close

Filter

Close X
loading table of contents...

Studio Developer Manual / Version 2010

Table Of Contents

8.5 Logging

In order to support the detection of attacks and analysis of incidents, authentication failures as well as successful authentication events are logged by CoreMedia Studio. Example 8.6, “Example Output” shows some typical log entries. 

2015-07-07 13:43:30 [WARN]
  Http401AuthenticationFailureHandler [] -
  Failed login - User: Rick,
  IP: 127.0.0.1 (http-bio-8080-exec-8)
2015-07-07 13:51:11 [INFO]
  Http200AuthenticationSuccessHandler [] -
  Successful login - User: Rick (coremedia:///cap/user/8),
  IP: 127.0.0.1 (http-bio-8080-exec-6)

Example 8.6. Example Output


Marker Hierarchy

To get a better overview of security events you might want to duplicate or even redirect such events to extra access logs. To do so CoreMedia Studio uses a SLF4j Marker hierarchy

  • coremedia - root marker

    • security - security related entries

      • authentication - for example login or logout events

      • authorization - events such as missing rights for certain actions

Example 8.7. Marker Hierarchy


Filtering

Filtering log entries is described in Logback's Online Documentation, Chapter 7: Filters. To redirect or duplicate security related log events you will define a filter for an appender using the JaninoEventEvaluator. Mind that you will require a runtime dependency on org.codehaus.janino:janino. 

    
<appender name="access"
          class="ch.qos.logback.core.FileAppender">
  <filter class="ch.qos.logback.core.filter.EvaluatorFilter">
    <evaluator>
      <expression><![CDATA[
        marker != null && marker.contains("authentication");
        ]]></expression>
    </evaluator>
    <OnMismatch>DENY</OnMismatch>
    <OnMatch>ACCEPT</OnMatch>
  </filter>
  <encoder><pattern>${log.pattern}</pattern></encoder>
  <file>access.log</file>
</appender>

Example 8.8. Configure Access Log


Example 8.8, “Configure Access Log” shows an example of how to log authentication events to a file named access.log. marker refers to a variable exported by JaninoEventEvaluator before parsing. Only authentication events will be logged here. 

    
<appender name="security"
          class="ch.qos.logback.core.FileAppender">
  <filter class="ch.qos.logback.core.filter.EvaluatorFilter">
    <evaluator>
      <expression><![CDATA[
        marker != null && marker.contains("security");
        ]]></expression>
    </evaluator>
    <OnMismatch>DENY</OnMismatch>
    <OnMatch>ACCEPT</OnMatch>
  </filter>
  <encoder><pattern>${log.pattern}</pattern></encoder>
  <file>security.log</file>
</appender>

Example 8.9. Configure Security Log


Example 8.9, “Configure Security Log” shows an example how to log any security related events to a file named security.log. As security contains authentication, also authentication log entries will go here. 

    
<appender name="default"
          class="ch.qos.logback.core.FileAppender">
  <filter class="ch.qos.logback.core.filter.EvaluatorFilter">
    <evaluator>
      <expression><![CDATA[
        marker != null && marker.contains("security");
        ]]></expression>
    </evaluator>
    <OnMismatch>NEUTRAL</OnMismatch>
    <OnMatch>DENY</OnMatch>
  </filter>
  <encoder><pattern>${log.pattern}</pattern></encoder>
  <file>default.log</file>
</appender>

Example 8.10. Configure Default Log


Example 8.10, “Configure Default Log” shows an example for an appender which ignores any security related log entries. You might want to use this approach to hide login/logout entries from unauthorized personal. 

    
<logger name="com.coremedia"
        additivity="false"
        level="info">
  <appender-ref ref="security"/>
  <appender-ref ref="access"/>
  <appender-ref ref="default"/>
</logger>

Example 8.11. Configure Logger


Example 8.10, “Configure Default Log” eventually binds all appenders to the given logger. 

    
<turboFilter class="ch.qos.logback.classic.turbo.MarkerFilter">
  <Marker>security</Marker>
  <OnMatch>DENY</OnMatch>
</turboFilter>

Example 8.12. Suppress Security Logging


Example 8.12, “Suppress Security Logging” is just another example in case you completely want to suppress security log entries using so called turbo filters.

Search Results

Table Of Contents