Audit log with extra information

[infinityskyline]

My project has requirement to log all user activities.. i.e., what all is happening in the environment and by whom. I have enabled  audit logging feature in AEM by going to http://localhost:4502/system/console/slinglog -> change the log level of logs/audit.log to DEBUG.

This solves my purpose and logs all the user activities but it doesn't log what content changes has been made. For example, if value of a property is changed from "Hello World" to "Hello Earth" I want to log both old and new values, if not both at least the new value.

Is this possible? If not using audit log, can be done with custom logs or any workflows?

[Kiran_Vedantam]

Hi @infinityskyline,

For logging all the user-level activities, you can write a filter and log them to a custom log. Related thread here.

If you need only the content level changes, you can write some listeners and can log the activities. Please find my blog for the annotations here.

Hope this helps!

Thanks,

Kiran Vedantam.

[Sanket_Kumbharkhane · Accepted solution]

You can use an event listener to listen to all the activities on your website. Create a separate class and log all the activities in info mode. 

1. NODE_ADDED
2. NODE_MOVED
3. NODE_REMOVED
4. Event.PERSIST
5. PROPERTY_ADDED
6. PROPERTY_CHANGED
7. PROPERTY_REMOVED

https://aem.redquark.org/2018/10/day-14-eventing-in-aem.html

and then register that class with a new log file name at

http://localhost:4502/system/console/slinglog

Note: Its better to add more restriction to listen to those events like

a. listen only for cq: page 

b. under a specific  parent folder

c. Strictly for Author

as per the requirement.

[infinityskyline]

@Sanket_Kumbharkhane I have created eventlistener class to achieve event handling at the JCR level. Everything is working as given in the example. But how can I achieve value of the property on PROPERTY_CHANGED or PROPERTY_ADDED event?

[Sanket_Kumbharkhane]

You can achieve it by adding more events like JackrabbitEventFilter eventFilter = new JackrabbitEventFilter().setAbsPath(path)) .setEventTypes(Event.NODE_ADDED | Event.NODE_REMOVED | Event.NODE_MOVED | Event.PROPERTY_ADDED | Event.PROPERTY_CHANGED | Event.PROPERTY_REMOVED) .setIsDeep(true).setNoLocal(false).setNoExternal(true); and then listen it in onEvent method

[kiranparab]

Hi,

You don't have to write any custom code for listeners instead you can go with ACS commons available feature Audit log serch

https://adobe-consulting-services.github.io/acs-aem-commons/features/audit-log-search/index.html

It will Trace all the Audit log depends on your Event Type like Page created, Page deleted, etc.. and provide the required information as needed till the date Audit log is available in instance. Purging for Audit log should not happen for that particular date.

Thanks,

Kiran Parab

[infinityskyline]

But this is to search audit log, which I am not bothered right now. I am bothered about the nature of log audit log has.

[kiranparab]

Hi @infinityskyline,

AEM internally logs User activities Audit relates to Page, DAM and Replication events which is OOTB completely in Author mode and the ACS commons Audit-log-search provides the search on the top of it.

Then why are you looking for another custom logs top of it ?

There are three types of Audit Logs options:

1. Page Audit logs

2. DAM Audit logs

3. Replication Audit logs

- If your requirement already covers the events required for this OOTB audit logs available then, you don't have to worry about eventListners to write the custom code again for same case.

- If it not covers your events then, you should go for custom code option with eventListners to write as per demand.

Page Audit events -

Below is the purging option for above audit logs - 

https://experienceleague.adobe.com/docs/experience-manager-64/administering/operations/operations-au...

Thanks,

Kiran Parab

[infinityskyline]

Yes true, but audit log doesn't log what content changes has been made. For example, if value of a property is changed from "Hello World" to "Hello Earth" I want to log both old and new values, if not both at least the new value. I am trying out other suggestions.

[kiranparab]

That's True. But If you are trying to capture very granular level properties or modified transactions then author will slow down with all this logging log sizes and my suggetion is don't go with Debug mode.

If author replicates the final version to publisher then, it will create the auto created version in Author and easy to find diff the page with older version if you really looking for changes.

As i said Audit OOTB logs also captures the timesstamp for each transaction so it will helpful to backtrack to do reverse engineering.

This might help to take call on your usecase.

Thanks,

Kiran Parab

[Jörg_Hoh]

As already stated, it's not useful to log all repository changes, because 1) you have to filter out the changes caused by system processes 2) no one will ever review these changes, 3) they slow down the system and 4) consume a lot of storage.

For what purpose do you need the audit log? What is the livecycle of these audit log data, how long do you want/need to keep them?