Liferay 7 CE GA audit log

[6年前 に mika mika によって更新されました。]

Hi all,
I want to integrate Audit log into Liferay 7 CE GA. But I cannot find any topic or tutorial about this.
Has any suggest for this? Please help me

Anymore, I have used follow code:

AuditMessage auditMessage = new AuditMessage(...);
AuditRouterUtil.route(auditMessage);

but seem to it not work. I dont see my log anywhere

[6年前 に David H Nebinger によって更新されました。]

CE does not include the infrastructure to log or persist the audit messages so they basically get discarded.

Audit support has always been a Liferay EE / Liferay DXP feature and has not been provided to CE.









Come meet me at the 2017 LSNA!

[6年前 に Andrew Jardine によって更新されました。]

Just like David said, you gotta pay for that one. With that said, as you have found in the API, the plumbing is partially there. All you need to do is write the config/code to register a message listener and services to write the data somewhere. I haven't tried it yet in 7, but I have done it more than once in 6.2

[6年前 に mika mika によって更新されました。]

Hi David and Andrew. As you said, CE dont have integrated Audit plugin. Can I write own audit log plugin with which Liferay Api?

[6年前 に Andrew Jardine によって更新されました。]

Hi Mika,

Yes you can, but it's a little more involved than just writing a plugin (UI). The way the audit plugin works is it leverages action hooks and model listeners to record the events. For example, if you want to record when someone logs in and someone logs out then you need to create service components that are registered against those actions.

The second part is the "recording" of the event. Liferay provides the routing mechanism in that it stubs out the classes that are part of the message bus routing. The part you need to fill in in the messages listener implementations -- so basically, you can create an AuditMessage, and you can ROUTE the AuditMessage -- but then nothing happens because there is no destination registered for the audit events (out of the box). You need to register the listener and include the logic required to store the audit record. So for example, if you were to store the records in the database, then you would provide the message listener class and, using Liferay mantra, create a service builder set of components that would create the tables to store the data.

At this point you would have everything you need to built of a plugin for the control panel where you can then view/sift the records.

make sense?

[6年前 に mika mika によって更新されました。]

Thank Andrew for quick reply
But I dont know how to register audit message Listener as you said. Could you please explain more clearly?

[6年前 に Andrew Jardine によって更新されました。]

Good morning Mika,

In truth, I haven't done this yet for 7 (it's on my list though!) -- but in 6.2 it was done through a spring configuration file, kinda like this --

<beans default-destroy-method="destroy" default-init-method="afterPropertiesSet" xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemalocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd">
    <!-- Router -->
    <bean id="com.liferay.portal.kernel.audit.AuditRouter" class="com.xyz.audit.router.YourCustomAuditRouter">
        <property name="globalAuditMessageProcessors">
            <list value-type="com.liferay.portal.kernel.audit.AuditMessageProcessor">
                <ref bean="com.xyz..audit.processor.DatabaseAuditRouterProcessor" />
                <ref bean="com.xyz..audit.processor.ElasticsearchAuditRouterProcessor" />
                <ref bean="com.xyz..audit.processor.FileAuditRouterProcessor" />
            </list>
        </property>
    </bean><!-- Processors -->
    <bean id="com.xyz.audit.processor.DatabaseAuditRouterProcessor" class="com.xyz.audit.processor.DatabaseAuditRouterProcessor" />
    <bean id="com.xyz.audit.processor.ElastisearchAuditRouterProcessor" class="com.xyz.audit.processor.ElasticsearchAuditRouterProcessor" />
    <bean id="com.xyz.audit.processor.FfileAuditRouterProcessor" class="com.xyz.audit.processor.FileAuditRouterProcessor" />
</beans>

-- you don't have to have a multiple processors of course, I'm just showing you an example of something that I have used in the past. With that defined, again in 6.2, there was an additional change that you had to the web.xml to make sure that the spring config files were loaded

<!--?xml version="1.0"?-->

<web-app version="2.4" xmlns="http://java.sun.com/xml/ns/j2ee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemalocation="http://java.sun.com/xml/ns/j2ee http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd">
    <context-param>
        <param-name>portalContextConfigLocation</param-name>
        <param-value>/WEB-INF/classes/META-INF/xyz-audit-spring.xml</param-value>
    </context-param>
</web-app>

.. then you just use the LR API by creating and AuditMessage entity, setting the data, and then using the AuditRouterUtil to ship it off. In your implementation class (for the Database of course) you would use your service builder api to store the records.

Now the question that remains is, how do we do all of this is Liferay 7? Well, I think, and this is just speculation without trying it (I'm just looking at the existing Liferay source for hints), you provide the same xyz-audit.xml file, but you place it in your xyz-service module under /resources/META-INF/spring -- like this https://github.com/liferay/liferay-portal/tree/master/modules/apps/twitter/twitter-service/src/main/resources/META-INF/spring -- and I suspect that during deployment it will get picked up.

Again though, that is an untested theory -- why don't you give it a shot and let me know?

[6年前 に mika mika によって更新されました。]

Good morning Andrew, Thank you for your hint. I will try it. If you have more information. Please let me know. I'll appreciate about it ^^

[6年前 に Antonio Musarra によって更新されました。]

Hi Mika.
I recently wrote an article (35 pages) on the Liferay Portal Security Audit system updated to the latest version of Liferay Liferay 7 Portal Security Audit. All the developed code can be found on my GitHub repository Liferay Portal Security Audit.

The article is in Italian which I will shortly translate into English. I hope you can help anyway.

[5年前 に Barrie Selack によって更新されました。]

Antonio,

Any progress on the English translation?

[4年前 に ronak vora によって更新されました。]

Hello All
can't we make plugin for audit into Liferay 6.2 and Liferay 7 ?

[4年前 に David H Nebinger によって更新されました。]

Plugins for 6.2 and 7.x are too different to have a single module for both.

[4年前 に Andrew Jardine によって更新されました。]

The fully flushed out solution is a EE/DXP thing, but all the plumbing you need to make it work should be there in the CE version as well. It's been a while since I had to tackle this for 6.2 CE or 7.0 CE but if my memory serves me correctly there are two missing pieces. 

1. There is no "message processor" registered at the liferay/audit message bus endpoint to do something with the message when it gets there, so it's basically just dropped. If you implement the processors then your records should be recorded. As David has said though, the way you implement them of course is different from 6.2 to 7. I think I posted above some details about how to do it in 6.2, in 7, it should be just a case of registering the correct OSGI services. 

2. The second piece I think that is missing would be the control panel portlets that are used to render the records that are currently stored in the database. I suppose this is an optional steps because you can get those records however you like, and you don't even necessarily store them in the Liferay database anyway (depending on your volume you probably want to store them elsewhere really). If you do want to add this in though, it's just a control panel portlet (in 6.2) or a Panel App in 7.x -- which basically amounts to a Liferay MVC portlet that uses the *LocalService classes to read the records and then something like a search container (or however you want to handle pagination) for sifting through the records.

... or, you could just license DXP and then have it all in place and fully supported.

[4年前 に Antonio Musarra によって更新されました。]

Hi.You can use the my open source project Liferay 7 Portal Security Audit  https://github.com/amusarra/liferay-portal-security-auditThis project implement the interfaces of the Liferay Portal Security Audit. AuditRouter, DummyAuditMessageProcessor,CloudAMQP Audit Message Processor
I hope I was helpful.
;-)

[4年前 に Andrew Jardine によって更新されました。]

Hah! Of course! ... But they should also read the paper you wrote (which was really good). You should make people read it. Score they get access to the code ;)

[4年前 に Antonio Musarra によって更新されました。]

For those interested, the book is available on Amazon https://amzn.to/2kMq4Dd but only in Italian. I am working on updating to version 7.3 of Liferay and this time I will undertake to make the edition in English.
Enjoy the reading.