log4j.logger.org.alfresco.repo.audit.AuditComponentImpl=DEBUG

org.alfresco.repo.audit.AuditComponentTest

• alfresco-audit-test-authenticationservice.xml: This is used by the test to capture both successful and unsuccessful login attempts in the audit data.
• testAuditAuthenticationService: This demonstrates the use of the auditSearch method.

org.alfresco.module.org_alfresco_module_dod5015.audit.*

• RecordsManagementAuditServiceImpl$RMAuditTxnListener: This transaction listener generates Records Management-specific data for events (it is a Data Producer). It generates node property deltas.
• config/alfresco/module/org_alfresco_module_dod5015/audit/rm-audit.xml: This defines how the data produced by the AuthenticationService and the Records Management module is persisted. There are some custom DataGenerators and DataRecorders.
• RecordsManagementAuditServiceImpl.getAuditTrailImpl: This method demonstrates how the Records Management use-case searches the audit data. Further query extensions are required to extend the search filters available using the auditQuery API.

alfresco/extensions/audit/alfresco-audit-example-login.xml.sample

% curl -u admin:admin "http://localhost:8080/alfresco/service/api/audit/control"
{
   "enabled" : true,
   "applications": 
   [
      {
         "name": "AuditExampleLogin1",
         "path" : "/auditexamplelogin1",
         "enabled" : true
      }
         ,
      {
         "name": "AuditExampleLogin2",
         "path" : "/auditexamplelogin2",
         "enabled" : true
      }
         ,
      {
         "name": "CMISChangeLog",
         "path" : "/CMISChangeLog",
         "enabled" : true
      }
         
   ]
}

% curl -u admin:admin -d "" "http://localhost:8080/alfresco/service/api/audit/control/CMISChangeLog/CMISChangeLog?enable=false"
{
   "enabled" : false
}

The following examples are two queries to return results: without and with full-audited values respectively. Some entries have been replaced with a (...) for brevity.

% curl -u admin:admin "http://localhost:8080/alfresco/service/api/audit/query/AuditExampleLogin1"
{
   "count":4,
   "entries": 
   [
      {
         "id":69,
         "application":AuditExampleLogin1,
         "user":admin,
         "time":"2010-09-20T14:45:28.998+01:00",
         "values":
null
      },
      ...
   ]
}
% curl -u admin:admin "http://localhost:8080/alfresco/service/api/audit/query/AuditExampleLogin1?verbose=true"
{
   "count":5,
   "entries": 
   [
      ...
      {
         "id":72,
         "application":AuditExampleLogin1,
         "user":null,
         "time":"2010-09-20T14:45:43.884+01:00",
         "values":
         {
                     "\/auditexamplelogin1\/login\/error\/user":"admin"
         }
         
      },
      ...
      {
         "id":76,
         "application":AuditExampleLogin1,
         "user":admin,
         "time":"2010-09-20T14:46:23.319+01:00",
         "values":
         {
                     "\/auditexamplelogin1\/login\/no-error\/user":"admin"
         }
         
      }
   ]
}

There is no count function in the search API. This is by design; use the limit parameter instead.

Notice that the response contains a count of the number of entries returned; the individual entries are provided so that the entry IDs can be used for further result retrieval.

% curl -u admin:admin "http://localhost:8080/alfresco/service/api/audit/query/AuditExampleLogin1?verbose=true&limit=2&forward=false"
{
   "count":2,
   "entries": 
   [
      {
         "id":98,
         "application":AuditExampleLogin1,
         "user":admin,
         "time":"2010-09-20T15:10:04.043+01:00",
         "values":
         {
                     "\/auditexamplelogin1\/login\/no-error\/user":"admin"
         }
         
      },
      {
         "id":96,
         "application":AuditExampleLogin1,
         "user":admin,
         "time":"2010-09-20T15:09:50.117+01:00",
         "values":
         {
                     "\/auditexamplelogin1\/login\/no-error\/user":"admin"
         }
         
      }
   ]
}
% curl -u admin:admin "http://localhost:8080/alfresco/service/api/audit/query/AuditExampleLogin1?verbose=false&limit=8&forward=false&toId=96"
{
   "count":8,
   "entries": 
   [
      {
         "id":94,
         "application":AuditExampleLogin1,
         "user":admin,
         "time":"2010-09-20T15:09:47.606+01:00",
         "values":
null
      },
      ...
      {
         "id":80,
         "application":AuditExampleLogin1,
         "user":admin,
         "time":"2010-09-20T14:58:34.305+01:00",
         "values":
null
      }
   ]
}

% curl -u admin:admin "http://localhost:8080/alfresco/service/api/audit/query/AuditExampleLogin1/auditexamplelogin1/login/error/user?verbose=true&value=joe"
{
   "count":1,
   "entries": 
   [
      {
         "id":101,
         "application":AuditExampleLogin1,
         "user":null,
         "time":"2010-09-20T15:13:57.947+01:00",
         "values":
         {
                     "\/auditexamplelogin1\/login\/error\/user":"joe"
         }
         
      }
   ]
}
% curl -u admin:admin "http://localhost:8080/alfresco/service/api/audit/query/AuditExampleLogin1/auditexamplelogin1/login/error/user?verbose=true&value=JOE"
{
   "count":0,
   "entries": 
   [
   ]
}

% cat <tomcatgt/shared/classes/alfresco/extension/audit-log4j.properties 
log4j.logger.org.alfresco.repo.audit.AuditComponentImpl=DEBUG
log4j.logger.org.alfresco.repo.audit.inbound=DEBUG

1. Login as admin.

   16:47:37,434  DEBUG [repo.audit.inbound] 
   Inbound audit values:
   	/alfresco-api/pre/AuthenticationService/authenticate/args/userName=admin
   16:47:37,443 User:admin DEBUG [repo.audit.inbound] 
   Inbound audit values:
   	/alfresco-api/post/AuthenticationService/authenticate/no-error=null
   	/alfresco-api/post/AuthenticationService/authenticate/args/userName=admin

2. From the inbound values (and if you have the AuditComponentImpl debugging on):

   16:47:37,445 User:System DEBUG [repo.audit.AuditComponentImpl] Extracted audit data: 
      Application: AuditApplication[ name=AuditExampleLogin2, id=7, disabledPathsId=7]
      Raw values:  {/auditexamplelogin2/login=null}
      Extracted:   {}
   16:47:37,447 User:admin DEBUG [repo.audit.AuditComponentImpl] New audit entry: 
      Application ID: 7
      Entry ID:       130
      Values:         {/auditexamplelogin2/login=null}
      Audit Data:     {/auditexamplelogin2/login/user=Administrator}
   16:47:37,447 User:System DEBUG [repo.audit.AuditComponentImpl] Extracted audit data: 
      Application: AuditApplication[ name=AuditExampleLogin1, id=6, disabledPathsId=6]
      Raw values:  {/auditexamplelogin1/login/no-error=null, /auditexamplelogin1/login/args/userName=admin}
      Extracted:   {/auditexamplelogin1/login/no-error/user=admin}
   16:47:37,449 User:admin DEBUG [repo.audit.AuditComponentImpl] New audit entry: 
      Application ID: 6
      Entry ID:       131
      Values:         {/auditexamplelogin1/login/no-error=null, /auditexamplelogin1/login/args/userName=admin}
      Audit Data:     {/auditexamplelogin1/login/no-error/user=admin}

   You can see that the AuthenticationService.authenticate method generate two sets of "inbound" data: the /alfresco-api/pre/AuthenticationService/authenticate data is passed through before the service call is processed; the /alfresco-api/post/AuthenticationService/authenticate data is passed through after the service call has been processed. When logging in successfully, the post-call data is generated with a no-error path.

3. Perform a failed login with user joe.

   17:02:09,697  DEBUG [repo.audit.inbound] 
   Inbound audit values:
   	/alfresco-api/pre/AuthenticationService/authenticate/args/userName=joe
   17:02:09,704  DEBUG [repo.audit.inbound] 
   Inbound audit values:
   	/alfresco-api/post/AuthenticationService/authenticate/error=08200014 Failed to authenticate 
      Started at: 
         org.alfresco.repo.security.authentication.AbstractChainingAuthenticationService.authenticate(AbstractChainingAuthenticationService.java:188)
         ...

   This is translated and recorded:

   17:02:09,704 User:System DEBUG [repo.audit.AuditComponentImpl] Extracted audit data: 
      Application: AuditApplication[ name=AuditExampleLogin1, id=6, disabledPathsId=6]
      Raw values:  {/auditexamplelogin1/login/error=08200014 Failed to authenticate 
      Started at: 
         org.alfresco.repo.security.authentication.AbstractChainingAuthenticationService.authenticate(AbstractChainingAuthenticationService.java:188)
         ...
   17:02:09,704  DEBUG [repo.audit.AuditComponentImpl] New audit entry: 
      Application ID: 6
      E6try ID:       135
      Values:         {/auditexamplelogin1/login/error=08200016 Failed to authenticate 
      Started at: 
         org.alfresco.repo.security.authentication.AbstractChainingAuthenticationService.authenticate(AbstractChainingAuthenticationService.java:188)
         ...
      Audit Data:     {/auditexamplelogin1/login/error/user=joe}

4. Notice that the failed login did not generate any data for audit application AuditExampleLogin2. To understand this, look at the PathMappings section of the example:

   <PathMappings>
           <PathMap source="/alfresco-api/post/AuthenticationService/authenticate" target="/auditexamplelogin1/login"/>
           <PathMap source="/alfresco-api/post/AuthenticationService/authenticate/no-error" target="/auditexamplelogin2/login"/>
       </PathMappings>

   Before any data is considered for persistence, the inbound data paths are remapped using the PathMappings configuration. The /auditexamplelogin2/login path is mapped onto .../no-error only, so failed logins were not recorded for the AuditExampleLogin2 audit application, while the AuditExampleLogin1 application recorded both successful and failed logins.

tail -f ../logs/catalina.out | grep -G "createNode" -A 200 -B 20

20:18:52,817 User:admin DEBUG [repo.audit.AuditComponentImpl] 
New audit entry: 
	Application ID: 8
	Entry ID:       177
	Values:         
		/auditexampleextractors/args/properties=...
		/auditexampleextractors/args/assocQName={http://www.alfresco.org/model/content/1.0}alfresco.log
		/auditexampleextractors/args/parentRef=workspace://SpacesStore/37884669-0607-4527-940d-cb34b4f07d75
		/auditexampleextractors/no-error=null
		/auditexampleextractors/args/assocTypeQName={http://www.alfresco.org/model/content/1.0}contains
		/auditexampleextractors/args/nodeTypeQName={http://www.alfresco.org/model/content/1.0}content
		/auditexampleextractors/result=workspace://SpacesStore/37884669-0607-4527-940d-cb34b4f07d75|workspace://SpacesStore/c0fabc6d-903f-4317-87d1-ec62de37089c|...
	Audit Data: 
		/auditexampleextractors/create/out/a=workspace://SpacesStore/37884669-0607-4527-940d-cb34b4f07d75|workspace://SpacesStore/c0fabc6d-903f-4317-87d1-ec62de37089c|...
		/auditexampleextractors/create/derived/parent-node-name=Company Home
		/auditexampleextractors/create/derived/parent-node-null=null
		/auditexampleextractors/create/in/c={http://www.alfresco.org/model/content/1.0}contains
		/auditexampleextractors/create/in/d={http://www.alfresco.org/model/content/1.0}alfresco.log
		/auditexampleextractors/create/in/a=workspace://SpacesStore/37884669-0607-4527-940d-cb34b4f07d75
		/auditexampleextractors/create/derived/parent-node-type={http://www.alfresco.org/model/content/1.0}folder
		/auditexampleextractors/create/in/b={http://www.alfresco.org/model/content/1.0}content

% curl -u admin:admin "http://localhost:8080/alfresco/service/api/audit/query/AuditExampleExtractors?limit=1&forward=false&verbose=true"
{
   "count":1,
   "entries": 
   [
      {
         "id":177,
         "application":AuditExampleExtractors,
         "user":admin,
         "time":"2010-09-20T20:18:52.761+01:00",
         "values":
         {
                     "\/auditexampleextractors\/create\/out\/a":"workspace:\/\/SpacesStore\/37884669-0607-4527-940d-cb34b4f07d75|workspace:\/\/SpacesStore\/c0fabc6d-903f-4317-87d1-ec62de37089c|...
                     ,"\/auditexampleextractors\/create\/derived\/parent-node-name":"Company Home"
                     ,"\/auditexampleextractors\/create\/in\/c":"{http:\/\/www.alfresco.org\/model\/content\/1.0}contains"
                     ,"\/auditexampleextractors\/create\/in\/d":"{http:\/\/www.alfresco.org\/model\/content\/1.0}alfresco.log"
                     ,"\/auditexampleextractors\/create\/in\/a":"workspace:\/\/SpacesStore\/37884669-0607-4527-940d-cb34b4f07d75"
                     ,"\/auditexampleextractors\/create\/derived\/parent-node-type":"{http:\/\/www.alfresco.org\/model\/content\/1.0}folder"
                     ,"\/auditexampleextractors\/create\/in\/b":"{http:\/\/www.alfresco.org\/model\/content\/1.0}content"
         }
         
      }
   ]
}

The /no-error path was used as the dataTrigger to activate all the RecordValue elements, that is, the presence of the path triggered the data rather than any specific value. /create/derived/... audit values show how the parent node reference was used to record values that were not part of the inbound data set.