Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Docs be explicit on how to turn off deprecated auditing #37316

Merged
merged 2 commits into from
Jan 15, 2019
Merged

Docs be explicit on how to turn off deprecated auditing #37316

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
a2ce2e1
part 2
albertzaharovits Jan 10, 2019
ab0f98c
[DOCS] Fixes formatting issues
lcawl Jan 10, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
35 changes: 30 additions & 5 deletions x-pack/docs/en/security/auditing/output-logfile.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,11 +7,36 @@ the `<clustername>_audit.log` file in the logs directory. To maintain
compatibility with releases prior to 6.5.0, a `<clustername>_access.log` file
is also generated. They differ in the output format but the contents
are similar. For systems that are not ingesting the audit file for search or
analytics it is strongly recommended to only keep the newer format.
Turning off the deprecated output format can be achieved by disabling the logger
in the `log4j2.properties` file (hint: there is a config comment
about it).
For more information, see {ref}/logging.html#configuring-logging-levels[configuring-logging].
analytics it is strongly recommended to keep only the newer format.

To turn off the deprecated output format, you can disable the logger in the
`log4j2.properties` file:

[source, properties]
--------------------------------------------------
# change info to off
# logger.xpack_security_audit_deprecated_logfile.level = info
logger.xpack_security_audit_deprecated_logfile.level = off
--------------------------------------------------

Alternatively, use the
{ref}/cluster-update-settings.html[cluster update settings API] to dynamically
configure the logger:

[source,js]
--------------------------------------------------
PUT /_cluster/settings
{
"persistent": {
"logger.org.elasticsearch.xpack.security.audit.logfile.DeprecatedLoggingAuditTrail": "off"
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should this setting be added to the list in https://www.elastic.co/guide/en/elasticsearch/reference/master/auditing-settings.html?

Copy link
Contributor Author

@albertzaharovits albertzaharovits Jan 13, 2019 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No, this is just configuring the logger via the dynamic settings API, as detailed in https://www.elastic.co/guide/en/elasticsearch/reference/current/logging.html#configuring-logging-levels .

}
}
--------------------------------------------------
// CONSOLE

NOTE: If you overwrite the `log4j2.properties` and do not specify appenders for
any of the audit trails, audit events are forwarded to the root appender, which
by default points to the `elasticsearch.log` file.


[float]
Expand Down