The audit log provides Administrators with a high level overview of actions that have taken place, when they occurred, and which user initiated the action. The log is output in JSON format which allows for post-processing and further analysis. For example, it can be read by the JSON Data node.
These actions are audited:
- All login attempts, both successful and unsuccessful.
- Run and save a data flow.
- Node execution.
- Create, update and delete schedules.
- Execute a scheduled run.
- Change schedule system settings.
- LDAP/AD import.
- Change of LDAP/AD system settings.
- Create, update, and delete a user.
- Create workspaces.
- Upload, download or access a data file.
- Create, update, move and delete a data connection and a data collection.
- Create, update and delete a mount point.
- Extract a zip file.
- Add or remove a user role.
- Change password.
- Create, update, and delete group.
- Create, update and delete folders.
- Logout and UI session timeout.
- Start and completion of backup.
The audit log is located at: <Data360Analyze site configuration directory>/logs/lae-audit.log
For example, C:/Users/<username>/Data360Analyze/site-7731/logs
Every day that the application is used, a new audit log file is created. Log files for previous days are saved in the same folder with the creation date as a suffix, for example lae-audit.log.2018-10-31.
The first section in this topic gives an overview of the elements that make up the audit log, see Understanding the audit log.
The second section gives details of how to map specific actions to log entries, see Identifying and tracing actions.
The final section gives an overview of the elements that make up the node audit log, see
Understanding the node audit log. The
node audit log file will be created under
<siteDir>/logs/nodes/<Date>/<User>/<DataFlow>/<runId>/<AutogeneratedId>.log
and is referenced in the lae-audit.lognodeProcessed audit log entry in the "auditLog"
argument.
Understanding the audit log
In general, log entries are made up of these pieces of information:
| Log entry information | Description | Example |
|---|---|---|
|
|
Indicates the time and date of the audited action. Each new timestamp indicates a new audit log entry. |
"timestamp":"2018-08-03T12:53:00.163+01:00"
|
|
|
The name of the action. |
"auditCode":"executionSessionService.execute"
|
userID
|
The |
"userId":"b9469ceb-65bd-472c-b8fa-d71a63be6929"
|
username
|
The |
"username":"user1234"
|
tenantName
|
The name of the deployment — with the currently supported model, this will always be set to defaultTenant. |
"tenantName":"defaultTenant"
|
success
|
A true or false statement that indicates if the action completed successfully or not. |
"success":true
|
arguments
|
The arguments passed in the API request. |
|
response
|
The API response to the action. Contains defined error fields. |
|
Identifying and tracing actions
By understanding the information tags within an audit log, you can follow the trail of actions undertaken by a specific user, or trace the changes to a given data flow.
For example, a new data flow is created with the following ID: 6ca06e21-73d0-4816-b44d-238903d3768f
{"timestamp":"2018-11-05T10:20:29.411Z","auditCode":"executionSessionService.create","userId":"b9469ceb-65bd-472c-b8fa-d71a63be6929","username":"User1234","tenantName":"defaultTenant","success":true,"arguments":{"executionSession":{"id":"49486f20-96ca-4a70-8f32-f738b15e59fc","graphLocator":"object:!tenant:defaultTenant~workspace:908ee33e-5eee-1694-4284-63aea9310e8c~edit-session:c833d293-c2e8-4dea-b129-60630f38558a~graph:6ca06e21-73d0-4816-b44d-238903d3768f","lxsId":null,"runtimeProperties":{},"valid":false,"runBy":"User1234","runDate":null,"runState":null,"lastExecutionCandidates":[],"allExecutionCandidates":[],"executionLogId":null,"interfaces":["ExecutionSession"]},"workspaceLocator":"object:!tenant:defaultTenant~workspace:908ee33e-5eee-1694-4284-63aea9310e8c"},"response":"object:!tenant:defaultTenant~workspace:908ee33e-5eee-1694-4284-63aea9310e8c~execution-session:49486f20-96ca-4a70-8f32-f738b15e59fc"}
Later, a new schedule is created based on this data flow:
{"timestamp":"2018-11-05T14:09:14.478Z","auditCode":"simpleScheduledTaskService.create","userId":"admin","username":"admin","tenantName":"defaultTenant","success":true,"arguments":{"containerLocator":"object:!tenant:defaultTenant~directory:__Root__~directory:__Users__~directory:c5eb280e-773f-d5bc-679a-455d6d702462","simpleScheduledTaskDto":{"id":"6e140249-5b0d-4428-9913-c19672336633","name":"schedule test","description":null,"enabled":true,"triggerProperties":{"cronExpression":"0 09 14 1 1/1 ?
*","startDateTime":"2018-11-05T14:09:06Z","interval":"monthly","monthlyScheduleOption":"day-of-week"},"runAs":null,"dataflowId":"6ca06e21-73d0-4816-b44d-238903d3768f","runProperties":{},"searchPath":["object:!tenant:defaultTenant~directory:__Root__~directory:__Users__~directory:c5eb280e-773f-d5bc-679a-455d6d702462"]}},"response":"object:!tenant:defaultTenant~directory:__Root__~directory:__Users__~directory:c5eb280e-773f-d5bc-679a-455d6d702462~scheduled-task:6e140249-5b0d-4428-9913-c19672336633"}
Examples
Some examples of common audit log entries are listed in the tables below, along with a description of how the log entry relates to a user action in Data360 Analyze:
Login
| Log entry | Description |
|---|---|
|
|
Indicates that a user has successfully signed in to Data360 Analyze. When a user signs in to the application, you will also see the following log entry:
|
Create or update user or group
In these examples, all actions except groupService.create and groupService.updateGroup are logged as a result of a single create user request. You can identify a user by their ID, for example, 21fad3f0-f8a2-4d66-846e-240dca92b16f, which you can trace through the various actions.
| Log entry | User action and example |
|---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Create, update and delete a folder
| Log entry | User action and example |
|---|---|
|
|
|
Create, save, run or delete a data flow
When a data flow is created, an edit session is opened to track data flow and node edits, and an execution session is opened to track the state of the data flow.
| Log entry | User action and example |
|---|---|
|
|
|
|
|
|
Node execution
| Log entry | User action and example |
|---|---|
|
and
|
When a node is executed, two entries are added to the log:
The reference to the node that is being executed is logged in the following format:
|
Create, update or run a schedule
| Log entry | User action and example |
|---|---|
|
and
|
When a user creates a schedule, several entries are added to the audit log including
When a schedule is updated, two entries are added to the audit log: The
The
When a user deletes a schedule, the following audit entries are logged:
|
|
|
Tip: Unlike when a user triggers a data flow to run immediately, when the system runs a schedule,
scheduledTaskId and scheduledTaskName attributes are logged in place of userid and username.
|
|
|
|
|
|
|
Run clean up settings
| Log entry | User action and example |
|---|---|
|
and
|
The following entries are logged when a new schedule setting is set, for example if a user chooses to delete temporary data after a successful run or specifies a number of recent scheduled runs to keep:
When a schedule setting is changed, for example if a user modifies the period of time for which they want to keep scheduled runs, the following entries are logged:
|
LDAP/AD integration
| Log entry | User action and example |
|---|---|
"auditCode":"authenticationConfigurationService.<action>"
|
As a result of a user configuring LDAP/AD authentication settings, you will also see
|
|
|
|
|
|
Note that has a result of configuring or editing LDAP/AD user import settings, you will also see a
|
Create, update or delete a data connection
| Log entry | User action and example |
|---|---|
"auditCode":"dataConnectionCreated"
|
Indicates that a new data connection has been
established.
{"timestamp":"2024-03-08T10:25:03.9504991Z","auditCode":"dataConnectionCreated","userId":"admin","username":"admin","tenantName":"defaultTenant","success":true,"arguments":{"dataConnectionPath":"//System
Connections/My Data
Connection#data-connection","targetLocation":"","dataConnectionlocator":"object:!tenant:defaultTenant~workspace:systemConnections~data-connection:4733efe0-5c15-4e74-8037-8e1d795cd876"},"response":"object:!tenant:defaultTenant~workspace:systemConnections~data-connection:4733efe0-5c15-4e74-8037-8e1d795cd876"} |
"auditCode":"dataConnectionUpdated"
|
Indicates that an existing data connection has been
modified.
{"timestamp":"2024-03-08T10:25:18.4251538Z","auditCode":"dataConnectionUpdated","userId":"admin","username":"admin","tenantName":"defaultTenant","success":true,"arguments":{"dataConnectionPath":"//System
Connections/My Data
Connection#data-connection","targetLocation":"file:///C:/test/","dataConnectionlocator":"object:!tenant:defaultTenant~workspace:systemConnections~data-connection:4733efe0-5c15-4e74-8037-8e1d795cd876"},"response":"object:!tenant:defaultTenant~workspace:systemConnections~data-connection:4733efe0-5c15-4e74-8037-8e1d795cd876"} |
"auditCode":"dataConnectionDeleted"
|
Indicates that an existing data connection has been
deleted.
{"timestamp":"2024-03-08T10:25:43.3515003Z","auditCode":"dataConnectionDeleted","userId":"admin","username":"admin","tenantName":"defaultTenant","success":true,"arguments":{"dataConnectionPath":"/unresolved
path","dataConnectionlocator":"object:!tenant:defaultTenant~workspace:systemConnections~data-connection:4733efe0-5c15-4e74-8037-8e1d795cd876"},"response":"object:!tenant:defaultTenant~workspace:systemConnections~data-connection:4733efe0-5c15-4e74-8037-8e1d795cd876"} |
Create, delete or move a data directory
| Log entry | User action and example |
|---|---|
"auditCode":"dataDirectoryCreated"
|
Indicates that a new data directory has been created to organize data files.
dataDirectoryRenamed is logged as
dataDirectoryCreated followed by a
dataDirectoryDeleted
entry.
|
"auditCode":"dataDirectoryDeleted"
|
Indicates that a data directory has been deleted.
|
"auditCode":"dataDirectoryMoved"
|
Indicates that a data directory has been
moved.
{"timestamp":"2024-03-08T10:35:52.4433347Z","auditCode":"dataDirectoryMoved","userId":"admin","username":"admin","tenantName":"defaultTenant","success":true,"arguments":{"sourceDataDirectoryLocator":"object:!tenant:defaultTenant~workspace:07a0732c-7140-4627-b594-47b7c13285cf~data-collection:5d772432-e218-4673-85d6-c7a7df24f589~data-directory:directory","destinationTargetLocation":"","destinationDataDirectoryLocator":"object:!tenant:defaultTenant~workspace:07a0732c-7140-4627-b594-47b7c13285cf~data-collection:5572088a-60d8-4762-9959-d27cd5dda81b~data-directory:directory","destinationDataDirectoryPath":"//admin/My
2nd Data
Collection#data-collection/directory#data-directory"},"response":"object:!tenant:defaultTenant~workspace:07a0732c-7140-4627-b594-47b7c13285cf~data-collection:5d772432-e218-4673-85d6-c7a7df24f589~data-directory:directory"} |
Working with data files
| Log entry | User action and example |
|---|---|
"auditCode":"dataFileCreated"
|
Indicates that a data file has been created.
|
"auditCode":"dataFileUploaded"
|
Indicates that a file is uploaded. This will also log a
dataFileCreated
action.
|
"auditCode":"dataFileMoved"
|
Indicates that a file has been moved to a new location. Data File rename is logged as a dataFileMoved.
|
"auditCode":"dataFileDownloaded"
|
Indicates that a file has been
downloaded.
|
"auditCode":"dataFileEntryExtracted"
|
Indicates that a file has been extracted from a zip archive. This
will also log dataFileCreated and
dataDirectoryCreated
entries.
{"timestamp":"2024-03-08T10:32:12.2591994Z","auditCode":"dataFileEntryExtracted","userId":"admin","username":"admin","tenantName":"defaultTenant","success":true,"arguments":{"archiveFileLocator":"object:!tenant:defaultTenant~workspace:07a0732c-7140-4627-b594-47b7c13285cf~data-collection:5d772432-e218-4673-85d6-c7a7df24f589~data-directory:My_20Data_20Folder~data-file:file_5F1_2Ezip","dataFileResourcePath":"//admin/My
Data Collection#data-collection/My Data
Folder#data-directory/file_1#data-directory/file_1.txt#data-file","dataFileLocator":"object:!tenant:defaultTenant~workspace:07a0732c-7140-4627-b594-47b7c13285cf~data-collection:5d772432-e218-4673-85d6-c7a7df24f589~data-directory:My_20Data_20Folder~data-directory:file_5F1~data-file:file_5F1_2Etxt"},"response":"object:!tenant:defaultTenant~workspace:07a0732c-7140-4627-b594-47b7c13285cf~data-collection:5d772432-e218-4673-85d6-c7a7df24f589~data-directory:My_20Data_20Folder~data-directory:file_5F1~data-file:file_5F1_2Etxt"} |
"auditCode":"dataFileExtracted"
|
Indicates that the extraction of a zip file has completed.
|
"auditCode":"dataFileDeleted"
|
Indicates that a file has been deleted.
|
Create, update or delete a mount point
| Log entry | User action and example |
|---|---|
"auditCode":"fileStoreMountPointCreated"
|
Indicates that a mount point has been
created.
|
"auditCode":"fileStoreMountPointUpdated"
|
Indicates that the settings for an existing mount point has been
updated.
{"timestamp":"2024-03-08T10:39:40.1287284Z","auditCode":"fileStoreMountPointUpdated","userId":"admin","username":"admin","tenantName":"defaultTenant","success":true,"arguments":{"mountPath":"/Users#directory/admin#directory/My
Data
Collection#data-collection","effectiveConnection":{"dataConnection":"object:!tenant:defaultTenant~directory:__Root__~directory:systemConnections~data-connection:system-shared-connection","relativePath":"admin\\dc"},"fileStoreMountPointlocator":"object:!tenant:defaultTenant~mounts:mounts~file-store-mount-point:f0602433-66bd-4093-a5f3-c7bcd91bea4c","mountLocator":"object:!tenant:defaultTenant~directory:__Root__~directory:__Users__~directory:9b940bab-f748-4347-80a0-2e01f0da5327~data-collection:5d772432-e218-4673-85d6-c7a7df24f589"},"response":"object:!tenant:defaultTenant~mounts:mounts~file-store-mount-point:f0602433-66bd-4093-a5f3-c7bcd91bea4c"} |
"auditCode":"fileStoreMountPointDeleted"
|
Indicates that a mount point has been
deleted.
|
Working with data collections
| Log entry | User action and example |
|---|---|
"auditCode":"dataCollectionCreated"
|
Indicates that a data collection has been
created.
|
"auditCode":"dataCollectionUpdated"
|
Indicates that a data collection has been renamed.
|
"auditCode":"dataCollectionDeleted"
|
Indicates that a data collection has been
deleted.
|
"auditCode":"dataCollectionMoved"
|
Indicates that a data collection has been moved to a new
location.
{"timestamp":"2024-03-14T14:04:48.2233702Z","auditCode":"dataCollectionMoved","userId":"admin","username":"admin","tenantName":"defaultTenant","success":true,"arguments":{"sourceDataCollectionLocator":"object:!tenant:defaultTenant~directory:__Root__~directory:__Users__~directory:b0894047-f671-42fb-8069-2c2915766674~directory:12ea94e6-61fa-4e00-91c3-886bde8cf39a~data-collection:f35a94aa-50f5-4300-b0f1-403c19c13275","destinationDataCollectionLocator":"object:!tenant:defaultTenant~directory:__Root__~directory:__Users__~directory:b0894047-f671-42fb-8069-2c2915766674~directory:4ce39d2a-f688-4b31-8008-d97c0ff843e5~data-collection:f35a94aa-50f5-4300-b0f1-403c19c13275","destinationDataCollectionPath":"/Users#directory/admin#directory/My
Folder 2#directory/My Data
Collection#data-collection"},"response":"object:!tenant:defaultTenant~directory:__Root__~directory:__Users__~directory:b0894047-f671-42fb-8069-2c2915766674~directory:12ea94e6-61fa-4e00-91c3-886bde8cf39a~data-collection:f35a94aa-50f5-4300-b0f1-403c19c13275"} |
Node audit logging
Node audit logs provide a traceable record of file system interactions for node executions withing the application. The node audit log is created under the <siteDir>/logs/nodes/ folder locations.
For each node that executes and attempts to read or write files, an audit log entry and corresponding audit log file is created.
The node audit log file is created under <siteDir>/logs/nodes/<Date>/<User>/<DataFlow>/<runId>/<AutogeneratedId>.log where:
-
<date>: Date when the node executed. -
<user>: Name of the user who ran the node. -
<dataFlow>: Name of the data flow the node exists in. -
<runId>: ID for the "execution-session" or run. -
<autoGeneratedId>: Auto-generated unique ID.
This node log, once created, is referenced in the lae-audit.lognodeProcessed audit log entry in the "auditLog"
argument.
Only nodes that interact with files outside of their temporary inputs, outputs and the libraries will have a corresponding audit log generated. This can still result in a large number of logs, but to ensure full auditing and traceability, the system will not delete or clean up these files. Node audit log file management and archiving is the responsibility of the Data360 Analyze system administrator.
ls.brain.node.auditNodeFileAccess=false to this configuration file
<siteDir>/conf/cust.prop. Some examples of node audit log entries are listed in the table below, along with a description of how the log entry relates to a user action in Data360 Analyze.
The node audit log entries contain the same parameters as the
lae.audit log (timestamp,
auditCode, userId, username,
tenantName, success) and the following arguments:
| Argument | Description |
|---|---|
dataFlowName
|
Name of the data flow the node is executing in. |
dataFlowLocator
|
Locator of the data flow the node is executing in. |
runName
|
Name of the run the node is executing within. |
executionSessionLocator
|
Locator of the run. |
nodeLocator
|
Locator of the node within the data flow. |
| Log entry | User action and example |
|---|---|
"auditCode":"fileOpened"
|
Indicates that an attempt was made to open a file, but the operation failed
due to insufficient permissions. This log has the {"timestamp":"2024-04-03T16:57:55.1656576+02:00","auditCode":"fileOpened","userId":"admin","username":"admin","tenantName":"defaultTenant","success":false,"arguments":{"dataFlowLocator":"object:!tenant:defaultTenant~directory:__Root__~directory:__Temp__~directory:08c91198-3121-4bb9-b32f-49fbedcd3c6a~edit-session:9fbc56af-c008-4bcb-a546-c061666de520~graph:acf08e33-96d2-4aab-9834-316deea99f0c","executionsessionLocator":"object:!tenant:defaultTenant~directory:__Root__~directory:__Temp__~directory:08c91198-3121-4bb9-b32f-49fbedcd3c6a~execution-session:aaf03abb-3461-4c5f-8223-081dd89ebed2","openClass":"java.io.File","dataFlowName":"Untitled
Data Flow","toResolve":"//Public
Documents/AnotherCollection#data-collection/other#data-directory/directory#data-directory/output.brd","permissions":"{READ,
READ_CONTAINED, EXECUTE,
ACL}","runName":"aaf03abb-3461-4c5f-8223-081dd89ebed2","nodeLocator":"object:element:a8f8df00-c728-44c8-bf60-9b5a6fa1a7ec~child:5e2089c6-1dbc-49c0-b426-2c9f82636db4","resolved":"file:/C:/Work/temp/33180/other/directory/output.brd","openOptions":"WRITE,
TRUNCATE_EXISTING, CREATE,
MAKE_PATH_DIRS_ON_CREATE"},"error":{"errorCode":"brain.io.missingRequiredPermissionForOpenAction","errorMessage":"Missing
required permission on path
'C:\\Work\\temp\\33180\\other\\directory\\output.brd' to perform operation:
WRITE. Action requires 'WRITE' permissions however only '[READ, READ_CONTAINED,
EXECUTE, ACL]' permissions seen."}} |
"auditCode":"fileOpened"
|
Indicates that a file was successfully opened. This log has the
|
"auditCode":"resolutionFailed"
|
Indicates that the referenced workspace was found, but the specific file
location could not be
resolved.
|