Enabling JEMH Audit Logging
Coming Soon
This logging method, will only output logs for auditing purposes and should be used for long term storage with use of Logger/Splunk. This log will output for the following:
When a Profile is Created, Updated and Deleted.
When an incoming email is Received, Audit entity is created and when the email has been Processed with the outcome.
When a notification Audit entity is created and if the outcome of processing the notification
Output to a dedicated log file recommended
Pre Jira 9.5.0 Log4j2 properties configuration
restart required
With the following configuration, Jira will create a su.log
file in JIRA_HOME/log
. A Jira restart will be required to make the changes apply.
Go to your
JIRA_INSTALL_DIR/atlassian-jira/WEB-INF/classes/log4j.properties
fileAdd the following lines to the bottom of the file:
# --------------------- # JEMH LOGGING STARTS log4j.appender.JEMHAUDITFileLog=com.atlassian.jira.logging.JiraHomeAppender log4j.appender.JEMHAUDITFileLog.File=jemh-audit.log log4j.appender.JEMHAUDITFileLog.MaxFileSize=20480KB log4j.appender.JEMHAUDITFileLog.MaxBackupIndex=5 log4j.appender.JEMHAUDITFileLog.layout=org.apache.log4j.PatternLayout log4j.appender.JEMHAUDITFileLog.layout.ConversionPattern=%d %t %p [%c{4}] %m%n log4j.appender.JEMHAUDITFileLog.Threshold=DEBUG log4j.logger.com.javahollic.jira.emh.auditlogger=DEBUG, JEMHAUDITFileLog log4j.additivity.com.javahollic.jira.emh.auditlogger=false # JEMH LOGGING ENDS # --------------------
Save your changes and restart Jira
Logs can be found in the
JIRA_INSTALL_DIR/home/log
(not to be confused withJIRA_INSTALL_DIR/logs
)
Changing the amount of data logged
The steps above set logging to the default level (DEBUG). This means that all extra information will be saved to the log file. To reduce the amount of logging, the level can be changed. Changing the level requires a Jira restart. The following levels can be set:
DEBUG (most information)
INFO
WARN
ERROR (least information)
Using Jira 9
Jira 9 needs the ‘log4j.appender.JEMHFileLog.layout’ to be set as:
log4j.appender.JEMHFileLog.layout=com.atlassian.logging.log4j.NewLineIndentingFilteringPatternLayout
Jira 9.5.0 and above Log4j2 XML configuration
restart required
Jira 9.5.0 has upgraded the Log4j runtime logging library to version 2. Log4j2 uses XML configuration file format. With the following configuration, Jira will create a jemh-audit.log
file in JIRA_HOME/log
. A Jira restart will be required to make the changes apply.
Go to your
JIRA_INSTALL_DIR/atlassian-jira/WEB-INF/classes/log4j2.xml
fileAdd the following lines above the closing Appenders tag
</Appenders>
(around line number 257) :<!-- #####################################################--> <!-- # JEMH AUDIT APPENDER STARTS--> <!-- #####################################################--> <JiraHomeAppender name="JEMHAUDITFileLog" fileName="jemh-audit.log" filePattern="jemh-audit.log.%i"> <PatternLayout alwaysWriteExceptions="false"> <Pattern> %d %t %p [%c{4}] %m%n </Pattern> </PatternLayout> <Policies> <SizeBasedTriggeringPolicy size="20480KB"/> </Policies> <DefaultRolloverStrategy fileIndex="min" max="5"/> </JiraHomeAppender> <!-- #####################################################--> <!-- # JEMH AUDIT APPENDER ENDS--> <!-- #####################################################-->
Add the following lines above the closing Loggers tag
</Loggers>
(at the bottom, around line number 839) :<!-- #####################################################--> <!-- # JEMH AUDIT LOGGER REF STARTS--> <!-- #####################################################--> <Logger name="com.javahollic.jira.emh.auditlogger" level="DEBUG" additivity="false"> <AppenderRef ref="JEMHAUDITFileLog"/> </Logger> <!-- #####################################################--> <!-- # JEMH AUDIT LOGGER REF ENDS--> <!-- #####################################################-->
Output to the existing Atlassian log file
no restart required
Whilst we recommend the first method as it outputs to a separate log file, if restarting Jira is not an option it can still be enabled temporarily.
Go to Jira Administration > System > Logging and profiling
Under Default Loggers, select configure logging level for another package
For Package name enter
com.javahollic.jira.emh.auditlogger
For Logging Level select
DEBUG
Press Add to save
JEMH Audit log output will now be added to Jira's own
atlassian-jira.log
file
Example Log output
Below is some example log output show the formatting of the log messages and the type of log messages that are created:
... user: admin INFO [jira.emh.auditlogger.JEMHAuditLogger] PROFILE_DELETED : Profile (5) was deleted by JIRAUSER10000
... user: admin INFO [jira.emh.auditlogger.JEMHAuditLogger] PROFILE_CREATED : Profile (6) was created by JIRAUSER10000
... user: admin INFO [jira.emh.auditlogger.JEMHAuditLogger] PROFILE_UPDATED : Profile (6) was updated by JIRAUSER10000, creating revision 2
... user: admin INFO [jira.emh.auditlogger.JEMHAuditLogger] INCOMING_MAIL_RECEIVED : Email sent by admin@localhost has been successfully downloaded and will be processed by Profile (6), Audit Event with Id (43) has been created
... user: admin INFO [jira.emh.auditlogger.JEMHAuditLogger] NOTIFICATION_EVENT_CREATED : Notification Audit Entry (Id: 3) created for Event [1], on SOF-3 triggered by JIRAUSER10000
... user: admin INFO [jira.emh.auditlogger.JEMHAuditLogger] NOTIFICATION_ENQUEUED : Enqueued JIRA user mail SUCCESS for event [1] on issue SOF-3 for admin@localhost
... user: admin INFO [jira.emh.auditlogger.JEMHAuditLogger] INCOMING_MAIL_SUCCESSFULLY_PROCESSED : Mail related to Audit (43) has been successfully processed by Profile (6), Created Issues : SOF-3
... user: admin INFO [jira.emh.auditlogger.JEMHAuditLogger] INCOMING_MAIL_SUCCESSFULLY_PROCESSED : Mail related to Audit (43) has been successfully processed by Profile (6), Created Issues : SOF-3
... user: admin INFO [jira.emh.auditlogger.JEMHAuditLogger] INCOMING_MAIL_RECEIVED : Email sent by randomSender@localhost has been successfully downloaded and will be processed by Profile (1), Audit Event with Id (44) has been created
... user: admin INFO [jira.emh.auditlogger.JEMHAuditLogger] NOTIFICATION_EVENT_CREATED : Notification Audit Entry (Id: 4) created for Event [1], on SOF-4 triggered by JIRAUSER10000
... user: admin INFO [jira.emh.auditlogger.JEMHAuditLogger] NOTIFICATION_ENQUEUED : Enqueued NON-JIRA mail for event #1 on issue SOF-4; To: [randomSender@localhost], Cc: [], Bcc: []
... user: admin INFO [jira.emh.auditlogger.JEMHAuditLogger] NOTIFICATION_ENQUEUED : Enqueued JIRA user mail SUCCESS for event [1] on issue SOF-4 for admin@localhost
... user: admin INFO [jira.emh.auditlogger.JEMHAuditLogger] INCOMING_MAIL_SUCCESSFULLY_PROCESSED : Mail related to Audit (44) has been successfully processed by Profile (1), Created Issues : SOF-4
... user: admin INFO [jira.emh.auditlogger.JEMHAuditLogger] INCOMING_MAIL_RECEIVED : Email sent by randomSender@localhost has been successfully downloaded and will be processed by Profile (1), Audit Event with Id (46) has been created
... user: admin INFO [jira.emh.auditlogger.JEMHAuditLogger] NOTIFICATION_ENQUEUED : Enqueued Forward email in html to admin@localhost
... user: admin INFO [jira.emh.auditlogger.JEMHAuditLogger] INCOMING_MAIL_UNSUCCESSFULLY_PROCESSED : Mail related to Audit (46) was unsuccessfully processed by Profile (1), resulted in a FORWARDED Outcome and a STOPPED Status
... user: admin INFO [jira.emh.auditlogger.JEMHAuditLogger] INCOMING_MAIL_UNSUCCESSFULLY_PROCESSED : Mail related to Audit (46) was unsuccessfully processed by Profile (1), resulted in a INTERNAL_ERROR Outcome and a NOT_PROCESSED Status