2.5.3. Configuring Audit Logging

Procedure 2.2. Monitor Server Startup and Shutdown Events

1. Uncomment Security Audit Appender

   Uncomment the following block.

   <!-- Security AUDIT Appender --> 
   <appender name="AUDIT" class="org.jboss.logging.appender.DailyRollingFileAppender"> 
     <errorHandler class="org.jboss.logging.util.OnlyOnceErrorHandler"/>
     <param name="File" value="${jboss.server.log.dir}/audit.log"/> 
     <param name="Append" value="true"/> 
     <param name="DatePattern" value="'.'yyyy-MM-dd"/> 
     <layout class="org.apache.log4j.PatternLayout"> 
       <param name="ConversionPattern" value="%d %-5p [%c] (%t:%x) %m%n"/> 
     </layout> 
   </appender>

2. Uncomment Security Audit Provider

   Uncomment the following block:

   <!-- Category specifically for Security Audit Provider -->
   <category name="org.jboss.security.audit.providers.LogAuditProvider" additivity="false">
     <priority value="TRACE"/>
     <appender-ref ref="AUDIT"/>
   </category>

3. Configure SecurityInterceptor logging level

   Set the logging level of the SecurityInterceptor class to TRACE by adding the <priority> element to the root <category> element.

   <category name="org.jboss.ejb.plugins.SecurityInterceptor">
     <priority value="TRACE" />
     <appender-ref ref="AUDIT" />
   </category>

4. Enable logging for ServerImpl log messages

   Set the priority and appender-ref levels for the Microcontainer bootstrap by adding the <category> block as specified.

   <category name="org.jboss.bootstrap.microcontainer">
     <priority value="INFO"/>
     <appender-ref ref="AUDIT"/> 
   </category>

5. Enable logging for web-based requests

   If you need additional logging for web-based requests, uncomment the AccessLogValve in JBOSS_HOME/server/production/deploy/jbossweb.sar/server.xml.

   <Valve className="org.apache.catalina.valves.AccessLogValve"
     prefix="localhost_access_log." suffix=".log"
     pattern="common" directory="${jboss.server.home.dir}/log"
     resolveHosts="false" />
   

   The access log is saved in the log directory of the server configuration.

6. Update ConversionPattern

   Update the ConversionPattern parameter in the appender/layout element to show thread information by replacing the Default Pattern with the Full Pattern:

   <!--The full pattern: Date MS Priority [Category] (Thread:NDC) Message -->
   <param name="ConversionPattern" value="%d %-5r %-5p [%c] (%t:%x) %m%n"/>