Auditing Service

In the WebSphere® Integrated Solutions Console, the portal Auditing Service is listed as WP AuditService.

The section about available events later in this topic lists and describes the events that are available for auditing.

The audit logging output is written to the audit log file. No other log messages are written to this file. For an explanation of the contents of the audit log file refer to the section about the audit log file later in this topic.

Auditing service configuration

By default the audit logging service is disabled. This means that the service is loaded, but does not register any event listeners for audit logging. The auditing service configuration is controlled by the Auditing Service.

audit.service.enable = (false)

This is the global switch. Use it to switch the service on (true) or off (false). The default setting is false.

The actual log file access of the service can be configured by using the following property:

audit.logFileName = log/audit_$create_time.log

This property defines the location and the name of the audit log file. The placeholder $create_time is replaced by a timestamp during filename generation. A second placeholder $APPSERVER_NAME is used for a vertical cluster configurations to make the log file name unique. Example:

     audit.logFileName = log/audit_$APPSERVER_NAME_$CREATE_TIME.log

The auditing service allows you to have the transaction ID written to the audit log file. The project ID can also be written to the audit log file. As these IDs can be very long and might not be required in every environment, you can disable the inclusion of the IDs.

audit.showTransactionID.enable = (true)

Use this property to disable transaction IDs in the audit log. To do this, change the value to false. The default value is true.

audit.projects.enable = (true)

Use this property to disable project IDs in the audit log. To do this, change the value to false. The default value is true.

You determine the events that you want to be logged by enabling the appropriate properties as required. Set the events that you want to enable to the value true. The following groups of events are defined:

		audit.groupEvents.enable
		audit.userEvents.enable
		audit.portletEvents.enable
		audit.roleEvents.enable
		audit.roleBlockEvents.enable
		audit.ownerEvents.enable
		audit.resourceEvents.enable
		audit.externalizationEvents.enable
		audit.userInGroupEvents.enable
		audit.webModuleEvents.enable
		audit.applicationRoleEvents.enable
		audit.principalToApplicationRoleMappingEvents.enable
		audit.roleToApplicationRoleMappingEvents.enable
		audit.domainAdminDataEvents.enable
		audit.designerDeployServiceEvents.enable
		audit.impersonationEvents.enable
    audit.taggingEvents.enable
    audit.ratingEvents.enable
    audit.projectPublishEvents.enable 

The default value for all of these properties is false. That means that no events will be logged by default, even if you have switched the service on by setting the property audit.service.enable to true. For more details about which events are included in each group refer to the section about Available events.

To enable one or more groups of events, change the default value of the appropriate audit.eventGroup.enable property to true.

Available events

This section lists the events that you can log by using the auditing service. They are listed by the groups in which they are available. If you enable one group, all events in that group are logged.

Audit log file

The audit log file contains one audit log message per line. All log messages start with a timestamp, followed by the optional transaction ID, the message code and the event message. Each event message contains the following:

• The user ID of the user who has performed the action which triggered the audit event
• Additional information about the event itself.

Events for actions that run in a transaction are written to the log file when the transaction is committed. If the transaction is rolled back, no event messages are written to the log file.

Events for actions that do not run in a transaction are written to the log immediately. In such cases it is not guaranteed that the related action was completed successfully.