Package org.alfresco.repo.audit.access

Class AccessAuditor

java.lang.Object
org.alfresco.repo.audit.access.AccessAuditor
All Implemented Interfaces:
CheckOutCheckInServicePolicies.OnCancelCheckOut, CheckOutCheckInServicePolicies.OnCheckIn, CheckOutCheckInServicePolicies.OnCheckOut, ContentServicePolicies.OnContentReadPolicy, ContentServicePolicies.OnContentUpdatePolicy, CopyServicePolicies.OnCopyCompletePolicy, NodeServicePolicies.BeforeDeleteNodePolicy, NodeServicePolicies.OnAddAspectPolicy, NodeServicePolicies.OnCreateNodePolicy, NodeServicePolicies.OnMoveNodePolicy, NodeServicePolicies.OnRemoveAspectPolicy, NodeServicePolicies.OnUpdatePropertiesPolicy, ClassPolicy, Policy, VersionServicePolicies.OnCreateVersionPolicy, org.springframework.beans.factory.InitializingBean
public class AccessAuditor extends Object implements org.springframework.beans.factory.InitializingBean, NodeServicePolicies.BeforeDeleteNodePolicy, NodeServicePolicies.OnAddAspectPolicy, NodeServicePolicies.OnCreateNodePolicy, NodeServicePolicies.OnMoveNodePolicy, NodeServicePolicies.OnRemoveAspectPolicy, NodeServicePolicies.OnUpdatePropertiesPolicy, ContentServicePolicies.OnContentReadPolicy, ContentServicePolicies.OnContentUpdatePolicy, VersionServicePolicies.OnCreateVersionPolicy, CopyServicePolicies.OnCopyCompletePolicy, CheckOutCheckInServicePolicies.OnCheckOut, CheckOutCheckInServicePolicies.OnCheckIn, CheckOutCheckInServicePolicies.OnCancelCheckOut
Creates high level audit records on the creation, deletion, modification and access of content and folders. Lower level events are grouped together by transaction and node.

To turn on auditing of these events and sub events add the following property to alfresco-global.properties: 

    # Enable audit in general
    audit.enabled=true

    # Enable the alfresco-access audit application
    audit.alfresco-access.enabled=true

    # Enable the auditing of sub-actions. Normally disabled as these values are
    # not normally needed by audit configurations, but may be useful to developers
    audit.alfresco-access.sub-actions.enabled=true
The following properties are set by default to discard events where the user is 'null' or 'System', the node path is '/sys:archivedItem' or under '/ver:' or the node type is not 'cm:folder', 'cm:content' or 'st:site'. These values result in events only being recorded for common actions initiated by users of the system. These vales may be overridden if required. 
    audit.filter.alfresco-access.default.enabled=true
    audit.filter.alfresco-access.transaction.user=~System;~null;.*
    audit.filter.alfresco-access.transaction.type=cm:folder;cm:content;st:site
    audit.filter.alfresco-access.transaction.path=~/sys:archivedItem;~/ver:;.*
Node and Content changes generate the following audit structure. Elements are omitted if not changed by the transaction. The /sub-action/<sequence> structure holds cut down details of each sub-action, but are only included if the global property audit.alfresco-access.sub-actions.enabled=true. 
    /alfresco-access
     /transaction
       /action=<actionName>
       /sub-actions=<sub action list>
       /path=<prefixPath>
       /type=<prefixType>
       /node=<nodeRef>
       /user=<user>
       /copy
         /from
           /node=<nodeRef>
           /path=<prefixPath>
           /type=<prefixType>
       /move
         /from
           /node=<nodeRef>
           /path=<prefixPath>
           /type=<prefixType>
       /properties
          /from=<mapOfValues>
            /<propertyName>=<propertyValue>
          /to=<mapOfValues>
            /<propertyName>=<propertyValue>
          /add=<mapOfValues>
            /<propertyName>=<propertyValue>
          /delete=<mapOfValues>
            /<propertyName>=<propertyValue>
        /aspects
          /add=<mapOfNames>
            /<aspectName>=null
          /delete=<mapOfNames>
            /<aspectName>=null
        /version-properties=<mapOfValues>
        /sub-action/<sequence>
          /action=<actionName>
          /move
            ...
          /properties
            ...
          /aspects
            ...
            
  Example data:
    /alfresco-access/transaction/action=MOVE
    /alfresco-access/transaction/node=workspace://SpacesStore/74a5985a-45dd-4698-82db-8eaeff9df8d7
    /alfresco-access/transaction/move/from/node=workspace://SpacesStore/d8a0dfd8-fe45-47da-acc2-fd8df9ea2b2e
    /alfresco-access/transaction/move/from/path=/app:company_home/st:sites/cm:abc/cm:documentLibrary/cm:folder1/cm:Word 123.docx
    /alfresco-access/transaction/move/from/type=cm:folder
    /alfresco-access/transaction/path=/app:company_home/st:sites/cm:abc/cm:documentLibrary/cm:folder2/cm:Word 123.docx
    /alfresco-access/transaction/sub-actions=moveNode readContent
    /alfresco-access/transaction/type=cm:content
    /alfresco-access/transaction/user=admin
    /alfresco-access/transaction/sub-action/00/action=moveNode
    /alfresco-access/transaction/sub-action/00/move/from/node=workspace://SpacesStore/d8a0dfd8-fe45-47da-acc2-fd8df9ea2b2e
    /alfresco-access/transaction/sub-action/00/move/from/path=/app:company_home/st:sites/cm:abc/cm:documentLibrary/cm:folder1/cm:Word 123.docx
    /alfresco-access/transaction/sub-action/00/move/from/type=cm:folder
    /alfresco-access/transaction/sub-action/01/action=readContent
The trace output from this class may be useful to developers as it logs method calls grouped by transaction. The debug output is of the audit records written and full inbound audit data. However for developers trace will provide a more readable form. Setting the following dev-log4j.properties: 
    log4j.appender.File.Threshold=trace
    log4j.logger.org.alfresco.repo.audit.access.AccessAuditor=trace
Author:
Alan Davis