Audit Trail Log

The audit trail log records security changes so you can track activity and enforce security policies. The log is located at $JFROG_HOME/artifactory/var/log/access-security-audit.log.

Access records the following operations:

Create, update, and delete users
Create, update, and delete groups
Create, update, and delete permission targets
Create, update, and delete access tokens
Create, update, and delete projects
Create, update, and delete project users and project groups
Create, update, and delete project resources
Create, update, and delete environments
Create, update, and delete roles
Update selected Access configuration settings

Audit Trail Log File Format

An entry in the Audit Trail Log has the following format:

Date | Trace ID | User IP | User | Logged Principal | Entity Name | Event Type | Event | Data Changed

On a multi-tenant JFrog Platform, the line starts with |<tenant-id>| before the date. A self-managed JFrog Platform doesn't include the tenant ID.

Log Field	Description
Date	The date and time of the log entry, in UTC, formatted as `yyyy-MM-dd'T'HH:mm:ss.SSSZ`.
Trace ID	The Trace ID is used to identify a request across services.
User IP	The IP address of the user that performed the operation. The IP address is `UNKNOWN` when Access can't determine the originating user, including an operation performed with an internal service token. A change applied by federation is also recorded as `UNKNOWN`.
User	The username of the user that performed the operation. The username is `UNKNOWN` when Access can't determine the originating user, including an operation performed with an internal service token. A change applied by federation is recorded as `FEDERATION`.
Logged Principal	The identity that performed the operation against Access. This can be a username or a service identity, such as `jfrt@<service-id>`. A change applied by federation is recorded as `FEDERATION`.
Entity Name	The security entity that the operation modified. For a user, group, permission, or token, this is the entity name. For a project, this is the project key. For a project user, project group, project resource, environment, or role, this is `<project-key>:<name>`. An Access configuration change uses the entity name `AccessConfig`.
Event Type	The type of operation performed. `C` is create, `U` is update, and `D` is delete.
Event	The security entity on which the operation was performed. `USR`: User `GRP`: Group `PRM`: Permission `TKN`: Token `CFG`: Access configuration `PRJ`: Project `PUS`: Project user `PGR`: Project group `PRS`: Project resource `ENV`: Environment `RLE`: Role
Data Changed	A JSON object that describes the change. It can contain `added`, `removed`, `updated`, and `upserted`. An `updated` value has `oldEntry` and `newEntry`. Sensitive values, such as passwords, keys, secrets, and tokens, are replaced with `*`. Permission actions are recorded by action name, such as `READ`, `ANNOTATE`, `DEPLOY`, `DELETE`, and `MANAGE`. A `CFG` entry records changes to security, token, task, federation, environment configuration, notification, proxy, permission, and central integration settings. It also records changes to integration templates, whether integrations are enabled, and the global role limit. Other Access configuration changes, such as database settings, aren't recorded.

Example 1

An admin user named admin created a user named bob and added bob to the groups dev-team, code-reviewers, and rnd-team-leaders.

2018-02-18T09:57:05.282Z|4b1b8a0b04e31b80|10.0.0.132|admin|jfrt@a64971e1-3c3c-4069-a769-dfb473dc8a67|bob|C|USR|{
   "added":{
      "customData.updatable_profile":"true",
      "password":"*",
      "groups.dev-team":"UserGroupImpl(name=dev-team, realm=internal)",
      "groups.code-reviewers":"UserGroupImpl(name=code-reviewers, realm=internal)",
      "allowedIps":"[*]",
      "groups.rnd-team-leaders":"UserGroupImpl(name=rnd-team-leaders, realm=internal)",
      "realm":"internal",
      "email":"[email protected]",
      "status":"enabled",
      "username":"bob"
   }
}

Example 2

An admin user named devops-admin added a user named dylan to a permission target named nodejs-developers with read, annotate, deploy, and delete permissions.

2018-02-18T11:19:51.644Z|7beab97bfa421337|10.0.0.132|devops-admin|jfrt@a64971e1-3c3c-4069-a769-dfb473dc8a67|nodejs-developers|U|PRM|{
   "added":{
      "actions.dylan(USER):READ":"dylan(USER):READ",
      "actions.dylan(USER):ANNOTATE":"dylan(USER):ANNOTATE",
      "actions.dylan(USER):DEPLOY":"dylan(USER):DEPLOY",
      "actions.dylan(USER):DELETE":"dylan(USER):DELETE"
   }
}

Manage Audit Trail Log File Size

Access rotates log files when the active file reaches 25 MB. Archived files are written to $JFROG_HOME/artifactory/var/log/archived.

To change the maximum size of each file, set MaxFileSize on the SECURITY_AUDIT appender in $JFROG_HOME/artifactory/var/etc/access/logback.xml.

<triggeringPolicy class="org.jfrog.common.logging.logback.triggering.SizeAndIntervalTriggeringPolicy">
    <MaxFileSize>25MB</MaxFileSize>
</triggeringPolicy>

Enable and Disable Audit Trail Log

Audit trail logging is enabled by default.

To disable or enable audit trail logging on a self-managed JFrog Platform:

Open $JFROG_HOME/artifactory/var/etc/system.yaml.
Set access.logging.audit.enabled.

access:
  logging:
    audit:
      enabled: false

Restart the JFrog Platform.

📘
Note
This setting applies to a self-managed JFrog Platform. The Access configuration property security.audit.enabled is deprecated and doesn't control this log.