No entries in audit log anymore (CQ 5.4)

[flkr]

Hello,

I am working with CQ 5.4 and having trouble to get audit logs for any kind of page events (e.g. creation, modification, activation, deletion, etc.).

Note: You can find the audit logs in the sidekick in the information tab by clicking on the "Audit Log..." button. A window opens which normally shows all kinds of page events, beginning with page creation, followed by any modification, activation and so on.

In my case, when I create a new page and modify it a little bit, this audit log is just empty - I know it should show some entries, as I have some old pages on the same CQ instance, where the audit log is not empty. I just did not give this feature that much attention until this week (a customer needs this).

To narrow it down a little bit: The audit log feature gets its data from nodes below "/var/audit". Page creation events for example are stored in a node below "/var/audit/com.day.cq.wcm.core.page/content/sitename/path/to/my/page". This applies also to modification and deletion events, but for now lets stick to the page creation example.

In my case no node gets created below "/var/audit/etcetera" and this is where I am stuck. I can not tell why this is so and hopefully someone can help me to further analyze this. Maybe it is just a misconfiguration or I am missing a hotfix for CQ?

Anyway I am glad about every help I can get!

Thanks in advance

Florian

[Kunal_Gaba_]

I don't have access to CQ 5.4 instance so I can not check it my self but I am sure there should be some OSGI configuration for enabling the audit logger as pointed by the below pages. 

http://stackoverflow.com/questions/34398028/node-folder-deletion-history-adobe-aem-cq

http://cq-ops.tumblr.com/post/32802188133/how-to-enable-audit-logging-for-cq-dam

[flkr]

Hello, first of all: Thanks for your reply!

But unfortunately this does not solve my problem. I already had a look at those pages before I posted my question here (posting in a Forum is always my last resort). :)

The first link you posted was promising, but I did not find the settings for the audit logger (they do not mention the name of the settings entry, but I searched for everything with "audit" in it's name). There are some settings, but nothing sounds like "activate audit log":

• AuditPurgeService (I installed this some time in the past, it provides a service for deleting very old audit logs)
• com.day.cq.replication.audit.ReplicationEventListener (sounds promising, but does not provide any settings except one called "org.apache.sling.installer.osgi.path" which has the value "jcrinstall:/libs/cq/replication/config.author/com.day.cq.replication.audit.ReplicationEventListener")
• com.day.cq.wcm.core.impl.event.PageEventAuditListener (sounds even more promising, but also has only one setting "org.apache.sling.installer.osgi.path" with a value "jcrinstall:/libs/wcm/core/config.author/com.day.cq.wcm.core.impl.event.PageEventAuditListener")
• com.day.cq.wcm.msm.impl.servlets.AuditLogServlet (this seems to be the servlet settings for requesting audit data from the content repository, it works but is of no use for me right now, as my problem is, that no data is written to the repository)

The second link you posted is about audit logging in DAM. I wanted to give it a try anyway, but there is no config called DamEventRecorder or "Day CQ DAM Event Recorder". I guess that they are using just another CQ version.

I tried something else, but this also had no effect: In your first link someone commented on the answer "Verified this, after audit log level is changed to DEBUG, I could see entries for node creation and deletion". As I have no useful settings for configuring the audit logging I just created a new logger which has the Loglevel DEBUG. It writes to "../logs/auditlogtest.log" and logs everything from "com.day.cq.replication.audit.ReplicationEventListener" and "com.day.cq.wcm.core.impl.event.PageEventAuditListener". But as I said, it doesn't log anything. :( (The logger itself works, as I tried it with some other classes first.)

Maybe there is a way to analyze this problem step by step? Can anyone help? I am also thankful for any technical documentation (I already found every user-documentation there is in the www).

And: Sorry for that much text!

Regards

Florian

[kautuk_sahni]

Hi 

Please follow the steps below:-

1. Go to:- http://localhost:4502/system/console/configMgr

2.  AEM 5.4 - 6.1

    Search for "org.apache.sling.commons.log.LogManager.factory.config", there you will get 6-7 entries for this. Open it and see the log file name, open the "audit.log" (not the auditlog.log) and change the log Level to     Debug.

    AEM 6.2

    Search for logs/audit.log and change the log Level to Debug.

Now try to delete some page and look at the logs, it will show you results.

Doc Link:- https://docs.adobe.com/docs/en/cq/5-4/howto/logsaudits.html

I hope this will work for you.

Thanks and Regards

Kautuk Sahni

logs/audit.log

[kautuk_sahni]

Hi 

Please follow the steps below:-

1. Go to:- http://localhost:4502/system/console/configMgr

2.  AEM 5.4 - 6.1

    Search for "org.apache.sling.commons.log.LogManager.factory.config", there you will get 6-7 entries for this. Open it and see the log file name, open the "audit.log" (not the auditlog.log) and change the log Level to     Debug.

[img]alog.jpg[/img]

    AEM 6.2

    Search for logs/audit.log and change the log Level to Debug.

Now try to delete some page and look at the logs, it will show you results.

Doc Link:- https://docs.adobe.com/docs/en/cq/5-4/howto/logsaudits.html

I hope this will work for you.

Thanks and Regards

Kautuk Sahni

[flkr]

Hello Kautuk,

thanks for your reply, but that is not what I try to achieve.

What I mean is, when you open a page and select the "Information" tab in the sidekick, there is a button called "Audit Log...". When clicking on it, a window opens which normally shows all kinds of page events, beginning with page creation, followed by any modification, activation and so on.

The audit.log in the log directory works independently (but is no prerequisite for the above feature to work). I was able to validate this on a fresh new CQ 5.4 instance.

As the problem occurs only on the production environment of my customer, this is of no use for me unfortunately.

I am still grateful for any help.

Kind regards

Florian

[Bhupta]

Hi @flkr : Any resolution to this?