Audit log
The audit log records the actions performed on the CLC Server. Included are actions like logging in, logging out, import, and the launching and running of analysis tasks. Data management operations such as copying, deleting and adding files are not Server actions and are thus not recorded.
Audit log information is available at:
Management (
) | Audit log (
)
The audit log can be filtered based on when the action was taken, by whom, what sort of action it was, and based on status (success of failure).
The status of failed jobs is visualized by a red exclamation mark in the Status column. Successful jobs run on a grid node have a G in the status column and successful jobs run on a CLC Genomics Cloud setup have a C in the status column.
Audit log database and text files
Audit log information is stored in a database. Once a month, and when the CLC Server is started up, entries in the audit log older than 3 months are deleted.
The limit the audit log database can grow to is 64 GB. If a new entry will push the size past this limit, the system will remove some of the oldest entries so that is is possible for newer entries to be added.
Audit information is also written to text-based log files. Upon the first activity on a given date, a new log file called audit.log is created. This file is then used for logging that activity and subsequent Server activities on that day. When this new audit.log file is created, the file that previously had that name is renamed to audit.<actual events date>.log. These log files are retained for 31 days. When the creation of a new audit.log file is triggered, audit log files older than 31 days are checked for and deleted.
The audit log files can be found under the Server installation area under webapps/CLCServer/WEB-INF.
The audit log text files are tab delimited and have the following fields:
- Date and time
- Log level
- Operation: Login, Logout, Command queued, Command done, Command executing, Change server configuration, Server lifecycle; more may be added and existing may be changed or removed.
- Users
- IP Address
- Process name (when operation is one of the Command values) or description of server lifecycle (when operation is Server lifecycle)
- Process identifier - can be used to differentiate several processes of the same type.
- Status - can be used to identify whether the entry was successful or not, e.g. if a job execution failed it will be marked here. Any number other than 0 means failed.