Guidance on F-TICKS logging in Idp v3 to syslog

[Cantor, Scott]

On 8/26/15, 2:56 PM, "dev on behalf of Chris Phillips" <dev-bounces at shibboleth.net on behalf of Chris.Phillips at canarie.ca> wrote:

>I'm looking at https://issues.shibboleth.net/jira/browse/IDP-501  and trying to understand how and where I need to apply the 'Entry' information that is described in the thread by Scott C.

That's about the hashing of one of the fields, that's a fairly exotic use case. That wasn't the essence of the feature I was adding. Getting into that is much more complicated, that's changing the actual field extractors that populate the audit records.

>I have this in the logback.xml as a skeleton for the moment and incomplete:

You have to apply the appender to an audit category (like the default one is).

<logger name="F-TICKS-Audit" level="ALL">
	<appender-ref ref="SYSLOG_AUDIT"/>
    </logger>


Then you need to define an audit formatting string and map that logger name to it in conf/audit.xml in the shibboleth.AuditFormattingMap bean.

https://wiki.shibboleth.net/confluence/display/IDP30/AuditLoggingConfiguration

>An example for logback.xml configuration would be helpful or explanation on where to take the items in the ticket and implement them would be too.

The only thing in logback.xml is the appender and the logger pair, ordinarily. Unless you want to use logback's other features in some way.

I didn't add anything for F-TICKS, I just made the auditing configurable and able to multiplex, so you can route the same events to any number of audit categories/formats at the same time.

-- Scott