This document discusses Alfresco's audit component and how it extracts and generates data. It describes how data producers generate data independently along predefined paths and how data extractors transform or output data. It also discusses how the audit query can retrieve audit application data through customizable queries and optional parameters. Finally, it briefly introduces syslog configuration, how to configure log4j to send audit logs to syslog, and logrotate for rotating logs.

1. Audit: data extractors, data generators and
integration with Syslog
Ivá Arroyo
n
Alfresco Developer

2. What is the alfresco Audit?

3. Data Producers
What is a data producer?

4. Data Producers
PathMapping
• The data generate by “data producers” are passing to application
through the path mappings
Application
• An application define how data is mapped, extracted, and recorded
without affecting data required by other applications

5. Audit Component

6. Data extractors and data generators
Data Generator
• A DataGenerator is a component that produces data without any input i.e. data is
produced when a data path is active, but is independent of the values at that
path.
Data Extractor
• A DataExtractor is a component that uses input data to produce some output,
either transforming the data or merely outputting the data verbatim

7. AuditQuery
Consult each audit application component by a
customizable query
Normal query (all results)
•curl -u <admin user>:<password>
"http://<hostname>:<port>/alfresco/service/api/audit/query/<application name>?
verbose=true
Optional parameters
•forward (true|false), sorted upward (true)/ downward (false) by date time
•limit (true|false), limit the number of results.
•toId, return the results until id specified
•value, the value to filter
•fromTime/toTime, returns the result by the time interval specified (millisecond)

8. Unifying all of the above in an example

9. Modify the output of audited messages
• Why?
• Advantages and disadvantages

10. What is Syslog?

11. Syslog configuration
• Configuration file: /etc/syslog.conf
1.Facilities
2.Log File

12. Log4j: syslog appender and additivity
log4j.properties (appender)
log4j.appender.syslog=org.apache.log4j.net.SyslogAppender
log4j.appender.syslog.syslogHost=localhost
log4j.appender.syslog.layout=org.apache.log4j.PatternLayout
log4j.appender.syslog.layout.conversionPattern=%m%n
log4j.appender.syslog.Facility=local4
log4j.properties (additivity)
log4j.logger.org.alfresco.audit.LogAuditImpl=INFO,syslog
log4j.additivity.org.alfresco.audit.LogAuditImpl = false

13. Logrotate: master you log files
• What is?
• How works?

14. Demo

15. Thank You!
@ivanscn