@Guru Prateek Pinnadhari Please review the code for format() function in next link: https://github.com/apache/knox/blob/master/gateway-util-common/src/main/java/org/apache/knox/gateway/audit/log4j/layout/AuditLayout.java @Override
public String format( LoggingEvent event ) {
sb.setLength( 0 );
dateFormat( sb, event );
CorrelationContext cc = (CorrelationContext)event.getMDC( Log4jCorrelationService.MDC_CORRELATION_CONTEXT_KEY );
AuditContext ac = (AuditContext)event.getMDC( Log4jAuditService.MDC_AUDIT_CONTEXT_KEY );
appendParameter( cc == null ? null : cc.getRootRequestId() );
appendParameter( cc == null ? null : cc.getParentRequestId() );
appendParameter( cc == null ? null : cc.getRequestId() );
appendParameter( event.getLoggerName() );
appendParameter( ac == null ? null : ac.getRemoteIp() );
appendParameter( ac == null ? null : ac.getTargetServiceName() );
appendParameter( ac == null ? null : ac.getUsername() );
appendParameter( ac == null ? null : ac.getProxyUsername() );
appendParameter( ac == null ? null : ac.getSystemUsername() );
appendParameter( (String)event.getMDC( AuditConstants.MDC_ACTION_KEY ) );
appendParameter( (String)event.getMDC( AuditConstants.MDC_RESOURCE_TYPE_KEY ) );
appendParameter( (String)event.getMDC( AuditConstants.MDC_RESOURCE_NAME_KEY ) );
appendParameter( (String)event.getMDC( AuditConstants.MDC_OUTCOME_KEY ) );
String message = event.getRenderedMessage();
sb.append( message == null ? "" : message ).append( LINE_SEP );
return sb.toString();
}
AFAIK the above class function is used to generate the audit line you like to have more information on. Hopefully this helps you if you can read java 🙂 Else here are the answers inline: 1. As seen, there is an IP address in the log that doesn't seem to have an equivalent/document field name. What is this address supposed to be? > This is the remote ip 2. Also, is it intentional to squish "EVENT_PUBLISHING_TIME" and "ROOT_REQUEST_ID" into one column? I understand ROOT_REQUEST_ID is a reserved/empty field but not sure why it is merged with EVENT_PUBLISHING_TIME in the actual log entry. Looks like a bug. > No, the event time is not followed by a | this is the reason why it seems to be squish. 3. The outcome field is misleading. Does it say "succeeded" because a response was sent back to the client? If so, then while technically correct, it does not accurately reflect the status of the operation as it actually failed as seen by the 401 / unauthorized response status. > Correct, says succeeded because it got response and forwarded this back to the client. I dont think knox will try to interpret the actual response and moreover the 401 code is not always a fail (for example with kerberos is expected to get 401 previous kerberos auth) 4. Why could the USER_NAME be missing in the audit entry? > As you can see this username is taken from auditcontext so for some reason in the context of this audit the username was empty for some reason. HTH *** If you found this answer addressed your question, please take a moment to login and click the "accept" link on the answer.
... View more
