long_value               as alf_prop_value___long_value,

      /*alf_prop_double_value TABLE as dv*/
        dv.double_value             as alf_prop_double_value___double_value,

      /*alf_prop_string_value TABLE as sv*/
            sv.id                                    as alf_prop_string_value___id,
            sv.string_value             as alf_prop_string_value___string_value,
            sv.string_end_lower               as alf_prop_string_value___string_end_lower,
            sv.string_crc                        as alf_prop_string_value___string_crc,

      /*alf_prop_serializable_value_value TABLE as serv*/
        serv.serializable_value     as prop_serializable_value

    from

        alf_audit_app app
        join alf_audit_entry entry on (entry.audit_app_id = app.id)

        /*Condition from iBatis query: <isEqual property="keyOrValueSearch" compareValue="true">
               join alf_prop_link sp_pl on (sp_pl.root_prop_id = entry.audit_values_id)*/

        join alf_prop_link pl on (pl.root_prop_id = entry.audit_values_id)
        join alf_prop_value pv on (pl.value_prop_id = pv.id)

        left join alf_prop_double_value dv on (dv.id = pv.long_value and pv.persisted_type = 2)
        left join alf_prop_string_value sv on (sv.id = pv.long_value and (pv.persisted_type = 3 OR pv.persisted_type = 5))
        left join alf_prop_serializable_value serv on (serv.id = pv.long_value and pv.persisted_type = 4)

        left join alf_audit_model model on (model.id = app.audit_model_id)
            left join alf_content_data dat on (dat.id = model.content_data_id)

            left join alf_prop_string_value sv_entry on (sv_entry.id = entry.audit_user_id and (pv.persisted_type = 3 OR pv.persisted_type = 5))
            left join alf_prop_string_value sv_app on (sv_app.id = app.app_name_id and (pv.persisted_type = 3 OR pv.persisted_type = 5))
            left join alf_prop_string_value sv_pl on (sv_pl.id = pl.key_prop_id and (pv.persisted_type = 3 OR pv.persisted_type = 5))
            left join alf_prop_string_value sv_pl2 on (sv_pl2.id = pl.value_prop_id and (pv.persisted_type = 3 OR pv.persisted_type = 5))

    ORDER BY entry.id ASC‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

But this still wasn't enough to retrieve all audited properties from the database. So I managed to discover the auditing tables links and relations to some point, and came up with a slightly more informative script, which gave me enough information about the audit entry (although it is still missing some relavant, but less important information):

select entry.id as Entry_ID,

    entry.audit_values_id as Entry_Value_ID,
    link.root_prop_id,
    link.key_prop_id as Key_ID,
    link.value_prop_id as Value_ID,
    /*val_value.long_value as Value_Time_epoch,*/
    FROM_UNIXTIME(LEFT(val_value.long_value,10)) as Value_Time,
    str_val.string_value as Value_String,
    /*val_key.id as apv_Key_ID,
    val_key.long_value as apv_Value_ID,*/
    apsv_result.string_value as Value_PT3,
    key_string.string_value as Audit_Path,
      node.uuid as NodeRef,
      val_ser.serializable_value as Object_Serialized
    
    from alf_audit_entry entry
    left join alf_prop_link link on (entry.audit_values_id = link.root_prop_id)
    left join alf_prop_value val_value on (link.value_prop_id = val_value.id and (val_value.persisted_type = 1) and LENGTH(val_value.long_value) > 9) /* EPOCH TIME*/
    left join alf_prop_string_value str_val on (link.value_prop_id = str_val.id)
    left join alf_prop_value val_key on (link.key_prop_id = val_key.id and (val_key.persisted_type = 3))
    left join alf_prop_string_value key_string on (val_key.long_value = key_string.id)
    
    left join alf_prop_value apv_result on (link.value_prop_id = apv_result.id and (apv_result.persisted_type = 3))
    left join alf_prop_string_value apsv_result on (apv_result.long_value = apsv_result.id)

      left join alf_prop_value val_result on (link.value_prop_id = val_result.id and (val_result.persisted_type = 4))
      left join alf_prop_serializable_value val_ser on (val_result.long_value = val_ser.id)

      left join alf_node node on (entry.audit_values_id = node.id and ( key_string.string_value = '/node/create/no-error/result'))
    
      ORDER BY entry.id ASC
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

If you have a soul entry that you want to list from the DB, you can use the "entry.id" to identify the entry.
Here's an example audit trail for deleting a node:

Inbound audit values:
   /alfresco-api/post/NodeService/deleteNode/no-error=null
   /alfresco-api/post/NodeService/deleteNode/args/nodeRef=workspace://SpacesStore/14ae1679-5701-4c8d-8b52-56fdaae22969
15:12:10,656 DEBUG [org.alfresco.repo.audit.AuditComponentImpl] 
Extracted audit data: 
   Application:    AuditApplication[ name=Node, id=14, disabledPathsId=327]
   Values:         
      /node/delete/args/nodeRef=workspace://SpacesStore/14ae1679-5701-4c8d-8b52-56fdaae22969
      /node/delete/no-error=null

   New Data: 
      /node/delete/no-error/nodeRef=workspace://SpacesStore/14ae1679-5701-4c8d-8b52-56fdaae22969

15:12:10,687 DEBUG [org.alfresco.repo.audit.AuditComponentImpl] 
New audit entry: 
   Application ID: 14
   Entry ID:       320
   Values:         
      /node/delete/args/nodeRef=workspace://SpacesStore/14ae1679-5701-4c8d-8b52-56fdaae22969
      /node/delete/no-error=null

   Audit Data: 
      /node/delete/no-error/currentUser=admin
      /node/delete/no-error/systemTime=Wed Jul 27 15:12:10 CEST 2011
      /node/delete/no-error/personFullName=Administrator
      /node/delete/no-error/nodeRef=workspace://SpacesStore/14ae1679-5701-4c8d-8b52-56fdaae22969‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Based on this, we now know the audit entry id = 320.

So we modify the DB query to show only this single audit entry, like this (check the last-but-one line, starting with the "WHERE" clause):

select entry.id as Entry_ID,

    entry.audit_values_id as Entry_Value_ID,
    link.root_prop_id,
    link.key_prop_id as Key_ID,
    link.value_prop_id as Value_ID,
    /*val_value.long_value as Value_Time_epoch,*/
    FROM_UNIXTIME(LEFT(val_value.long_value,10)) as Value_Time,
    str_val.string_value as Value_String,
    /*val_key.id as apv_Key_ID,
    val_key.long_value as apv_Value_ID,*/
    apsv_result.string_value as Value_PT3,
    key_string.string_value as Audit_Path,
      node.uuid as NodeRef,
      val_ser.serializable_value as Object_Serialized
    
    from alf_audit_entry entry
    left join alf_prop_link link on (entry.audit_values_id = link.root_prop_id)
    left join alf_prop_value val_value on (link.value_prop_id = val_value.id and (val_value.persisted_type = 1) and LENGTH(val_value.long_value) > 9) /* EPOCH TIME*/
    left join alf_prop_string_value str_val on (link.value_prop_id = str_val.id)
    left join alf_prop_value val_key on (link.key_prop_id = val_key.id and (val_key.persisted_type = 3))
    left join alf_prop_string_value key_string on (val_key.long_value = key_string.id)
    
    left join alf_prop_value apv_result on (link.value_prop_id = apv_result.id and (apv_result.persisted_type = 3))
    left join alf_prop_string_value apsv_result on (apv_result.long_value = apsv_result.id)

      left join alf_prop_value val_result on (link.value_prop_id = val_result.id and (val_result.persisted_type = 4))
      left join alf_prop_serializable_value val_ser on (val_result.long_value = val_ser.id)

      left join alf_node node on (entry.audit_values_id = node.id and ( key_string.string_value = '/node/create/no-error/result'))

          WHERE entry.id = '320'
      ORDER BY entry.id ASC
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

So this is how far I got. If someone comes up with better auditing stratetgy, or a complete DB query that lists all the information the audit trail shows, please share!

Re: Audit Alfresco 3.4.c: Nothing audited

g_rathod — Wed, 23 May 2012 13:30:50 GMT

Hi robinflow,

Thanks for posting an audit configuration file, but I am eager to know in following scenario.

1) I have my own custom property (e.g. xz:cargoId ) which is under path :

/{http://www.alfresco.org/model/system/1.0}system/{http://www.alfresco.org/model/system/1.0}people‍

2) I tried applying filter in alfresco-global.properties for type filter below :

audit.filter.alfresco-access.default.type=cm:content;cm:person;cm:folder;‍

3) I have following configuration for audit in global.properties file

### Enable audit in general ###
audit.enabled=true
audit.alfresco-access.enabled=true
audit.alfresco-access.sub-actions.enabled=true
audit.alfresco-access.sub-events.enabled=true



# Enable debug from the PropertyAuditFilter
log4j.logger.org.alfresco.repo.audit.PropertyAuditFilter=debug

### Audit Filter ###
audit.filter.alfresco-access.default.enabled=true
audit.filter.alfresco-access.default.type=cm:content;cm:person;cm:folder;
audit.filter.alfresco-access.default.path=.*
audit.filter.alfresco-access.default.user=.*;~System;‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

4) Now when I change anything user properties like firstName/lastName or even my custom id xz:cargoId
it is not showing anything in log.

Any idea how do I include my custom content type or property in audit ?

Re: Audit Alfresco 3.4.c: Nothing audited

eric_soto — Thu, 26 Sep 2013 12:01:25 GMT

Hi g_rathod,

You might want to try adding the following property to your alfresco-global.properties file (and perhaps eliminate the audit.filter.alfresco-access.default.type property):


audit.filter.alfresco-access.transaction.type=cm:folder;cm:content;cm:person;xz:cargoId 
‍‍‍

I hope this helps. Cheers.