Where can I see result fo Security Event Logging
Hello.
On PRPC 7.3, security event configuration landing page, we can configure system to capture event about log outs, successful logins, open a work class or search quires, change to workbasket role settings etc. Once I configured list of events to capture and click submit. Where I am supposed to see those logging events ?
I don't see system created any specific logging files for this, or is there a OOTB report definition that I can run to pull those information. or it is just print on some log file?
Thanks
Tom
***Edited by Moderator Marissa to update categories***
Accepted Solution
Pegasystems Inc.
CA
Further research shows the Security event audit information shows in SecurityEvent log file, to enable this we need to update the OOTB prlog4j2.xml file. PRPC 7.3 prlog4j2.xml file is replacing the prlogging.xml, but the OOTB prlog42j.xml only provided PRPC Log, alert log and Json log.
Below is an sample prlog4j2.xml that we can use to extend the logging to include BIX, SecurityAlert, SecurityEvent logging
<?xml version="1.0" encoding="UTF-8"?>
<Configuration status="WARN">
<Appenders>
Further research shows the Security event audit information shows in SecurityEvent log file, to enable this we need to update the OOTB prlog4j2.xml file. PRPC 7.3 prlog4j2.xml file is replacing the prlogging.xml, but the OOTB prlog42j.xml only provided PRPC Log, alert log and Json log.
Below is an sample prlog4j2.xml that we can use to extend the logging to include BIX, SecurityAlert, SecurityEvent logging
<?xml version="1.0" encoding="UTF-8"?>
<Configuration status="WARN">
<Appenders>
<Console name="CONSOLE" target="SYSTEM_OUT">
<PatternLayout pattern="%d [%20.20t] [%10.10X{pegathread}] [%20.20X{tenantid}] [%20.20X{app}] (%30.30c{3}) %-5p %X{stack} %X{userid} - %m%n"/>
<Filters>
<!--Deny message logged under ALERT log level-->
<ThresholdFilter level="ALERT" onMatch="DENY" onMismatch="NEUTRAL"/>
</Filters>
</Console>
<RollingRandomAccessFile name="PEGA" fileName="${sys:pega.logdir}/PegaRULES.log" filePattern="${sys:pega.logdir}/PegaRULES-%d{MM-dd-yyyy}-%i.log.gz">
<PatternLayout>
<Pattern>%d [%20.20t] [%10.10X{pegathread}] [%20.20X{tenantid}] [%20.20X{app}] (%30.30c{3}) %-5p %X{stack} %X{userid} - %m%n</Pattern>
</PatternLayout>
<Filters>
<!--Deny message logged under ALERT log level-->
<ThresholdFilter level="ALERT" onMatch="DENY" onMismatch="NEUTRAL"/>
</Filters>
<Policies>
<TimeBasedTriggeringPolicy />
<SizeBasedTriggeringPolicy size="250 MB"/>
</Policies>
<DefaultRolloverStrategy max="20"/>
</RollingRandomAccessFile>
<!-- RollingRandomAccessFile Appender for pegarules PERFORMANCE Alert logs -->
<RollingRandomAccessFile name="ALERT" fileName="${sys:pega.logdir}/PegaRULES-ALERT.log" filePattern="${sys:pega.logdir}/PegaRULES-ALERT-%d{MM-dd-yyyy}-%i.log.gz">
<PatternLayout>
<Pattern>%m%n</Pattern>
</PatternLayout>
<ThreadContextMapFilter onMatch="DENY" onMismatch="NEUTRAL" operator="or">
<KeyValuePair key="alertType" value="security"/>
</ThreadContextMapFilter>
<Policies>
<TimeBasedTriggeringPolicy />
<SizeBasedTriggeringPolicy size="250 MB"/>
</Policies>
</RollingRandomAccessFile>
<!-- RollingRandomAccessFile Appender for PegaRULES-ALERTSECURITY logs -->
<RollingRandomAccessFile name="ALERTSECURITY" fileName="${sys:pega.logdir}/PegaRULES-ALERTSECURITY.log" filePattern="${sys:pega.logdir}/PegaRULES-ALERTSECURITY-%d{MM-dd-yyyy}-%i.log.gz">
<PatternLayout>
<Pattern>%m%n</Pattern>
</PatternLayout>
<ThreadContextMapFilter onMatch="ACCEPT" onMismatch="DENY" operator="or">
<KeyValuePair key="alertType" value="security"/>
</ThreadContextMapFilter>
<Policies>
<TimeBasedTriggeringPolicy />
<SizeBasedTriggeringPolicy size="250 MB"/>
</Policies>
</RollingFile>
<!-- RollingRandomAccessFile Appender for PegaBIX logs logs -->
<RollingRandomAccessFile name="BIX" fileName="${sys:pega.logdir}/PegaBIX.log" filePattern="${sys:pega.logdir}/PegaBIX-%d{MM-dd-yyyy}-%i.log.gz">
<PatternLayout>
<Pattern>%d [%20.20t] [%20.20X{tenantid}] [%20.20X{app}] (%30.30c{3}) %-5p %X{stack} %X{userid} - %m%n</Pattern>
</PatternLayout>
<Policies>
<TimeBasedTriggeringPolicy />
<SizeBasedTriggeringPolicy size="250 MB"/>
</Policies>
</RollingRandomAccessFile >
<!-- RollingRandomAccessFile Appender for PegaRULES-SecurityEvent logs -->
<RollingRandomAccessFile name="SECURITYEVENT" fileName="${sys:pega.logdir}/PegaRULES-SecurityEvent.log" filePattern="${sys:pega.logdir}/PegaRULES-SecurityEvent-%d{MM-dd-yyyy}-%i.log.gz">
<PatternLayout>
<Pattern>%m%n</Pattern>
</PatternLayout>
<Policies>
<TimeBasedTriggeringPolicy />
<SizeBasedTriggeringPolicy size="250 MB"/>
</Policies>
</RollingRandomAccessFile >
<!-- RollingRandomAccessFile Appender for PegaCLUSTER logs -->
<RollingRandomAccessFile name="CLUSTER" fileName="${sys:pega.logdir}/PegaCLUSTER.log" filePattern="${sys:pega.logdir}/PegaCLUSTER-%d{MM-dd-yyyy}-%i.log.gz">
<PatternLayout>
<Pattern>%d [%20.20t] [%20.20X{tenantid}] [%20.20X{app}] (%30.30c{3}) %-5p %X{stack} %X{userid} - %m%n</Pattern>
</PatternLayout>
<Policies>
<TimeBasedTriggeringPolicy />
<SizeBasedTriggeringPolicy size="50 MB"/>
</Policies>
</RollingRandomAccessFile >
</Appenders>
<Loggers>
<asyncRoot>
<AppenderRef ref="CONSOLE"/>
<AppenderRef ref="PEGA"/>
<AppenderRef ref="ALERT" level="ALERT"/>
<AppenderRef ref="ALERTSECURITY" level="ALERT"/>
</asyncRoot>
<Logger name="com.pega.pegarules.session.internal.mgmt.SecurityEventLogger" additivity="false" level="info">
<AppenderRef ref="SECURITYEVENT"/>
</Logger>
<Logger name="com.pega.pegarules.data.internal.access.ExtractImpl" additivity="false" level="info">
<AppenderRef ref="BIX"/>
</Logger>
<Logger name="com.pega.pegarules.data.internal.access.ExtractParameters" additivity="false" level="info">
<AppenderRef ref="BIX"/>
</Logger>
<Logger name="com.pega.pegarules.data.internal.access.DatabaseUtilsCommonImpl" additivity="false" level="info">
<AppenderRef ref="BIX"/>
</Logger>
<Logger name="com.hazelcast" additivity="false" level="info">
<AppenderRef ref="CLUSTER"/>
</Logger>
<Logger name="org.apache.ignite" additivity="false" level="info">
<AppenderRef ref="CLUSTER"/>
</Logger>
</Loggers>
</Configuration>