topic Audit Application is Enabled but audit entry is not visible in Alfresco Forum

Audit Application is Enabled but audit entry is not visible

piyush48 — Thu, 10 Sep 2020 13:40:21 GMT

Hii all,

I have been working with auditing and have used custom-audit application as mention in docs but only changed pathmapping tag source only. Due to it audit entries has stopped entering my application also i change audit application name in global.properties still it is behaving wrongly please correct me if i had done something wrong.

<?xml version='1.0' encoding='UTF-8'?>
<Audit
        xmlns="http://www.alfresco.org/repo/audit/model/3.2"
        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
        xsi:schemaLocation="http://www.alfresco.org/repo/audit/model/3.2 alfresco-audit-3.2.xsd"
        >
    <DataExtractors>
        <DataExtractor name="simpleValue" registeredName="auditModel.extractor.simpleValue"/>
        <DataExtractor name="nodeName" registeredName="auditModel.extractor.nodeName"/>
        <DataExtractor name="nodeType" registeredName="auditModel.extractor.nodeType"/>

        <!-- Custom data extractor -->
        <DataExtractor name="siteName" class="com.aviva.alf.platformsample.SiteNameDataExtractor"/>
    </DataExtractors>

    <PathMappings>
        <PathMap source="/share-site-access" target="/share-site-access"/>
    </PathMappings>

    <Application name="ShareSiteAccess" key="share-site-access">
        <RecordValue key="access" dataExtractor="simpleValue" dataSource="/share-site-access/transaction/action"
                     dataTrigger="/share-site-access/transaction/action"/>
        <RecordValue key="nodepath" dataExtractor="simpleValue" dataSource="/share-site-access/transaction/path"
                     dataTrigger="/share-site-access/transaction/path"/>
        <RecordValue key="nodename" dataExtractor="nodeName" dataSource="/share-site-access/transaction/node"
                     dataTrigger="/share-site-access/transaction/node"/>
        <RecordValue key="nodetype" dataExtractor="nodeType" dataSource="/share-site-access/transaction/node"
                     dataTrigger="/share-site-access/transaction/node"/>
        <RecordValue key="site" dataExtractor="siteName" dataSource="/share-site-access/transaction/path"
                     dataTrigger="/share-site-access/transaction/path"/>
    </Application>
</Audit>

Above is my share-site-audit.xml.

Here i have only changed:-

<PathMap source="/share-site-access" target="/share-site-access"/>

from:-

<PathMap source="/alfresco-access" target="/share-site-access"/>

As i dont want audit entries to be duplicated in both audit applications that is:- alfresco-access and share-site-access.

Please look at my alfresco-global.properties

audit.enabled= true
audit.share-site-access.enabled=true
audit.share-site-access.sub-actions.enabled=false
audit.filter.share-site-access.default.enabled=true
audit.filter.share-site-access.default.user=~System;~null;.*
audit.filter.share-site-access.default.path=/app:company_home/st:sites/.*
audit.filter.share-site-access.transaction.user=~System;~null;.*
audit.filter.share-site-access.transaction.path=/app:company_home/st:sites/.*
audit.filter.share-site-access.transaction.action=updateNodeProperties;CREATE
audit.filter.share-site-access.transaction.type=

Re: Audit Application is Enabled but audit entry is not visible

piyush48 — Fri, 11 Sep 2020 10:32:41 GMT

As i have used alfresco-access as Data Producer it works fine but when i change path source to share-site-access it is not recording value. How can i make share-site-access as data producer so that my audit entries will only be entered in share-site-access audit application rather than in both alfresco-access and share-site-access.

Please do guide out.

Thanks,

Piyush

Re: Audit Application is Enabled but audit entry is not visible

afaust — Fri, 11 Sep 2020 12:29:59 GMT

Of course you are now not getting any audit events anymore because there is no audit source called "share-site-access" unless you have also implemented a custom Java component that generates audit events with that source.

I believe there is some confusion / misunderstanding of some aspects of auditing that is at the heart of this, and it does not help that Alfresco reuses names for different elements.

- PathMap source: This is the path / name of audit entries as "recorded" in Java via the AuditComponentImpl - you cannot freely choose this and are fully dependent on what Java components actualyl record data. With Alfresco there are only two valid sources out of the box: /alfresco-api and /alfresco-access

- PathMap target: This is the path / name that relates to the Application to which you want to route audit entries for actual recording / storing, so this always begins with the /<key-of-your-application

- audit.filter.<name>.<setting>: Here, the name always relates to the name for the Java component that records audit entries via the AuditComponentImpl - so essentially the source of the PathMap, never the target

Confusion likely arises from the fact that Alfresco by default comes with both a source and a target called alfresco-access, and Alfresco also documents that the audit.filter can be used to restrict what the audit application alfresco-access records, when in fact, it restricts what the source alfresco-access provides even before PathMap is processed. The effect is the same, apart from the fact that other PathMap which use alfresco-access as the source to a custom target are also transparently affected by the filtering.

In your case, unless you develop custom Java components to record data entries separate from alfresco-access, you will have to use alfresco-access as the source for your custom application, and CANNOT configure a filter separately from alfresco-access.

Re: Audit Application is Enabled but audit entry is not visible

filipehtf — Sat, 15 Oct 2022 22:00:05 GMT

Hello my friend.
I'm trying to create a custom extractor, using SDK 4.3, and I get the error saying it couldn't find the bean.
How did you configure it? Apparently the system is loading the audit.xml before the beans.
Thanks.