Auditing

In highly regulated environments, it may be necessary for every change made by a user to be logged. This feature is disabled by default. When the feature is required, it must be activated by changing the settings of the orchestra runtime. The configuration parameters can be found in the group "Audit".

When the feature is enabled, all user actions that change the state of the orchestra runtime are recorded in a log file. The name of the log file follows the format log_<NodeName>_<date>_<month>_<day>_<hour>_<minute>-<minute> (e.g., log_SERVICE1_2021-02-06_00_10-19). A file with the extension ".lock" designates the corresponding log file as "in work".

info

The log files are not deleted automatically. Every 10 minutes, a new log file is created. An ending ".lock" indicates that the corresponding file is locked. All audit log entries are added to this active log file.

info

When auditLog with reason is enabled, ensure that the start arguments of the orchestra server contain the following start argument:
-javaagent:"<path-to-orchestra-lib-folder>\aspectjweaver-1.9.5.jar"

Configuration

The configuration of the audit log feature is managed in the environment settings group "Audit". Below are the available configuration parameters:

1. monitor.path
   Path on the local filesystem where the monitor audit log is stored. If it does not exist, Orchestra will create it automatically.

2. monitor.enabled
   Indicates whether audit logging of all monitor activities is enabled (=true) or disabled (=false).

3. monitor.base64
   Specifies whether the audit log of the monitor should be written in plain text (=false) or base64 encoded (=true).

4. monitor.reason
   Requires the user to enter a reason for every monitor action. Set to true to force the user to enter a reason; set to false to log the action without a reason.

Set up Java Agent

The implementation of audit logging uses AspectJ to achieve the required functionality (AspectJ is necessary when monitor.reason = true). To enable this, a specific Java programming language agent must be configured. An additional JVM parameter must be passed to Java in the startup scripts.

Traditional Setup with Apache Tomcat (Linux)
When using Apache Tomcat, open the setenv.sh file and add the following line before starting Tomcat:
CATALINA_OPTS="$CATALINA_OPTS -javaagent:/absolute/path/to/orchestra/WEB-INF/aspectjweaver-1.9.5.jar"

Traditional Setup with Apache Tomcat (Windows)
When using Apache Tomcat, open the Tomcat configuration dialog and add the following command line to the Java Options field:
-javaagent:/absolute/path/to/orchestra/WEB-INF/aspectjweaver-1.9.5.jar

Setup as Standalone Juno

Update the orchestra_juno.sh file to add the following line:
JAVA_OPTS="$JAVA_OPTS -javaagent:${ORC_HOME}/aspectjweaver-1.9.5.jar"