OXAudit

Introduction

The Open-Xchange Audit Bundle is an extension of the Open-Xchange Server > 6.12 which will enable your Open-Xchange Server to log actions from users using your Open-Xchange environment. In detail the following actions will be logged to the logfile:

1. Creation, modification, deletion of an appointment
2. Creation, modification, deletion of a task
3. Creation, modification, deletion of a contact
4. Creation, modification, deletion of an infostore item

Install on OX {{#if:|{{{version}}}| AppSuite}}

Debian GNU/Linux 10.0

Add the following entry to /etc/apt/sources.list.d/open-xchange.list if not already present:

deb https://{{#if:%7C{{{ldbaccount}}}@%7C}}software.open-xchange.com/{{#if:%7C{{{toplevel}}}%7Cproducts}}/stable/DebianBuster/ /{{#if:||

# if you have a valid maintenance subscription, please uncomment the 
# following and add the ldb account data to the url so that the most recent
# packages get installed
# deb https://[CUSTOMERID:PASSWORD]@software.open-xchange.com/{{#if:|{{{toplevel}}}|products}}/stable/updates/DebianBuster/ /

}}

and run

$ apt-get update
$ apt-get install open-xchange-audit

Debian GNU/Linux 11.0

Add the following entry to /etc/apt/sources.list.d/open-xchange.list if not already present:

deb https://{{#if:%7C{{{ldbaccount}}}@%7C}}software.open-xchange.com/{{#if:%7C{{{toplevel}}}%7Cproducts}}/stable/DebianBullseye/ /{{#if:||

# if you have a valid maintenance subscription, please uncomment the 
# following and add the ldb account data to the url so that the most recent
# packages get installed
# deb https://[CUSTOMERID:PASSWORD]@software.open-xchange.com/{{#if:|{{{toplevel}}}|products}}/stable/updates/DebianBullseye/ /

}}

and run

$ apt-get update
$ apt-get install open-xchange-audit

Configuration

Per default the audit bundle will use the Open-Xchange groupware logfile to generate log entries. The logfile can be found at:

/var/log/open-xchange/open-xchange.log

If there is a need to use a seperate logfile for those audit log entries, please modify the configuration file /opt/open-xchange/etc/logback.xml by adding the following sentences appropriately to your current configuration:

  <appender class="ch.qos.logback.core.rolling.RollingFileAppender" name="AUDIT_LOG">
      <file>/var/log/open-xchange/open-xchange-audit.log</file>
      <rollingPolicy class="com.openexchange.logback.extensions.FixedWindowRollingPolicy">
          <fileNamePattern>/var/log/open-xchange/open-xchange-audit.log.%i</fileNamePattern>
          <minIndex>1</minIndex>
          <maxIndex>99</maxIndex>
      </rollingPolicy>
      <triggeringPolicy class="ch.qos.logback.core.rolling.SizeBasedTriggeringPolicy">
          <maxFileSize>2MB</maxFileSize>
      </triggeringPolicy>
      <encoder class="com.openexchange.logback.extensions.ExtendedPatternLayoutEncoder">
          <pattern>%date{"yyyy-MM-dd'T'HH:mm:ss,SSSZ"} %-5level [%thread] %class.%method\(%class{0}.java:%line\)%n%message%n%lmdc%exception{full}</pattern>
      </encoder>
  </appender>
  <appender class="ch.qos.logback.classic.AsyncAppender" name="ASYNC_AUDIT">
      <queueSize>2048</queueSize>
      <discardingThreshold>0</discardingThreshold>
      <includeCallerData>true</includeCallerData>
      <appender-ref ref="AUDIT_LOG"/>
  </appender>

  <logger additivity="false" name="com.openexchange.audit">
      <level value="INFO"/> <!-- possible log levels are DEBUG, INFO, WARN, ERROR and ALL -->
      <appender-ref ref="ASYNC_AUDIT"/>
  </logger>

After you have set the logpath for the audit bundle (/var/log/open-xchange/open-xchange-audit.log in this example) you need to restart the groupware service:

$ /etc/init.d/open-xchange restart