Audit trail

Overview

XML audit trail is a feature that allows logging updates to XML files. An alternative history feature is also available to record table updates in the relational database; see History.

Any persistent updates performed in the TIBCO EBX® repository are logged to an audit trail XML file. Procedure executions are also logged, even if they do not perform any updates, as procedures are always considered to be transactions. The following information is logged:

• Transaction type, such as dataset creation, record modification, record deletion, specific procedure, etc.

• Dataspace or snapshot on which the transaction is executed.

• Transaction source. If the action was initiated by EBX®, this source is described by the user identity, HTTP session identifier and client IP address. If the action was initiated programmatically, only the user's identity is logged.

• Optional "trackingInfo" value regarding the session

• Transaction date and time (in milliseconds);

• Transaction UUID (conform to the Leach-Salz variant, version 1);

• Error information; if the transaction has failed.

• Details of the updates performed. If there are updates and if history detail is activated, see next section.

Update details and disk management

The audit trail is able to describe all updates made in the EBX® repository, at the finest level. Thus, the XML files can be quite large and the audit trail directory must be carefully supervised. The following should be taken into account:

1. If an archive import is executed in non-interactive mode (without a change set), the audit trail does not detail the updates; it only specifies the archive that has been imported. In this case, if it is important to keep a fine trace of the import-replace, the archive itself must be preserved.

2. If an archive import is executed in interactive mode (with a change set), or if a dataspace is merged to its parent, the resulting log size will nearly triple the unzipped size of the archive. Furthermore, for consistency concerns, each transaction is logged to a temporary file (in the audit trail directory) before being moved to the main file. Therefore, EBX® requires at least six times the unzipped size of the largest archive that may be imported.

3. In the context of a custom procedure that performs many updates not requiring auditing, it is possible for the developer to disable the detailed history using the method ProcedureContext.setHistoryActivation.

File organization

All audit trail files are stored in the directory ${ebx.repository.directory}/History.

"Closed" audit files

Each file is named as follows:

<yyyy-mm-dd>-part<nn>.xml

where <yyyy-mm-dd> is the file date and <nn> is the file index for the current day.

Writing to current audit files

When an audit file is being written, the XML structure implies working in an "open mode". The XML elements of the modifications are added to a text file named:

<yyyy-mm-dd>-part<nn>Content.txt

The standard XML format is still available in an XML file that references the text file. This file is named:

<yyyy-mm-dd>-part<nn>Ref.xml

These two files are then re-aggregated in a "closed" XML file when the repository has been cleanly shut down, or if EBX® is restarted.

Example of an audit directory