# Audit users activity on graylog

**URL:** <https://community.graylog.org/t/audit-users-activity-on-graylog/7848>\
**Category:** Graylog Central (peer support)\
**Created:** [November 29, 2018, 9:33pm UTC](https://community.graylog.org/t/audit-users-activity-on-graylog/7848 "2018-11-29T21:33:53Z")\
**Posts on this page:** 18\
**Page:** 1

<div class="post-metadata">

**Author:** ![Tafsir\_Alam](https://avatars.discourse-cdn.com/v4/letter/t/e9bcb4/32.png) [@Tafsir\_Alam](https://community.graylog.org/u/Tafsir_Alam)\
**Post date:** [November 29, 2018, 9:33pm UTC](https://community.graylog.org/t/audit-users-activity-on-graylog/7848/1 "2018-11-29T21:33:53Z")

</div>

Hi All

In my infrastructure, more than 20 users using graylog and all having admin access. Is it possible to track users activity. Is there any location where audit logs are stored.

I want to track activities like:

1. Who created the dashboard and when.
2. Who created streams and when.
3. Who added the extractors and did changes in input.

Graylog version - 2.4.6  
Elasticsearch version - 5.6

Please help me with this.

Thanks

---

<div class="post-metadata">

**Author:** ![Totally\_Not\_A\_Robot](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/totally_not_a_robot/32/3353_2.png) [@Totally\_Not\_A\_Robot](https://community.graylog.org/u/Totally_Not_A_Robot)\
**Post date:** [November 30, 2018, 5:16am UTC](https://community.graylog.org/t/audit-users-activity-on-graylog/7848/2 "2018-11-30T05:16:04Z")

</div>

I believe I’ve seen that auditing is an option, but it is a paid-for Enterprise-level feature.

EDIT:  
Confirmed… it’s an Enterprise feature.

> **[Pricing](https://www.graylog.org/products/pricing)**
>
> Graylog is a leading centralized log management solution built to open standards for capturing, storing, and enabling real-time analysis of terabytes of machine data. We deliver a better user experience by making analysis ridiculously fast,...

---

<div class="post-metadata">

**Author:** ![macko003](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/macko003/32/3175_2.png) [@macko003](https://community.graylog.org/u/macko003)\
**Post date:** [November 30, 2018, 10:26am UTC](https://community.graylog.org/t/audit-users-activity-on-graylog/7848/3 "2018-11-30T10:26:21Z")

</div>

@jan shared another “solution” before.  
You can set logging form the web server, so you can see in the requests, but it’s not a real audit log.  
As I saw the web server logs you should phrase and analyze it.

This is free, but the better is the enterprise feature. You can use it for free under 5GB/day.

---

<div class="post-metadata">

**Author:** ![frantz](https://avatars.discourse-cdn.com/v4/letter/f/dbc845/32.png) [@frantz](https://community.graylog.org/u/frantz)\
**Post date:** [November 30, 2018, 1:23pm UTC](https://community.graylog.org/t/audit-users-activity-on-graylog/7848/4 "2018-11-30T13:23:51Z")

</div>

I think you mean:  
[http://docs.graylog.org/en/2.4/pages/secure/sec\_log\_user\_activity.html](http://docs.graylog.org/en/2.4/pages/secure/sec_log_user_activity.html)

---

<div class="post-metadata">

**Author:** ![Tafsir\_Alam](https://avatars.discourse-cdn.com/v4/letter/t/e9bcb4/32.png) [@Tafsir\_Alam](https://community.graylog.org/u/Tafsir_Alam)\
**Post date:** [November 30, 2018, 1:35pm UTC](https://community.graylog.org/t/audit-users-activity-on-graylog/7848/5 "2018-11-30T13:35:30Z")

</div>

Hi, Thanks for your reply @frantz .

No, it will show only logging user activity but will not show users activity. I want to track user activities like:

1. Who created the dashboard and when.
2. Who created streams and when.
3. Who added the extractors and did changes in input.

Is this possible to track without having the Enterprise feature?

Thanks

---

<div class="post-metadata">

**Author:** ![frantz](https://avatars.discourse-cdn.com/v4/letter/f/dbc845/32.png) [@frantz](https://community.graylog.org/u/frantz)\
**Post date:** [November 30, 2018, 2:04pm UTC](https://community.graylog.org/t/audit-users-activity-on-graylog/7848/6 "2018-11-30T14:04:00Z")

</div>

With the solution I provide you have all what you need.  
Access log provide the date and the user who did the action.

For example:  
`2016-06-08 18:21:55,780 DEBUG: org.graylog2.rest.accesslog - 192.168.122.1 admin [-] "POST streams/abcdef" Mozilla/5.0 (X11; Fedora; Linux x86_64; rv:46.0) Gecko/20100101 Firefox/46.0 200 -1`  
This log means user admin created the stream with id abcdef at 2016-06-08 18:21:55.

HTTP methods:

- GET = read
- POST = create
- PUT = update
- DELETE = delete

---

<div class="post-metadata">

**Author:** ![Tafsir\_Alam](https://avatars.discourse-cdn.com/v4/letter/t/e9bcb4/32.png) [@Tafsir\_Alam](https://community.graylog.org/u/Tafsir_Alam)\
**Post date:** [November 30, 2018, 2:07pm UTC](https://community.graylog.org/t/audit-users-activity-on-graylog/7848/7 "2018-11-30T14:07:04Z")

</div>

Where we can find the log @frantz ?

Log Location ?

Also I think this will not show the username. If 20 users having admin access then the logs always return username as admin.

---

<div class="post-metadata">

**Author:** ![frantz](https://avatars.discourse-cdn.com/v4/letter/f/dbc845/32.png) [@frantz](https://community.graylog.org/u/frantz)\
**Post date:** [November 30, 2018, 2:56pm UTC](https://community.graylog.org/t/audit-users-activity-on-graylog/7848/8 "2018-11-30T14:56:48Z")

</div>

Did you read the doc ?  
Because you can choose the filename in the XML.  
By default it’s /var/log/graylog/restaccess.log.

It shows the real username, not the role.  
If you have 2 users adminA and adminB with both admin rights, you will see adminA and adminB in the log.

Try this solution you’ll see by your own.

---

<div class="post-metadata">

**Author:** ![Tafsir\_Alam](https://avatars.discourse-cdn.com/v4/letter/t/e9bcb4/32.png) [@Tafsir\_Alam](https://community.graylog.org/u/Tafsir_Alam)\
**Post date:** [December 1, 2018, 5:48pm UTC](https://community.graylog.org/t/audit-users-activity-on-graylog/7848/9 "2018-12-01T17:48:58Z")

</div>

Ok will try and let you know @frantz

Thanks for the reply 🙂

---

<div class="post-metadata">

**Author:** ![macko003](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/macko003/32/3175_2.png) [@macko003](https://community.graylog.org/u/macko003)\
**Post date:** [December 3, 2018, 9:32am UTC](https://community.graylog.org/t/audit-users-activity-on-graylog/7848/10 "2018-12-03T09:32:48Z")

</div>

Exactly, I thought for this.

---

<div class="post-metadata">

**Author:** ![Tafsir\_Alam](https://avatars.discourse-cdn.com/v4/letter/t/e9bcb4/32.png) [@Tafsir\_Alam](https://community.graylog.org/u/Tafsir_Alam)\
**Post date:** [December 3, 2018, 10:26am UTC](https://community.graylog.org/t/audit-users-activity-on-graylog/7848/11 "2018-12-03T10:26:57Z")

</div>

Hey @frantz On which server I need to change _log4j2.xml_ file? I mean on web-interface server or master node server or on data node server?

Quick response will be appreciated.

Thanks

---

<div class="post-metadata">

**Author:** ![Totally\_Not\_A\_Robot](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/totally_not_a_robot/32/3353_2.png) [@Totally\_Not\_A\_Robot](https://community.graylog.org/u/Totally_Not_A_Robot)\
**Post date:** [December 3, 2018, 10:41am UTC](https://community.graylog.org/t/audit-users-activity-on-graylog/7848/12 "2018-12-03T10:41:25Z")

</div>

> [@Tafsir\_Alam](#):
>
> I mean on web-interface server or master node server or on data node server?

![taco](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/4/4150c9bc94128998150255ec717c1cc0f6df7bc1.jpeg)

You could just keep all configuration files consistent. 🙂

---

<div class="post-metadata">

**Author:** ![Tafsir\_Alam](https://avatars.discourse-cdn.com/v4/letter/t/e9bcb4/32.png) [@Tafsir\_Alam](https://community.graylog.org/u/Tafsir_Alam)\
**Post date:** [December 3, 2018, 10:44am UTC](https://community.graylog.org/t/audit-users-activity-on-graylog/7848/13 "2018-12-03T10:44:11Z")

</div>

Also @frantz After configuring **log4j2.xml** on web-interface node I noticed the following changes.

1. Not showing streams creation msg in the log.
2. But if I delete the stream it prompt deletion msg. for example:

```auto
2018-12-03 02:33:00,826 DEBUG: org.graylog2.rest.accesslog - 192.168.212.209 tafsir [-] "DELETE api/streams/5c05062c0af282750eca0406" Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.110 Safari/537.36 204 -1

```

Also it shows stream ID not name. Please help me to sove this.

My **log4j2.xml** file configuration is:

```auto
<?xml version="1.0" encoding="UTF-8"?>
<Configuration packages="org.graylog2.log4j" shutdownHook="disable">
    <Appenders>
        <!-- Simple appender that writes access log to specified file -->
        <File name="RestAccessLog" fileName="/var/log/graylog-server/server.log" append="true">
            <PatternLayout pattern="%d %-5p: %c - %m%n"/>
        </File>
    </Appenders>
    <Loggers>
        <!-- RestAccessLogFilter -->
        <Logger name="org.graylog2.rest.accesslog" level="debug" additivity="false">
                <AppenderRef ref="RestAccessLog" level="debug"/>
                <AppenderRef ref="STDOUT" level="info"/>
        </Logger>
    </Loggers>
</Configuration>

```

@Totally_Not_A_Robot ^^

Thanks

---

<div class="post-metadata">

**Author:** ![macko003](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/macko003/32/3175_2.png) [@macko003](https://community.graylog.org/u/macko003)\
**Post date:** [December 3, 2018, 11:58am UTC](https://community.graylog.org/t/audit-users-activity-on-graylog/7848/14 "2018-12-03T11:58:57Z")

</div>

check the api-browser  
DELETE is just an HTTP method. You won’t see “CREATE”. You should check after POST events.

As I mentioned before, It’s NOT an audit log. It’s logging the http traffic, where you can find the logs what you need.

---

<div class="post-metadata">

**Author:** ![Tafsir\_Alam](https://avatars.discourse-cdn.com/v4/letter/t/e9bcb4/32.png) [@Tafsir\_Alam](https://community.graylog.org/u/Tafsir_Alam)\
**Post date:** [December 3, 2018, 12:12pm UTC](https://community.graylog.org/t/audit-users-activity-on-graylog/7848/15 "2018-12-03T12:12:25Z")

</div>

@macko003 Can we customize **log4j2.xml** on the basis of our requirement?

---

<div class="post-metadata">

**Author:** ![macko003](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/macko003/32/3175_2.png) [@macko003](https://community.graylog.org/u/macko003)\
**Post date:** [December 3, 2018, 12:19pm UTC](https://community.graylog.org/t/audit-users-activity-on-graylog/7848/16 "2018-12-03T12:19:50Z")

</div>

> [@macko003](#):
>
> You can set logging form the web server, so you can see in the requests, but it’s not a real audit log.  
> As I saw the web server logs you should phrase and analyze it.

Don’t confuse web server logs, and audit logs.  
I don’t familiar with java logging, so I don’t know. But I’m sure, you can’t filter for eg. stream create.  
As I mentioned, you need to analyle the logs eg with graylog.

---

<div class="post-metadata">

**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\
**Post date:** [December 3, 2018, 1:46pm UTC](https://community.graylog.org/t/audit-users-activity-on-graylog/7848/17 "2018-12-03T13:46:38Z")

</div>

> basis of our requirement

To be honest - your requirements are fullfilled with the audit plugin in Graylog Enterprise.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [December 17, 2018, 1:46pm UTC](https://community.graylog.org/t/audit-users-activity-on-graylog/7848/18 "2018-12-17T13:46:40Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.