Log4j audit logger

Search Guard
1

I am trying to configure separate audit log file, how should I configure log4j logger name? Root logger, without this custom part works and audit logs appear in regular log file, but we want to keep it separate.

logger.sgaudit.name = com.floragunn.searchguard.auditlog
logger.sgaudit.level = info
logger.sgaudit.appenderRef.audit_rolling.ref = audit_rolling
logger.sgaudit.additivity = false

current output of audit file:
{“type”:“audit”, “timestamp”:“2021-11-25T11:29:58,018+0100”}
{“type”:“audit”, “timestamp”:“2021-11-25T11:29:58,021+0100”}
{“type”:“audit”, “timestamp”:“2021-11-25T11:29:58,021+0100”}
{“type”:“audit”, “timestamp”:“2021-11-25T11:29:58,021+0100”}

2

My mistake, appender audit_rolling had misconfigured layout pattern, so after I fixed it, my json logs started to appear in the audit log.

elasticsearch.yml:

searchguard.audit.type: "log4j"
searchguard.audit.config.log4j.logger_name: sgaudit
searchguard.audit.config.log4j.level: INFO

log4j:

logger.sgaudit.name = sgaudit
logger.sgaudit.appenderRef.audit_rolling.ref = audit_rolling
logger.sgaudit.additivity = false
3

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.