Leona
GitHubBlogs
  • Welcome to Leona!
  • Installation
    • Docker
    • Manual Setup
    • Log Collection
  • Tutorial
    • Quickstart
  • Configuration
    • Server Conf
    • Web Interface
    • Multi-Nodes
    • Index Model
    • Backup
    • The REST APIs
  • Security
    • Using ModSecurity
    • Logging User Activity
    • The URL Whitelist
    • Alerts And Events
  • Getting in
    • Log Sources
      • GELF
      • Beats
      • Ingest Logs Manually
        • Syslog
        • Journald
        • CEF
        • Raw or Plaintext
        • From Files
        • HTTP API
        • Application Data
      • Input
    • Sidecar
    • Forwarder
      • Forward Installation
      • Forward Configuration
  • Making sense
    • Pipelines
      • Rules
      • Functions
      • Use Cases
    • Streams
    • Enrichment
      • Lookup Tables
      • Geolocation
      • Data Adapters
  • Alerts & Notifications
    • Alerting By Example
    • Notifications
    • Leona Dashboard
  • Searching
    • Search Query Language
    • Time Frame Selector
  • Appendix
    • Support
    • License
    • Ecosystem
    • Contribute
    • Change Log
    • FAQs
Powered by GitBook
On this page
  1. Security

Logging User Activity

PreviousUsing ModSecurityNextThe URL Whitelist

Last updated 2 years ago

LeonaLog has been built using a client-server architecture model in which the user interface retrieves all data via a collection of REST APIs. Thus logging relevant user activity, in other words, an access log, is simply a matter of enabling a built-in feature. It logs all requests to the leona REST API and produces an access log augmented by additional information, like the user name, the remote address, and the user agent.

Configuring the Access Log

The Access Log is configured by adding an appender and logger to the file (log4j2.xml). The following example demonstrates the required additions on top of the normal logging configuration:

<?xml version="1.0" encoding="UTF-8"?>
<Configuration packages="org.graylog2.log4j" shutdownHook="disable">
    <Appenders>
        <!-- Simple appender that writes access log to specified file -->
        <File name="RestAccessLog" fileName="/var/log/leona/server/restaccess.log" append="true">
            <PatternLayout pattern="%d %-5p: %c - %m%n"/>
        </File>
    </Appenders>
    <Loggers>
        <!-- RestAccessLogFilter -->
        <Logger name="org.graylog2.rest.accesslog" level="debug" additivity="false">
                <AppenderRef ref="RestAccessLog" level="debug"/>
                <AppenderRef ref="STDOUT" level="info"/>
        </Logger>
    </Loggers>
</Configuration>

Log4j2 configuration