Red Hat SummitEste contenido no está disponible en el idioma seleccionado.
3.7. Management Interface Audit Logging
3.7.1. About Management Interface Audit Logging
Copiar enlaceEnlace copiado en el portapapeles!
When audit logging is enabled, all operations performed using the Management Console, Management CLI interface, or a custom-written management application, are subject to audit logging.
The audit log entries are stored in JSON format and, based on your configuration, can be stored in files, sent to a syslog server or both. Audit logging can only be configured using the Management CLI and is disabled by default.
Login and logout events cannot be audited as there is no 'authenticated session' in EAP. Instead. audit messages are logged when an operation is received from the user.
Note
By default, audit logging is not active. Audit logging can only be configured using the Management CLI.
To list all available management interface audit logging configuration options and their current values, enter the following Management CLI command.
Note
Add the prefix
/host=HOST_NAME to the command for a managed domain.
[... /] /core-service=management/access=audit:read-resource(recursive=true)
[... /] /core-service=management/access=audit:read-resource(recursive=true)3.7.2. Enable Management Interface Audit Logging to a File
Copiar enlaceEnlace copiado en el portapapeles!
To enable audit logging output to a file, enter the following Management CLI command.
Note
If the change is to be applied to a managed domain, add the prefix
/host=HOST_NAME to the following command.
/core-service=management/access=audit/logger=audit-log:write-attribute(name=enabled,value=true)
/core-service=management/access=audit/logger=audit-log:write-attribute(name=enabled,value=true)
Management operations are now logged to a file:
- Standalone mode:
EAP_HOME/standalone/data/audit-log.log - Domain mode:
EAP_HOME/domain/data/audit-log.log
For details of all file handler attributes, see Section A.3, “Management Interface Audit Logging Reference”.
3.7.3. Enable Management Interface Audit Logging to a Syslog Server
Copiar enlaceEnlace copiado en el portapapeles!
By default, audit logging is preconfigured to output to a file when enabled. This procedure configures output to a syslog server and enables audit logging to a file. For details of all syslog handler attributes see Section A.3, “Management Interface Audit Logging Reference”.
Note
If the change is to be applied to a managed domain, add the prefix
/host=HOST_NAME to the /core-service commands.
Procedure 3.24. Enable Audit Logging to a Syslog Server
Enable Audit Logging
Execute the following command:[.. /]/core-service=management/access=audit/logger=audit-log:write-attribute(name=enabled,value=true)
[.. /]/core-service=management/access=audit/logger=audit-log:write-attribute(name=enabled,value=true)Copy to Clipboard Copied! Toggle word wrap Toggle overflow Create a
syslogHandlerIn this example thesyslogserver is running on the same server as the JBoss EAP instance, on port 514. Replace the values of thehostattribute with values appropriate to your environment.Example 3.34. Example syslog handler
[.. /]batch [.. / #]/core-service=management/access=audit/syslog-handler=mysyslog:add(formatter=json-formatter) [.. / #]/core-service=management/access=audit/syslog-handler=mysyslog/protocol=udp:add(host=localhost,port=514) [.. /]run-batch
[.. /]batch [.. / #]/core-service=management/access=audit/syslog-handler=mysyslog:add(formatter=json-formatter) [.. / #]/core-service=management/access=audit/syslog-handler=mysyslog/protocol=udp:add(host=localhost,port=514) [.. /]run-batchCopy to Clipboard Copied! Toggle word wrap Toggle overflow Add a Reference to the
syslogHandlerExecute the following:[.. /]/core-service=management/access=audit/logger=audit-log/handler=mysyslog:add
[.. /]/core-service=management/access=audit/logger=audit-log/handler=mysyslog:addCopy to Clipboard Copied! Toggle word wrap Toggle overflow
Result
Management interface audit log entries are logged on the syslog server.
Note
Enabling audit logging to a Syslog Server in JBoss EAP will not work unless logging is enabled in the operating system as well.
For more information on
rsyslog configurations on Red Hat Enterprise Linux, refer to the "Basic Configuration of rsyslog" section in the System Administrator's Guide for Red Hat Enterprise Linux in https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/
3.7.4. Disable Management Interface Audit Logging
Copiar enlaceEnlace copiado en el portapapeles!
The audit logging to a file or a
Copy to Clipboard
Copied!
Toggle word wrap
Toggle overflow
syslog server can be disabled by executing the following command:
/core-service=management/access=audit/logger=audit-log:write-attribute(name=enabled,value=false)
/core-service=management/access=audit/logger=audit-log:write-attribute(name=enabled,value=false)3.7.5. Read a Management Interface Audit Log
Copiar enlaceEnlace copiado en el portapapeles!
Audit log entries output to file(s) are best viewed with a text viewer, while those output to a syslog server are best viewed using a syslog viewer application.
Note
Using a text editor for viewing log files is not recommended as some may prevent further log entries being written to the log file.
The management interface audit logs are output in JSON format. Each log entry begins with an optional timestamp, then the fields listed in the Management Interface Audit Log Fields table.
| Field Name | Description |
|---|---|
| type | This can have the values core, meaning it is a management operation, or jmx meaning it comes from the JMX subsystem (see the JMX subsystem for configuration of the JMX subsystem's audit logging). |
| r/o | Has the value true if the operation does not change the management model, false otherwise. |
| booting | Has the value true if the operation was executed during the bootup process, false if it was executed once the server is up and running. |
| version | The version number of the JBoss EAP instance. |
| user | The username of the authenticated user. If the operation occurs via the Management CLI on the same machine as the running server, the special user $local is used. |
| domainUUID | An ID to link together all operations as they are propagated from the domain controller to its servers, slave host controllers, and slave host controller servers. |
| access | This can have one of the following values:
|
| remote-address | The address of the client executing this operation. |
| success | Has the value true if the operation is successful, false if it was rolled back. |
| ops | The operations being executed. This is a list of the operations serialized to JSON. At boot this is the operations resulting from parsing the XML. Once booted the list typically contains a single entry. |
'%20d='M201.5%20305.5c-13.8%200-24.9-11.1-24.9-24.6%200-13.8%2011.1-24.9%2024.9-24.9%2013.6%200%2024.6%2011.1%2024.6%2024.9%200%2013.6-11.1%2024.6-24.6%2024.6zM504%20256c0%20137-111%20248-248%20248S8%20393%208%20256%20119%208%20256%208s248%20111%20248%20248zm-132.3-41.2c-9.4%200-17.7%203.9-23.8%2010-22.4-15.5-52.6-25.5-86.1-26.6l17.4-78.3%2055.4%2012.5c0%2013.6%2011.1%2024.6%2024.6%2024.6%2013.8%200%2024.9-11.3%2024.9-24.9s-11.1-24.9-24.9-24.9c-9.7%200-18%205.8-22.1%2013.8l-61.2-13.6c-3-.8-6.1%201.4-6.9%204.4l-19.1%2086.4c-33.2%201.4-63.1%2011.3-85.5%2026.8-6.1-6.4-14.7-10.2-24.1-10.2-34.9%200-46.3%2046.9-14.4%2062.8-1.1%205-1.7%2010.2-1.7%2015.5%200%2052.6%2059.2%2095.2%20132%2095.2%2073.1%200%20132.3-42.6%20132.3-95.2%200-5.3-.6-10.8-1.9-15.8%2031.3-16%2019.8-62.5-14.9-62.5zM302.8%20331c-18.2%2018.2-76.1%2017.9-93.6%200-2.2-2.2-6.1-2.2-8.3%200-2.5%202.5-2.5%206.4%200%208.6%2022.8%2022.8%2087.3%2022.8%20110.2%200%202.5-2.2%202.5-6.1%200-8.6-2.2-2.2-6.1-2.2-8.3%200zm7.7-75c-13.6%200-24.6%2011.1-24.6%2024.9%200%2013.6%2011.1%2024.6%2024.6%2024.6%2013.8%200%2024.9-11.1%2024.9-24.6%200-13.8-11-24.9-24.9-24.9z'/%3e%3c/svg%3e){kind=small}