Hi,
Iam trying to capture user activity logs to the passbolt app container logs, something like below
User john.doe logged in
Resource prod accessed by john.doe
Resource prod was shared by john.doe
User X logged in
Resource Y accessed by X
After some research and based on online suggestions, tried adding below environment variables to my docker-compose file, but unable to get the expected result.
PASSBOLT_PLUGINS_ACTIONLOG_ENABLED: “true”
PASSBOLT_PLUGINS_ACTIONLOG_LOG_ENABLED: “true”
PASSBOLT_LOG_LEVEL: info
PASSBOLT_LOG_SCOPES: “actions”
LOG_ACTION_LOGS_ENABLED: “true”
LOG_ACTION_LOGS_ON_FILE_ENABLED: “true”
LOG_ACTION_LOGS_ON_FILE_PATH: “/var/log/passbolt/”
LOG_ACTION_LOGS_ON_FILE_FORMATTER: “App\Log\Formatter\HumanReadableFormatter”
LOG_ACTION_LOGS_ON_FILE_FILE: “action-logs.log”
LOG_ACTION_LOGS_ON_SYSLOG_ENABLED: “false”
So thought of checking in passbolt community forum, is there a way to achieve this to get the user activity logs captured in app container logs, the idea is to get those logs forwarded to SIEM logging at later stage for audit purposes.
Also as per my research i have observed that the action logs are captured in DB separately under action_logs table, and i need to use sql queries to get those identified and then copy the query results to a log file using a shell script.
SELECT
al.created,
a.name AS action,
u.username,
al.context
FROM action_logs al
LEFT JOIN actions a ON al.action_id = a.id
LEFT JOIN users u ON al.user_id = u.id
ORDER BY al.created DESC
LIMIT 10;
Can someone guide/suggest on this, is this the right way writing a sql and then capture the action logs to the app container to achieve the task or is there any other way to achieve this to get the action logs captured to app container logs.
Thanks,
Prasd