diff --git a/hetu-docs/en/admin/audit-log.md b/hetu-docs/en/admin/audit-log.md new file mode 100644 index 000000000..ebd22818f --- /dev/null +++ b/hetu-docs/en/admin/audit-log.md @@ -0,0 +1,46 @@ +# Audit Log + +openLooKeng audit logging functionality is a custom event listener that is invoked for query creation and query completion (success or failure) +An audit log contains the following information: + +1. time when an event occurs +2. user ID +3. address or identifier of the access initiator +4. event type (operation) +5. name of accessed resource +6. result of an event + +In an openLooKeng cluster, only a single event listener plugin can be active at a time. + +## Implementation + +Audit logging is an implementation of `io.prestosql.spi.eventlistener.EventListener` in `HetuListener` plugin. Methods overwritten include `AuditEventLogger#onQueryCreatedEvent` +and `AuditEventLogger#onQueryCompletedEvent` + +## Configuration +To enable audit logging feature, the following configs must be present in `etc/event-listener.config` for this feature to be active. + +``` +hetu.event.listener.type=AUDIT +hetu.event.listener.listen.query.creation=true +hetu.event.listener.listen.query.completion=true +``` + +Other audit logging properties include: +`hetu.event.listener.audit.file`: Optional Property to define absolute file path for the audit file. Ensure the process running the openLooKeng server has write access to this directory. + +`hetu.event.listener.audit.filecount`: Optional property to define the number of files to use + +`hetu.event.listener.audit.limit`: Optional property to define the maximum number of bytes to write to any one file + +Example configuration file: + +``` properties +event-listener.name=hetu-listener +hetu.event.listener.type=AUDIT +hetu.event.listener.listen.query.creation=true +hetu.event.listener.listen.query.completion=true +hetu.event.listener.audit.file=/var/log/hetu/hetu-audit.log +hetu.event.listener.audit.filecount=1 +hetu.event.listener.audit.limit=100000 +``` diff --git a/hetu-listener/src/main/java/io/hetu/core/eventlistener/HetuEventListenerConfig.java b/hetu-listener/src/main/java/io/hetu/core/eventlistener/HetuEventListenerConfig.java index e7b98e1ab..c15053c49 100644 --- a/hetu-listener/src/main/java/io/hetu/core/eventlistener/HetuEventListenerConfig.java +++ b/hetu-listener/src/main/java/io/hetu/core/eventlistener/HetuEventListenerConfig.java @@ -192,7 +192,7 @@ public class HetuEventListenerConfig */ @Config("hetu.event.listener.audit.file") @ConfigDescription( - "Optional property to define absolute file path for the logger. If not set, logger will use the default " + "Optional property to define absolute file path for the audit logger. If not set, audit logger will use the default " + "log file") public HetuEventListenerConfig setAuditFile(String auditFile) { diff --git a/presto-main/etc/event-listener.properties b/presto-main/etc/event-listener.properties index a28139a05..22f04273f 100644 --- a/presto-main/etc/event-listener.properties +++ b/presto-main/etc/event-listener.properties @@ -2,10 +2,9 @@ event-listener.name=hetu-listener hetu.event.listener.type=AUDIT hetu.event.listener.listen.query.creation=true hetu.event.listener.listen.query.completion=true -hetu.event.listener.listen.split.completion=true #hetu.event.listener.logger.file=/tmp/hetu-events.log #hetu.event.listener.logger.count=1 #hetu.event.listener.logger.limit=0 -hetu.event.listener.audit.file=/tmp/hetu-audit.log +hetu.event.listener.audit.file=/var/log/hetu/hetu-audit.log hetu.event.listener.audit.filecount=1 -hetu.event.listener.audit.limit=0 \ No newline at end of file +hetu.event.listener.audit.limit=100000 \ No newline at end of file