You are viewing limited content. For full access, please sign in.

Question

Question

Custom Audit Events: Data Missing in Report

asked on July 13, 2017 Show version history

Hello,

I'm currently working on a project that involves accessing the Audit Trail database via workflow to analyze activity for a specific user account utilized by an SDK application and run a process on certain documents based on the results.

To provide some background, the basic goal of this part of the project is to find a way to easily distinguish between "reading an eDoc" and "exporting pages to PDF" using the SDK.

I've done some preliminary testing, and so far it seems like both events are logged as "view document" with no way to easily tell the difference.

Question 1: Is there any data in the Audit Trail database that provides a distinction between these events when they are triggered by an SDK application? If so, how can I access it?

 

Assuming the answer to question 1 is no, there is no way, then my next option is to create a custom event that will provide the necessary information.

I've done some experimentation, but so far I've only gotten as far as getting Audit Trail to report a "custom event" with minimal details.

I see that there are columns for custom data, but so far I haven't been able to connect the dots between those and methods/class members.

Question 2: Are there any examples/documentation describing the correct way to create, report, and utilize custom auditing events/data? 

1 0

Answer

SELECTED ANSWER
replied on July 18, 2017

Use the Laserfiche.RepositoryAccess.Audit.AuditEvent to log more information about the export:

AuditEvent auditEvent = new AuditEvent(AuditEventType.ExportDocument, session);
auditEvent.Format = "pdf";
auditEvent.Comment = comment; // optional
auditEvent.ReportAuditEvent(doc); // doc is the DocumentInfo

 

1 0

Replies

replied on July 17, 2017

Reading an electronic document is audited under View Document, while exporting pages is under Export Document. Now, if you're referring to saving an e-doc locally after you've opened it for viewing, that's not really under Laserfiche's control anymore, so we can't audit it.

Using custom audit events is documented in the SDK documentation.

0 0
replied on July 17, 2017

Would this behavior differ for Workflow SDK scripts?

I've been using WF to test the code, but instead of an Export event I just end up with a separate View Document event for each page.

I verified the Export event is being tracked and I can get it to appear if I use that account directly in the Client, just not in the Workflow SDK Script.

I've tried establishing a separate session in the script without using the RASession, but now I'm wondering if Workflow SDK scripts behave differently.

 

For the custom audit events, I found that section of the documentation, thank you.

0 0
replied on July 18, 2017

Can you post the script?

0 0
replied on July 18, 2017

Miruna,

Below is a "bare bones" version of the script without the search function or the logic to decide between read and export.

RepositoryRegistration repository = new RepositoryRegistration(serverName,repoName);
Session session = new Session();
session.LogIn(userName,password,repository);

// Set output path and file name
string fileName = "Test File";
string outputPath = @"\\TEST\D$\";

// Retrieve document
DocumentInfo doc = Document.GetDocumentInfo(entry,session);
bool hasEdoc = doc.IsElectronicDocument;

// If no electronic document found, generate PDF
int pageCount = doc.PageCount;

// Create document exporter and apply settings
DocumentExporter dExp = new DocumentExporter();
dExp.CompressionQuality = 75;
dExp.IncludeAnnotations = true;
dExp.BlackoutRedactions = true;
dExp.PageFormat = DocumentPageFormat.Jpeg;

// Set export options
PdfExportOptions ExportOptions = new PdfExportOptions();
ExportOptions = PdfExportOptions.IncludeText | PdfExportOptions.RenderAnnotationsAsImage;

// Attempt to generate the PDF
try {
    // Generate PDF document
    dExp.ExportPdf(doc, doc.AllPages, ExportOptions, outputPath + fileName + ".pdf");
}
finally {
    session.LogOut();
}

 

0 0
SELECTED ANSWER
replied on July 18, 2017

Use the Laserfiche.RepositoryAccess.Audit.AuditEvent to log more information about the export:

AuditEvent auditEvent = new AuditEvent(AuditEventType.ExportDocument, session);
auditEvent.Format = "pdf";
auditEvent.Comment = comment; // optional
auditEvent.ReportAuditEvent(doc); // doc is the DocumentInfo

 

1 0
replied on July 18, 2017

Thank you both. I was getting the impression that manually reporting the audit event I wanted would be necessary based on my results so far.

It looks to me like the SDK is pulling each page and then generating the PDF externally, therefore it doesn't register as an export event.

This would explain why all I'm seeing is a separate "View Document" event for each page when it is running the DocumentExporter code.

0 0
replied on July 19, 2017 Show version history

Hi Robert,

We have a vendor building out another similar process for a new system that uses the Java SDK. Is the Java SDK also capable of reporting standard Audit Events?

I looked through the Java SDK documentation and saw that there is a ReportAuditEvent method for Custom events, but I didn't see an equivalent to the .NET AuditEvent.

0 0
replied on July 19, 2017

JRA has the CustomAuditEvent class, set the properties on that object and call reportAuditEvent().

0 0
replied on July 19, 2017

Just to clarify, the JRA CustomAuditEvent class would only be capable of creating events with an event_type value of 105, correct?

replied on July 19, 2017 Show version history

Just to be 100% clear, the CustomAuditEvent class in the JRA does not allow reporting of standard auditing events, correct?

If that is the case, I'll need to use a custom event in both the .NET and Java applications to ensure both are reporting the same event.

 

I've tested the .NET version of the CustomAuditEvent, but Audit Trail is not showing any of the custom audit event class information.

Additionally, when I attempt to add both a description and an Entry, it will only include the first one added in the database (only prop_index is 0).

The audit_custom table seems to be empty. When I execute the code and log the custom event ID I get a value, but it doesn't appear to be logging it in the database, which I'm assuming is why the reports don't show any additional data.

 

Here is the code I used to create the event:

CustomAuditReason customEvent = new CustomAuditReason(session);
customEvent.EventName = "PDF Generated";
customEvent.Save();

And here is the code I've been using to report the event:

CustomAuditReasonReader reader = new CustomAuditReasonReader(session);
while (reader.Read())
{
    if (reader.Item.EventName == "PDF Generated")
    {
        CustomAuditReason reason = reader.Item;
        CustomAuditEvent e = new CustomAuditEvent(reason,session);
        
        // verified that the correct reason is selected
        Console.WriteLine(reason.EventName + ": " + reason.Id);
       
        e.AddEntry(entry); // works
        e.Add("TEST","Value"); // does not work
        e.AddTrustee(Account.GetInfo(username,session)); // works
        e.ReportAuditEvent();
    }
0 0
replied on March 6, 2019

Hi Jason, did you ever figure out how to get the custom audit event to record the complete data you are passing to it?  I am having the exact same results you describe above.

0 0
replied on March 6, 2019

No, unfortunately I ended up going in a different direction that didn't require this functionality so I didn't pursue this any further.

0 0
replied on March 6, 2019

@████████, since there are multiple instances of this same issue with custom audit events, are there any known gotchas or direction on how to make them work?  Sorry to revive an old thread!

0 0
replied on September 30

Hello Sir,

How to fetch/get the Audit trail log from Laserfiche cloud into the our local system ?

Is there any SDK script or Laserfiche API available to do same ?

We have scenario where we want to pull data from LF cloud audit log and PUSH it to some other tools so we need some solution.

Thanks,
Pratik

0 0
You are not allowed to follow up in this post.

Sign in to reply to this post.