OXAudit

From Open-Xchange
Revision as of 09:37, 3 December 2014 by Martin.schneider (talk | contribs) (Corrected pattern)
The printable version is no longer supported and may have rendering errors. Please update your browser bookmarks and please use the default browser print function instead.

Introduction

The Open-Xchange Audit Bundle is an extension of the Open-Xchange Server > 6.12 which will enable your Open-Xchange Server to log actions from users using your Open-Xchange environment. In detail the following actions will be logged to the logfile:

  1. Creation, modification, deletion of an appointment
  2. Creation, modification, deletion of a task
  3. Creation, modification, deletion of a contact
  4. Creation, modification, deletion of an infostore item

Install on OX AppSuite

Debian GNU/Linux 11.0

Add the following entry to /etc/apt/sources.list.d/open-xchange.list if not already present:

deb https://software.open-xchange.com/products/stable/DebianBullseye/ /
# if you have a valid maintenance subscription, please uncomment the 
# following and add the ldb account data to the url so that the most recent
# packages get installed
# deb https://[CUSTOMERID:PASSWORD]@software.open-xchange.com/products/stable/updates/DebianBullseye/ /

and run

$ apt-get update
$ apt-get install open-xchange-audit

Debian GNU/Linux 12.0

Add the following entry to /etc/apt/sources.list.d/open-xchange.list if not already present:

deb https://software.open-xchange.com/products/stable/DebianBookworm/ /
# if you have a valid maintenance subscription, please uncomment the 
# following and add the ldb account data to the url so that the most recent
# packages get installed
# deb https://[CUSTOMERID:PASSWORD]@software.open-xchange.com/products/stable/updates/DebianBookworm/ /

and run

$ apt-get update
$ apt-get install open-xchange-audit


Configuration

Per default the audit bundle will use the Open-Xchange groupware logfile to generate log entries. The logfile can be found at:

/var/log/open-xchange/open-xchange.log

If there is a need to use a seperate logfile for those audit log entries, please modify the following configuration file:

$ vim /opt/open-xchange/etc/logback.xml
 <appender class="ch.qos.logback.core.rolling.RollingFileAppender" name="AUDIT_LOG">
     <file>/var/log/open-xchange/open-xchange-audit.log</file>
     <rollingPolicy class="com.openexchange.logback.extensions.FixedWindowRollingPolicy">
         <fileNamePattern>/var/log/open-xchange/open-xchange-audit.log.%i</fileNamePattern>
         <minIndex>1</minIndex>
         <maxIndex>99</maxIndex>
     </rollingPolicy>
     <triggeringPolicy class="ch.qos.logback.core.rolling.SizeBasedTriggeringPolicy">
         <maxFileSize>2MB</maxFileSize>
     </triggeringPolicy>
     <encoder class="com.openexchange.logback.extensions.ExtendedPatternLayoutEncoder">
         <pattern>%date{"yyyy-MM-dd'T'HH:mm:ss,SSSZ"} %-5level [%thread] %class.%method\(%class{0}.java:%line\)%n%message%n%lmdc%exception{full}</pattern>
     </encoder>
 </appender>
 <appender class="ch.qos.logback.classic.AsyncAppender" name="ASYNC_AUDIT">
     <queueSize>2048</queueSize>
     <discardingThreshold>0</discardingThreshold>
     <includeCallerData>true</includeCallerData>
     <appender-ref ref="AUDIT_LOG"/>
 </appender>
 <logger additivity="false" name="com.openexchange.audit">
     <level value="INFO"/> 
     <appender-ref ref="ASYNC_AUDIT"/>
 </logger>

After you have set the logpath for the audit bundle (/var/log/open-xchange/open-xchange-audit.log in this example) you need to restart the groupware service:

$ /etc/init.d/open-xchange restart