Re: auditing and log4j

[Pat Felsted]

Thanks for the response.  So are you suggesting there is a better way to audit, since you say the purpose of log4j is diagnostics?  If so do you have suggestions?   Thanks again. Pat >>> Curt Arnold <[EMAIL PROTECTED]> 6/14/2006 5:36 PM >>> On Jun 14, 2006, at 5:47 PM, Pat Felsted wrote: > I am trying to get a feel of some usage of log4j pertaining to  > application auditing.  Do you all feel that many use it more for  > debugging or is auditing also a common use of it?  If it is used  > for auditing would it make sense to have a audit method?  I have  > searched the archives and not seen any talk of audit.  Are there  > projects or communities that use log4j for auditing that you can  > refer me to? > > Thanks. > Pat Additional discussion would be best handled on log4j-user.  This list  is reserved for discussions that affect the Logging Services Project  as a whole or don't fit into any of the existing logging frameworks. The most common use of log 4j is to process what I would call  "diagnostic" messages.  Messages that are intended to help a  diagnostician (developer or administrator) resolve some observed  problem.  Since in many cases interpreting these messages require  some understanding of the code and program flow, it is natural that  class names are used as logger names. Since that pattern is so prevalent, many people that loggers have to  be named after classes and log4j is only useful for diagnostic  logging.  For "business" or "audit" messages, the class name is not  the most useful organizational pattern since the auditor may not have  knowledge of the code and program flow.  For this type of use, you  might want to name loggers something like "audit.security" or  "audit.customer.address".  In your configuration, you could set the  root logger to handle diagnostic mess ages and then set the "audit"  logger to go to a different destination (and possibly set additivity  to false so audit messages don't flow into the diagnostic log). Your suggestion of an audit method is likely a suggestion that there  should be an AUDIT level like the existing DEBUG, INFO, WARN, etc.   However, I believe that "audit" is more an indication of the target  audience of the message and therefore is appropriately done using the  logger name which exists to categorize messages by topic or intended  audience.  If you did treat AUDIT as a level, you would lose the  distinction between a severe audit message (when an action might  break a law or cause serious financial harm) and informational audit  messages (like a particular user logged out) unless you added levels  for AUDIT_INFO, AUDIT_WARN, etc.