Added audit log bean/constant in IdP 3.3

[Michael A Grady]

> On Sep 6, 2017, at 2:22 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:
> 
>> 
>> Isn't the %T in the audit.xml formatting string controlling that first timestamp? Isn't that the IdP itself?
> 
> You're right, and it's a bug. It's handled separately from all the field population logic and it isn't routed through the date logic the other fields are.

And I'll confirm that a workaround for that today is to:

modify the IdP's conf/audit.xml file to remove the '%T' from the beginning of the pattern, so that that form of the timestamp is not included in the log line
and then add a timestamp to the front of that message in the IdP's conf/logback.xml file, where you can control the timezone. 
So this line in audit.xml:
<entry key="Shibboleth-Audit" value="%T|%b|%I|%SP|%P|%IDP|%bb|%III|%u|%ac|%attr|%n|%i|" />
becomes:
<entry key="Shibboleth-Audit" value="|%b|%I|%SP|%P|%IDP|%bb|%III|%u|%ac|%attr|%n|%i|" />

and then, in the section of logback.xml that starts with this:

<!-- Audit log. -->
<appender name="IDP_AUDIT" class="ch.qos.logback.core.rolling.RollingFileAppender">
you change this following line:

           <Pattern>%msg%n</Pattern>
to be something like:

        <Pattern>%date{"yyyy-MM-dd'T'HH:mm:ss,SSSZZ", America/Los_Angeles}%msg%n</Pattern>
Of course, you can vary what is in that timestamp, whether you want micoseconds or not, etc.


--
Michael A. Grady
IAM Architect, Unicon, Inc.



-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170906/8b67c9a4/attachment-0001.html>