[SERVER-38642] Support projection of audit messages Created: 14/Dec/18 Updated: 14/Feb/23 |
|
| Status: | Investigating |
| Project: | Core Server |
| Component/s: | Logging |
| Affects Version/s: | None |
| Fix Version/s: | None |
| Type: | Improvement | Priority: | Major - P3 |
| Reporter: | Kai Orend | Assignee: | Salman Baset |
| Resolution: | Unresolved | Votes: | 3 |
| Labels: | None | ||
| Remaining Estimate: | Not Specified | ||
| Time Spent: | Not Specified | ||
| Original Estimate: | Not Specified | ||
| Participants: | |
| Case: | (copied to CRM) |
| Description |
|
Some customers have quite big audit messages, as they can contain information provided by external authentication systems, like LDAP/Active Directory. Some audit analysis systems are truncating big messages, making them unusable if they are too big. Adding the ability to select the included fields in the audit messages, for instance by allowing users to define a projection on them, would not only fix this issue, but would also allow to redact audit messages where needed. It would certainly be useful if these projections could depend on the type of message and on the content of other fields. |
| Comments |
| Comment by Salman Baset [ 15/Jul/21 ] |
|
jack.alder wondering if we have recommended using regular audit logs instead of syslogs to avoid truncation. |