Customizing audit logging for Teracloud® Streams by adding filters

The sample log4j configuration file that is installed with Teracloud® Streams includes an appender example that shows you how to filter out audit event entries and messages based on certain conditions.

Before you begin

Enable audit logging and create a log4j configuration file.

Procedure

Optional: Add filters to your log4j configuration file.
Examples of Teracloud® Streams filters are:
  • domainID, instanceID, hostname, and userID:
  • components such as streamtool, jmx, api, and sam
  • operations such as submitjob, addhost, and getinstancestate
  • combination of any of the above
The following example in the sample file includes audit entries for all log messages for streamtool and submitjob operations: 

 <appender name="auditAppender" class="org.apache.log4j.FileAppender"> 
   <param name="File" value="${streams_log_path}/logs/streams.audit.log"/>
   <layout class="org.apache.log4j.PatternLayout">
     <param name="ConversionPattern" value="%m%n"/>
   </layout>
   <filter class="org.apache.log4j.filter.ExpressionFilter">
     <param name="ConvertInFixToPostFix" value="true" />      
     <param name="AcceptOnMatch" value="true" />
     <param name="Expression" value="MSG ~= 'SRC[streamtool]' || MSG ~= 'OP[submitjob'" />
    </filter>
    <filter class="org.apache.log4j.filter.DenyAllFilter" />
</appender>

To help you create filter expressions, see the audit log examples.