Audit Trail Log

JFrog Platform Administration Documentation

Content Type
Administration / Platform
ft:sourceType
Paligo

Artifactory maintains an Audit Trail Log, which registers all operations related to users, groups and permissions to allow auditing and tracking capabilities that allow you to enforce security policies in your organization. Operations that will be registered in the log include:

  • Creation, update and deletion of users

  • Creation, update and deletion of groups

  • Creation, update and deletion of permission targets

  • Creation, update and deletion of access tokens

The Audit Trail Log is located under $JFROG_HOME/artifactory/var/log/access-security-audit.log

Enable and Disable Audit Trail Log

Logging audit trail events is enabled by default. It can be disabled and re-enabled using the following REST API endpoint:

This is a REST API endpoint of the Access Service

Enabling or disabling the audit trail log is a feature of the Access Service. Therefore, this call is to the Access Service whose default port is 8040.

Audit Trail Logging

Description: Enables or disables Audit Trail Logging

Since: 5.9.0

Security: Requires a user with Admin privileges to the Access service

Usage: PATCH /api/v1/config

Consumes: application/json

PATCH /api/v1/config
{
 "config" : "---\nsecurity:\n  audit:\n    enabled: <true | false>\n"
}

Sample usage showing how to disable Audit Trail Logging:

curl -H "Content-Type:application/json" -X PATCH -u access-admin:password http://localhost:8040/access/api/v1/config -d '{"config" : "---\nsecurity:\n  audit:\n    enabled: false\n"}'

Audio Trail Log File Format

An entry in the Audit Trail Log has the following format:

Date | Trace ID | User IP | User | Logged Principal | Entity Name | Event Type | Event | Data Changed

where:

Log Field

Description

Date

A date and time stamp for the log entry formatted:

yyyy-MM-dd'T'HH:mm:ss.SSSZ

Trace Id

The trace id value. Trace id is used to identify a request across services

User IP

The IP address of the user that performed the operation in Artifactory

Note

The IP address is shown as unknown if the operation was performed with an internal service token, which is used only for internal communication.

User

The username of the user that performed the operation in Artifactory

Note

The username is shown as unknown if the operation was performed with an internal service token, which is used only for internal communication.

Logged Principal

The login information of the Artifactory service that performed the operation against Access

Entity Name

The security entity that the operation modified. For example, permission target name, group name, username etc.

Event Type

The type of operation performed where: C = Create, U = Update, D = Delete

Event

The security entity on which the operation was performed where: USR = user, GRP = Group, PRM = Permission, TKN = Token

Data Changed

A JSON describing the data that was changed

The following describes a map that specifies permissions when creating or updating a permission target:

r = Read

t = Annotate

w = Deploy/Cache

d = Delete/Overwrite

m = Manage

Example 1

An admin user named admin created a user named bob and added him to 3 groups named: dev-team, code-reviewers, rnd-team-leaders.

2018-02-18T11:57:05.282+0200|10.0.0.132|admin|jf-artifactory@a64971e1-3c3c-4069-a769-dfb473dc8a67|bob|C|USR|{  
   "added":{  
      "customData.updatable_profile":"true",
      "password":"*",
      "groups.dev-team":"UserGroupImpl(name=dev-team, realm=internal)",
      "groups.code-reviewers":"UserGroupImpl(name=code-reviewers, realm=internal)",
      "allowedIps":"[*]",
      "groups.rnd-team-leaders":"UserGroupImpl(name=rnd-team-leaders, realm=internal)",
      "realm":"internal",
      "email":"bob@company.com",
      "status":"enabled",
      "username":"bob"
   }
}
Example 2

An admin user named devops-admin added a user named dylan to a permission target named nodejs-developers with read, annotate, deploy and delete permissions.

2018-02-18T13:19:51.644+0200|10.0.0.132|devops-admin|jf-artifactory@a64971e1-3c3c-4069-a769-dfb473dc8a67|jf-artifactory@a64971e1-3c3c-4069-a769-dfb473dc8a67:nodejs-developers|U|PRM|{  
   "added":{  
      "actions.dylan(USER):w":"dylan(USER):w",
      "actions.dylan(USER):d":"dylan(USER):d",
      "actions.dylan(USER):r":"dylan(USER):r",
      "actions.dylan(USER):n":"dylan(USER):n"
   }
}

Manage Audit Trail Log File Size

The Audit Trail Log size is managed as a series of files that are configured with a maximal size. By default, this log is limited to a size of 1GB split into 10 files each of which is up to 100MB in size.

To change the number of files or their maximal size, change the following tags of the SECURITY.AUDIT log appender in $JFROG_HOME/artifactory/var/etc/access/logback.xml:

Maximum number of files: <maxIndex>

Maximum size of each file: <MaxFileSize>