Content Auditing Issue

[garyj]

Hi All,

I am running a clean install of Alfresco community, and am testing Content Auditing, as we are required to monitor and audit people's access to some of the documents on our system.

Basically I've gone through the wikis and the docs and have the following in my alfresco-global.properties

# Audit configuration 
audit.enabled=true
audit.tagging.enabled=true
audit.alfresco-access.enabled=true
audit.alfresco-access.sub-events.enabled=true
audit.cmischangelog.enabled=true
audit.dod5015.enabled=false
# Setting this flag to true will force startup failure when invalid audit configurations are detected 
audit.config.strict=true
# Audit map filter for AccessAuditor - restricts recorded events to user driven events 
audit.filter.alfresco-access.default.enabled=true
audit.filter.alfresco-access.transaction.user=~System;~null;.*
audit.filter.alfresco-access.transaction.type=cm:folder;cm:content;st:site
audit.filter.alfresco-access.transaction.path=~/sys:archivedItem;~/ver:;.*
#Tried with and without the following line
audit.filter.alfresco-access.default.path=/app:company_home/.* 
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

I have also set the logging to DEBUG for the audit modules and can see the output of the logging events in the alfresco.log file.

However when I go to Preview in Template -> show_audit.ftl there are no log entries shown for any of the content.

I've also noticed the following in alfresco.log when I try to access show_audit.ftl

21:16:00,488 DEBUG [org.alfresco.repo.audit.PropertyAuditFilter] Rejected 
               /alfresco-access/transaction/type=ws:webassetCollection
   audit.filter.alfresco-access.transaction.type=cm:folder;cm:content;st:site
21:16:00,488 DEBUG [org.alfresco.repo.audit.PropertyAuditFilter] Rejected 
               /alfresco-access/transaction/type=ws:webassetCollection
   audit.filter.alfresco-access.transaction.type=cm:folder;cm:content;st:site
‍‍‍‍‍‍‍‍

Just wondering if anyone can point me in the right direction in relation to this issue, as the audit system is working but I just can't seem to get the audit events to display in Alfresco Explorer.

Thank you

garyj

[afaust]

Hello,

your type filter essentially suppresses all recorded events as it determines every object of the following types and all their subtypes as un-auditable. You need to adapt that filter for any event to be recorded.

Regards
Axel

[garyj]

Thank you for the reply, but I don't think the problem is there!

I completely removed the following line from alfresco-global.properties

and still can not view the history via show_audit.ftl

now looking through the logs I get the following entries:

18:54:00,686 DEBUG [org.alfresco.repo.audit.PropertyAuditFilter] Rejected
               /alfresco-access/transaction/type=ws:webassetCollection
   audit.filter.alfresco-access.transaction.type=cm:folder;cm:content;st:site
18:54:00,687 DEBUG [org.alfresco.repo.audit.PropertyAuditFilter] Rejected
               /alfresco-access/transaction/type=ws:webassetCollection
   audit.filter.alfresco-access.transaction.type=cm:folder;cm:content;st:site
18:54:00,688 DEBUG [org.alfresco.repo.audit.PropertyAuditFilter] Rejected
               /alfresco-access/transaction/type=ws:webassetCollection
   audit.filter.alfresco-access.transaction.type=cm:folder;cm:content;st:site
18:54:00,688 DEBUG [org.alfresco.repo.audit.PropertyAuditFilter] Rejected
               /alfresco-access/transaction/type=ws:webassetCollection
   audit.filter.alfresco-access.transaction.type=cm:folder;cm:content;st:site
18:54:00,689 DEBUG [org.alfresco.repo.audit.PropertyAuditFilter] Rejected
               /alfresco-access/transaction/type=ws:webassetCollection
   audit.filter.alfresco-access.transaction.type=cm:folder;cm:content;st:site
18:54:00,690 DEBUG [org.alfresco.repo.audit.PropertyAuditFilter] Rejected
               /alfresco-access/transaction/type=ws:webassetCollection
   audit.filter.alfresco-access.transaction.type=cm:folder;cm:content;st:site

Any other thoughts?

Thank you again!

garyj

[garyj]

Further to my previous posts, I seem to have the auditing working when I create, open and change files in "My Home" within Alfresco Explorer, however I can not seem to get the same functionality going under "Company Home". Is there a way to switch this on and off?

Thank you

[garyj]

And just some further info:

I've come accross: https://issues.alfresco.com/jira/browse/ALF-13443 and it is the exact issue that I am experiencing.

I have created a document via CIFS and the auditing is working perfectly fine, however when I add content using Alfresco Explorer the show_audit.ftl is always blank!

I noticed however that the issue has been marked as "Can not reproduce" and closed, has anyone else had the same problem and been able to resolve it?

Thank you

garyj

[mrogers]

This regression seems to be fixed by another JIRA, possibly ALF-5830?   Anyway it does not reproduce any more.