[Geoserver-users] Enabling audit logging

GeoServer GeoServer User
1

Hello

I'm new to Geoserver and brand new to this list, so please excuse my ignorance. I am trying to get audit logging to work in 2.4.1 on Windows, as per the documentation here:

http://docs.geoserver.org/2.4.1/user/extensions/monitoring/audit.html

It's not working - no files are generated. Can someone clarify the following:

- in monitor.properties, should it be 'audit.enabled' or 'audit.enable'?
- does audit logging require storage to be set to hibernate?
- in monitor.properties, can I omit audit.roll_limit to have a single file per day?
- are changes to monitor.properties picked up immediately, or do they require a config and catalog reload, or GeoServer restart?

Sorry for all the questions, and many thanks in advance for any help

Tom

Tom Chadwin, UK National Parks Portal Manager
Telephone: 01434 611511 Mob: 07881 109617
Web: www.northumberlandnationalpark.org.uk<http://www.northumberlandnationalpark.org.uk/&gt;

IMPORTANT NOTICE - Disclaimer - This communication is from Northumberland National Park Authority (NNPA).The Authority’s head office and principal place of business is Eastburn, South Park, Hexham, Northumberland, NE46 1BS, United Kingdom. If you are not the intended recipient(s) please note that any form of disclosure, distribution, copying or use of this communication or the information in it or in any attachments is strictly prohibited and may be unlawful. If you have received this communication in error, please delete the email and destroy any copies of it. Any views or opinions presented are solely those of the author and do not necessarily represent those of NNPA.Contractors or potential contractors are reminded that a formal Order or Contract is needed for NNPA to be bound by any offer or acceptance of terms for the supply of goods or services Although this email and any attachments are believed to be free of any virus or other defects which might affect any computer or IT system into which they are received, no responsibility is accepted by the NNPA for any loss or damage arising in any way from the receipt or use thereof. Computer systems of this Authority may be monitored and communications carried out on them recorded, to secure the effective operation of the system and for other lawful purpose.

2

On Wed, Apr 23, 2014 at 3:32 PM, Tom Chadwin <tom.chadwin@anonymised.com>wrote:

Hello

I'm new to Geoserver and brand new to this list, so please excuse my
ignorance. I am trying to get audit logging to work in 2.4.1 on Windows, as
per the documentation here:

http://docs.geoserver.org/2.4.1/user/extensions/monitoring/audit.html

It's not working - no files are generated. Can someone clarify the
following:

- in monitor.properties, should it be 'audit.enabled' or 'audit.enable'?

enabled

- does audit logging require storage to be set to hibernate?

Not that I know of

- in monitor.properties, can I omit audit.roll_limit to have a single file
per day?

No, you will get a single file period. There is no way to roll per day (it
could be coded, I can give you pointers in the
code if you want to change it yourself, or you could look at commercial
support and have someone implement it for you, see the "commercial support"
link at geoserver.org)

- are changes to monitor.properties picked up immediately, or do they
require a config and catalog reload, or GeoServer restart?

Going by memory, you have to restart the server, but I may be wrong.

Also have a look at this training material, it may be easier to understand:
http://geoserver.geo-solutions.it/edu/en/adv_gsconfig/monitoring.html
http://geoserver.geo-solutions.it/edu/en/adv_gsconfig/auditing.html

Cheers
Andrea

--

Meet us at GEO Business 2014! in London! Visit http://goo.gl/fES3aK
for more information.

Ing. Andrea Aime
@geowolf
Technical Lead

GeoSolutions S.A.S.
Via Poggio alle Viti 1187
55054 Massarosa (LU)
Italy
phone: +39 0584 962313
fax: +39 0584 1660272
mob: +39 339 8844549

http://www.geo-solutions.it
http://twitter.com/geosolutions_it

-------------------------------------------------------

3

Ah, got it:

"rememeber to always use forward slashes, /, in the path, regardless of the operating system. For example, on Windows the path might look like c:/data/Training_1.7_Win32"

That was the problem. Thanks, so much, Andrea.

Audit log files are now being generated in the right place. However:

- up to three files are being generated per minute
- the log files are all empty

My config is:

audit.enabled=true
audit.path=G:/geoserver/logs
audit.roll_limit=20

Any ideas?

Thanks

Tom

Tom Chadwin, UK National Parks Portal Manager
Telephone: 01434 611511 Mob: 07881 109617
Web: www.northumberlandnationalpark.org.uk<http://www.northumberlandnationalpark.org.uk/&gt;

IMPORTANT NOTICE - Disclaimer - This communication is from Northumberland National Park Authority (NNPA).The Authority’s head office and principal place of business is Eastburn, South Park, Hexham, Northumberland, NE46 1BS, United Kingdom. If you are not the intended recipient(s) please note that any form of disclosure, distribution, copying or use of this communication or the information in it or in any attachments is strictly prohibited and may be unlawful. If you have received this communication in error, please delete the email and destroy any copies of it. Any views or opinions presented are solely those of the author and do not necessarily represent those of NNPA.Contractors or potential contractors are reminded that a formal Order or Contract is needed for NNPA to be bound by any offer or acceptance of terms for the supply of goods or services Although this email and any attachments are believed to be free of any virus or other defects which might affect any computer or IT system into which they are received, no responsibility is accepted by the NNPA for any loss or damage arising in any way from the receipt or use thereof. Computer systems of this Authority may be monitored and communications carried out on them recorded, to secure the effective operation of the system and for other lawful purpose.

4

On Wed, Apr 23, 2014 at 4:18 PM, Tom Chadwin <tom.chadwin@anonymised.com>wrote:

Ah, got it:

"rememeber to always use forward slashes, /, in the path, regardless of
the operating system. For example, on Windows the path might look like
c:/data/Training_1.7_Win32"

That was the problem. Thanks, so much, Andrea.

Audit log files are now being generated in the right place. However:

- up to three files are being generated per minute

This is because the roll limit is just 20, set it to a larger value (this
way it rolls
every 20 requests logged)

- the log files are all empty

Not sure about this one, there was definitely content in them last time
I gave the above training, but I was using a 4.x series, and the last
time I create a template, but in that case I was using a 2.6.x series on
Linux
(both cases happened in the last month)

Do you have any error in the GeoServer logs?

Cheers
Andrea

--

Meet us at GEO Business 2014! in London! Visit http://goo.gl/fES3aK
for more information.

Ing. Andrea Aime
@geowolf
Technical Lead

GeoSolutions S.A.S.
Via Poggio alle Viti 1187
55054 Massarosa (LU)
Italy
phone: +39 0584 962313
fax: +39 0584 1660272
mob: +39 339 8844549

http://www.geo-solutions.it
http://twitter.com/geosolutions_it

-------------------------------------------------------

5

I’ve changed changed it to:

audit.roll_limit=2000

No change in behaviour: up to three files generated per minute, and all empty. This is (I presume) a low-traffic server, so it can’t be that we have thousands of requests.

I don’t know what is causing the multiple files issue, but could the empty files issue be related to permissions? Is it possible that whatever user account is being used has rights to create files, but not to append? That could result in one file per request. Not sure why the files would be empty, though - they should have a single request in them.

Did I read about a bug which might have existed in 2.4? Something about default log templates not being found? Could this be the cause?

Ah, possibly:

2014-04-23 16:10:45,929 WARN [geoserver.monitor] - Request Dumper exiting due to :Template header.ftl not found.

java.io.FileNotFoundException: Template header.ftl not found.

Do I need to upgrade?

Thanks

Tom

···

From: andrea.aime@…84… [mailto:andrea.aime@…84…] On Behalf Of Andrea Aime
Sent: 23 April 2014 15:30
To: Tom Chadwin
Cc: geoserver-users@lists.sourceforge.net
Subject: Re: [Geoserver-users] Enabling audit logging

On Wed, Apr 23, 2014 at 4:18 PM, Tom Chadwin <tom.chadwin@…3373…> wrote:

Ah, got it:

“rememeber to always use forward slashes, /, in the path, regardless of the operating system. For example, on Windows the path might look like c:/data/Training_1.7_Win32”

That was the problem. Thanks, so much, Andrea.

Audit log files are now being generated in the right place. However:

  • up to three files are being generated per minute

This is because the roll limit is just 20, set it to a larger value (this way it rolls

every 20 requests logged)

  • the log files are all empty

Not sure about this one, there was definitely content in them last time

I gave the above training, but I was using a 4.x series, and the last

time I create a template, but in that case I was using a 2.6.x series on Linux

(both cases happened in the last month)

Do you have any error in the GeoServer logs?

Cheers

Andrea

–

==

Meet us at GEO Business 2014! in London! Visit http://goo.gl/fES3aK

for more information.

==

Ing. Andrea Aime

@geowolf

Technical Lead

GeoSolutions S.A.S.

Via Poggio alle Viti 1187

55054 Massarosa (LU)

Italy

phone: +39 0584 962313

fax: +39 0584 1660272

mob: +39 339 8844549

http://www.geo-solutions.it

http://twitter.com/geosolutions_it

6

But it should have been fixed by 2.4.0, which version are you running?

2.4.1

Did you provide your own template files, maybe just in part?

No, but I shall read the docs to see if I can figure out where the template files should be, and whether they are in the wrong place.

Thanks

Tom

Tom Chadwin, UK National Parks Portal Manager
Telephone: 01434 611511 Mob: 07881 109617
Web: www.northumberlandnationalpark.org.uk<http://www.northumberlandnationalpark.org.uk/&gt;

IMPORTANT NOTICE - Disclaimer - This communication is from Northumberland National Park Authority (NNPA).The Authority’s head office and principal place of business is Eastburn, South Park, Hexham, Northumberland, NE46 1BS, United Kingdom. If you are not the intended recipient(s) please note that any form of disclosure, distribution, copying or use of this communication or the information in it or in any attachments is strictly prohibited and may be unlawful. If you have received this communication in error, please delete the email and destroy any copies of it. Any views or opinions presented are solely those of the author and do not necessarily represent those of NNPA.Contractors or potential contractors are reminded that a formal Order or Contract is needed for NNPA to be bound by any offer or acceptance of terms for the supply of goods or services Although this email and any attachments are believed to be free of any virus or other defects which might affect any computer or IT system into which they are received, no responsibility is accepted by the NNPA for any loss or damage arising in any way from the receipt or use thereof. Computer systems of this Authority may be monitored and communications carried out on them recorded, to secure the effective operation of the system and for other lawful purpose.

7

No, but I shall read the docs to see if I can figure out where the template files
should be, and whether they are in the wrong place.

I've put the three template files alongside monitor.properties, the templates having the default content from the documentation, and that has fixed both issues: now only one log file, and it has content.

So, to confirm, audit logging cannot find the inbuilt templates in 2.4.1 on Windows.

Thanks for all the help

Tom

Tom Chadwin, UK National Parks Portal Manager
Telephone: 01434 611511 Mob: 07881 109617
Web: www.northumberlandnationalpark.org.uk<http://www.northumberlandnationalpark.org.uk/&gt;

IMPORTANT NOTICE - Disclaimer - This communication is from Northumberland National Park Authority (NNPA).The Authority’s head office and principal place of business is Eastburn, South Park, Hexham, Northumberland, NE46 1BS, United Kingdom. If you are not the intended recipient(s) please note that any form of disclosure, distribution, copying or use of this communication or the information in it or in any attachments is strictly prohibited and may be unlawful. If you have received this communication in error, please delete the email and destroy any copies of it. Any views or opinions presented are solely those of the author and do not necessarily represent those of NNPA.Contractors or potential contractors are reminded that a formal Order or Contract is needed for NNPA to be bound by any offer or acceptance of terms for the supply of goods or services Although this email and any attachments are believed to be free of any virus or other defects which might affect any computer or IT system into which they are received, no responsibility is accepted by the NNPA for any loss or damage arising in any way from the receipt or use thereof. Computer systems of this Authority may be monitored and communications carried out on them recorded, to secure the effective operation of the system and for other lawful purpose.