<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<html>
<body link="#355491" alink="#4262a1" vlink="#355491" style="background: #e2e2e2; margin: 0; padding: 20px;">
<div>
<table cellpadding="0" bgcolor="#FFFFFF" border="0" cellspacing="0" style="border: 1px solid #dadada; margin-bottom: 30px; width: 100%; -moz-border-radius: 6px; -webkit-border-radius: 6px;">
<tbody>
<tr>
<td>
<table border="0" cellpadding="0" cellspacing="0" bgcolor="#FFFFFF" style="border: solid 2px #ccc; background: #dadada; width: 100%; -moz-border-radius: 6px; -webkit-border-radius: 6px;">
<tbody>
<tr>
<td bgcolor="#000000" valign="middle" height="58px" style="border-bottom: 1px solid #ccc; padding: 20px; -moz-border-radius-topleft: 3px; -moz-border-radius-topright: 3px; -webkit-border-top-right-radius: 5px; -webkit-border-top-left-radius: 5px;">
<h1 style="color: #333333; font: bold 22px Arial, Helvetica, sans-serif; margin: 0; display: block !important;">
<!-- To have a header image/logo replace the name below with your img tag -->
<!-- Email clients will render the images when the message is read so any image -->
<!-- must be made available on a public server, so that all recipients can load the image. -->
<a href="https://community.jboss.org/index.jspa" style="text-decoration: none; color: #E1E1E1">JBoss Community</a></h1>
</td>
</tr>
<tr>
<td bgcolor="#FFFFFF" style="font: normal 12px Arial, Helvetica, sans-serif; color:#333333; padding: 20px; -moz-border-radius-bottomleft: 4px; -moz-border-radius-bottomright: 4px; -webkit-border-bottom-right-radius: 5px; -webkit-border-bottom-left-radius: 5px;"><h3 style="margin: 10px 0 5px; font-size: 17px; font-weight: normal;">
Audit Logging Design Notes
</h3>
<span style="margin-bottom: 10px;">
created by <a href="https://community.jboss.org/people/brian.stansberry">Brian Stansberry</a> in <i>JBoss AS 7 Development</i> - <a href="https://community.jboss.org/docs/DOC-18812">View the full document</a>
</span>
<hr style="margin: 20px 0; border: none; background-color: #dadada; height: 1px;">
<div class="jive-rendered-content"><p>Design notes for work on <a class="jive-link-external-small" href="https://issues.jboss.org/browse/AS7-444">https://issues.jboss.org/browse/AS7-444</a>.</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p>My current development topic branch for this is <a class="jive-link-external-small" href="https://github.com/bstansberry/jboss-as/tree/AS7-444">https://github.com/bstansberry/jboss-as/tree/AS7-444</a>. (Note that this is a personal branch; I make no guarantees not to change its commit history.)  This branch is based on work previously done by John Bailey.</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p>Design notes:</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p>1) Processing location in OperationContext</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p>a) when done</p><p>b) when decision to not proceed is made in OperationContext</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p>2) Log record format:</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p>a) date</p><p>b) read-only?</p><p>c) boot?</p><p>d) (if boot) version (as string???)</p><p>e) uuid</p><p>f) model hash length</p><p>g) model hash</p><p>h) overall hash length</p><p>i) overall hash</p><p>j) result action</p><p>k) operation</p><p>l) userid</p><p>m) length of a->j (scan from end to last boot during validation; alternative is to write the length first and scan from beginning to last boot)</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p>3) Index record format:</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p>a) overall hash length</p><p>b) overall hash</p><p>c) model hash length</p><p>d) model hash</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p>4) Mgmt operations</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p>a) truncate (back to last boot)</p><p> i) don't discard previous; just write under a different file name</p><p>b) read log (params -- from (default 0); batch-size (default 20; -1 means all))</p><p>c) validate log</p><p>d) config changes</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p>5) Validation:</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p>a) compare persisted model hash to current model</p><p>b) scan back through log to last config-file-modified boot or version-change boot. We stop at version-change boot to avoid spurious validation problems resulting from changes in model construction across versions </p><p>c) recreate by re-running ops</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p>-- validation problems</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p>a) need to verify model hash at each stage -- special controller that ignores all runtime ops</p><p>  i) problem -- how to recreate domain ops involving remote slaves that don't exist?</p><p>  ii) this "special controller" could end up duplicating a lot of logic just for validation</p><p>b) reads and runtime ops cannot be verified against model; it can only be confirmed that their hash is consistent with subsequent hashes in the log. Tamper resistant as modification would require modifying all subsequent log entries, but not tamper proof as this could be done.</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p>6) Domain mode</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p>a) tracking requests from master to slaves</p><p>apply a uuid to requests</p><p>-- as a header</p><p>include uuid in log record</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p>b) detecting host.xml config changes at boot</p><p>problem -- can't detect host.xml config changes at boot, as model changes may be due to domain.xml stuff coming from the master</p><p>so, independent domain and host logging</p><p>but, what about non-model affecting ops? log twice?</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p>c) domain logging on slaves? only if --backup-dc is set?</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p>d) remote-slave-only logging on master?</p><p>yes, to maintain a complete record of what was done</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p>7) Non-model-affecting ops</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p>a) re-calculating the model hash for all such ops is too expensive</p><p>b) store the hash(es) in the ModelController along with the model</p><p>c) provide the hash along with the model to OperationContext</p><p>d) persisters recalc hashes and return them</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p>8) Config</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p>a) <audit-log> element</p><p>b) part of <management> section</p><p>c) resource is /core-service=audit-log</p><p>d) attributes</p><p> i) path</p><p> ii) relative-to</p><p> iii) log-read-only?</p><p> iv) daily-rolling??? (hassle; tempting to defer to later release but it's probably necessary immediately)</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p>9) Other issues</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p>a) disable logging overhead for dev scenarios</p><p>  i) not sure how to disable it during initial boot (until whatever config element that turns it on/off is read) -- probably maintain log data in memory and only write on last boot op</p><p>b) parallel boot handlers should not log</p><p>c) fluctuating model hashes</p><p>  i) if op took the controller lock, that lock ensures proper ordering of model hashes</p><p>  ii) if op does not take controller lock (reads) earlier model hashes can intermix with later -- validation needs to account for this</p></div>
<div style="background-color: #f4f4f4; padding: 10px; margin-top: 20px;">
<p style="margin: 0;">Comment by <a href="https://community.jboss.org/docs/DOC-18812">going to Community</a></p>
<p style="margin: 0;">Create a new document in JBoss AS 7 Development at <a href="https://community.jboss.org/choose-container!input.jspa?contentType=102&containerType=14&container=2225">Community</a></p>
</div></td>
</tr>
</tbody>
</table>
</td>
</tr>
</tbody>
</table>
</div>
</body>
</html>