Enabling JEMH Audit Logging

Enabling JEMH Audit Logging

Coming Soon

This logging method, will only output logs for auditing purposes and should be used for long term storage with use of Logger/Splunk. This log will output for the following:

  1. When a Profile is Created, Updated and Deleted.

  2. When an incoming email is Received, Audit entity is created and when the email has been Processed with the outcome.

  3. When a notification Audit entity is created and if the outcome of processing the notification

Output to a dedicated log file recommended

Pre Jira 9.5.0 Log4j2 properties configuration

restart required

With the following configuration, Jira will create a su.log file in JIRA_HOME/log.  A Jira restart will be required to make the changes apply.

  1. Go to your JIRA_INSTALL_DIR/atlassian-jira/WEB-INF/classes/log4j.properties file

  2. Add the following lines to the bottom of the file:

    # --------------------- # JEMH LOGGING STARTS log4j.appender.JEMHAUDITFileLog=com.atlassian.jira.logging.JiraHomeAppender log4j.appender.JEMHAUDITFileLog.File=jemh-audit.log log4j.appender.JEMHAUDITFileLog.MaxFileSize=20480KB log4j.appender.JEMHAUDITFileLog.MaxBackupIndex=5 log4j.appender.JEMHAUDITFileLog.layout=org.apache.log4j.PatternLayout log4j.appender.JEMHAUDITFileLog.layout.ConversionPattern=%d %t %p [%c{4}] %m%n log4j.appender.JEMHAUDITFileLog.Threshold=DEBUG log4j.logger.com.javahollic.jira.emh.auditlogger=DEBUG, JEMHAUDITFileLog log4j.additivity.com.javahollic.jira.emh.auditlogger=false # JEMH LOGGING ENDS # --------------------
  3. Save your changes and restart Jira

  4. Logs can be found in the JIRA_INSTALL_DIR/home/log (not to be confused with JIRA_INSTALL_DIR/logs)

Changing the amount of data logged

The steps above set logging to the default level (DEBUG). This means that all extra information will be saved to the log file. To reduce the amount of logging, the level can be changed. Changing the level requires a Jira restart. The following levels can be set:

  • DEBUG (most information)

  • INFO

  • WARN

  • ERROR (least information)

Using Jira 9

Jira 9 needs the ‘log4j.appender.JEMHFileLog.layout’ to be set as:

log4j.appender.JEMHFileLog.layout=com.atlassian.logging.log4j.NewLineIndentingFilteringPatternLayout

Jira 9.5.0 and above Log4j2 XML configuration

restart required

Jira 9.5.0 has upgraded the Log4j runtime logging library to version 2. Log4j2 uses XML configuration file format. With the following configuration, Jira will create a jemh-audit.log file in JIRA_HOME/log.  A Jira restart will be required to make the changes apply.

  1. Go to your JIRA_INSTALL_DIR/atlassian-jira/WEB-INF/classes/log4j2.xml file

  2. Add the following lines above the closing Appenders tag </Appenders> (around line number 257) :

    <!-- #####################################################--> <!-- # JEMH AUDIT APPENDER STARTS--> <!-- #####################################################--> <JiraHomeAppender name="JEMHAUDITFileLog" fileName="jemh-audit.log" filePattern="jemh-audit.log.%i"> <PatternLayout alwaysWriteExceptions="false"> <Pattern> %d %t %p [%c{4}] %m%n </Pattern> </PatternLayout> <Policies> <SizeBasedTriggeringPolicy size="20480KB"/> </Policies> <DefaultRolloverStrategy fileIndex="min" max="5"/> </JiraHomeAppender> <!-- #####################################################--> <!-- # JEMH AUDIT APPENDER ENDS--> <!-- #####################################################-->
  3. Add the following lines above the closing Loggers tag </Loggers> (at the bottom, around line number 839) :

    <!-- #####################################################--> <!-- # JEMH AUDIT LOGGER REF STARTS--> <!-- #####################################################--> <Logger name="com.javahollic.jira.emh.auditlogger" level="DEBUG" additivity="false"> <AppenderRef ref="JEMHAUDITFileLog"/> </Logger> <!-- #####################################################--> <!-- # JEMH AUDIT LOGGER REF ENDS--> <!-- #####################################################-->

Output to the existing Atlassian log file

no restart required

Whilst we recommend the first method as it outputs to a separate log file, if restarting Jira is not an option it can still be enabled temporarily.

  1. Go to Jira Administration > System > Logging and profiling

  2. Under Default Loggers, select configure logging level for another package

  3. For Package name enter com.javahollic.jira.emh.auditlogger

  4. For Logging Level select DEBUG

  5. Press Add to save

  6. JEMH Audit log output will now be added to Jira's own atlassian-jira.log file

Example Log output

Below is some example log output show the formatting of the log messages and the type of log messages that are created:

... user: admin INFO [jira.emh.auditlogger.JEMHAuditLogger] PROFILE_DELETED : Profile (5) was deleted by JIRAUSER10000 ... user: admin INFO [jira.emh.auditlogger.JEMHAuditLogger] PROFILE_CREATED : Profile (6) was created by JIRAUSER10000 ... user: admin INFO [jira.emh.auditlogger.JEMHAuditLogger] PROFILE_UPDATED : Profile (6) was updated by JIRAUSER10000, creating revision 2 ... user: admin INFO [jira.emh.auditlogger.JEMHAuditLogger] INCOMING_MAIL_RECEIVED : Email sent by admin@localhost has been successfully downloaded and will be processed by Profile (6), Audit Event with Id (43) has been created ... user: admin INFO [jira.emh.auditlogger.JEMHAuditLogger] NOTIFICATION_EVENT_CREATED : Notification Audit Entry (Id: 3) created for Event [1], on SOF-3 triggered by JIRAUSER10000 ... user: admin INFO [jira.emh.auditlogger.JEMHAuditLogger] NOTIFICATION_ENQUEUED : Enqueued JIRA user mail SUCCESS for event [1] on issue SOF-3 for admin@localhost ... user: admin INFO [jira.emh.auditlogger.JEMHAuditLogger] INCOMING_MAIL_SUCCESSFULLY_PROCESSED : Mail related to Audit (43) has been successfully processed by Profile (6), Created Issues : SOF-3 ... user: admin INFO [jira.emh.auditlogger.JEMHAuditLogger] INCOMING_MAIL_SUCCESSFULLY_PROCESSED : Mail related to Audit (43) has been successfully processed by Profile (6), Created Issues : SOF-3 ... user: admin INFO [jira.emh.auditlogger.JEMHAuditLogger] INCOMING_MAIL_RECEIVED : Email sent by randomSender@localhost has been successfully downloaded and will be processed by Profile (1), Audit Event with Id (44) has been created ... user: admin INFO [jira.emh.auditlogger.JEMHAuditLogger] NOTIFICATION_EVENT_CREATED : Notification Audit Entry (Id: 4) created for Event [1], on SOF-4 triggered by JIRAUSER10000 ... user: admin INFO [jira.emh.auditlogger.JEMHAuditLogger] NOTIFICATION_ENQUEUED : Enqueued NON-JIRA mail for event #1 on issue SOF-4; To: [randomSender@localhost], Cc: [], Bcc: [] ... user: admin INFO [jira.emh.auditlogger.JEMHAuditLogger] NOTIFICATION_ENQUEUED : Enqueued JIRA user mail SUCCESS for event [1] on issue SOF-4 for admin@localhost ... user: admin INFO [jira.emh.auditlogger.JEMHAuditLogger] INCOMING_MAIL_SUCCESSFULLY_PROCESSED : Mail related to Audit (44) has been successfully processed by Profile (1), Created Issues : SOF-4 ... user: admin INFO [jira.emh.auditlogger.JEMHAuditLogger] INCOMING_MAIL_RECEIVED : Email sent by randomSender@localhost has been successfully downloaded and will be processed by Profile (1), Audit Event with Id (46) has been created ... user: admin INFO [jira.emh.auditlogger.JEMHAuditLogger] NOTIFICATION_ENQUEUED : Enqueued Forward email in html to admin@localhost ... user: admin INFO [jira.emh.auditlogger.JEMHAuditLogger] INCOMING_MAIL_UNSUCCESSFULLY_PROCESSED : Mail related to Audit (46) was unsuccessfully processed by Profile (1), resulted in a FORWARDED Outcome and a STOPPED Status ... user: admin INFO [jira.emh.auditlogger.JEMHAuditLogger] INCOMING_MAIL_UNSUCCESSFULLY_PROCESSED : Mail related to Audit (46) was unsuccessfully processed by Profile (1), resulted in a INTERNAL_ERROR Outcome and a NOT_PROCESSED Status