audit.ini [AuditSettings] #

The block [AuditSettings] of settings/audit.ini, with 5 setting(s).

Never edit settings/audit.ini itself: an update replaces it. Put the settings you change in an override, which wins over the shipped file:

• settings/override/audit.ini.append.php for every siteaccess,
• settings/siteaccess/<siteaccess>/audit.ini.append.php for one siteaccess,
• extension/<extension>/settings/audit.ini.append.php in an extension (read when the extension is active).

Audit #

enabled | disabled. On in every installation by convention (unlike the 4.x releases).

Default: enabled.

<?php /* #?ini charset="utf-8"?
# settings/override/audit.ini.append.php
[AuditSettings]
Audit=enabled
*/ ?>

LogDir #

Where the live channel files are written, relative to the site's var directory
([FileSettings] VarDir of site.ini). Created with the site user's owner and group.

Default: log/audit.

<?php /* #?ini charset="utf-8"?
# settings/override/audit.ini.append.php
[AuditSettings]
LogDir=log/audit
*/ ?>

AuditFileNames #

4.x compatibility: the old per-event file names. Kept so the old names resolve as
aliases in filters and so a site's own names keep a home; see [AuditCompatSettings].

Default: a hash of 13: user-login=login.log, user-failed-login=failed_login.log, content-delete=content_delete.log, content-move=content_move.log, content-hide=content_hide.log, role-change=role_change.log, role-assign=role_assign.log, section-assign=section_assign.log, state-assign=state_assign.log, order-delete=order_delete.log, location-assign=location_assign.log, location-remove=location_remove.log ....

<?php /* #?ini charset="utf-8"?
# settings/override/audit.ini.append.php
[AuditSettings]
# an empty "AuditFileNames[]" first replaces the shipped list; without it the items are added
AuditFileNames[]
AuditFileNames[user-login]=login.log
AuditFileNames[user-failed-login]=failed_login.log
AuditFileNames[content-delete]=content_delete.log
AuditFileNames[content-move]=content_move.log
AuditFileNames[content-hide]=content_hide.log
AuditFileNames[role-change]=role_change.log
AuditFileNames[role-assign]=role_assign.log
AuditFileNames[section-assign]=section_assign.log
AuditFileNames[state-assign]=state_assign.log
AuditFileNames[order-delete]=order_delete.log
AuditFileNames[location-assign]=location_assign.log
AuditFileNames[location-remove]=location_remove.log
AuditFileNames[main-node-update]=location_main_update.log
*/ ?>

OnWriteFailure #

What to do when the audit cannot write (disk full, permissions):
continue the request goes on; the failure is in error.log (AUDIT-UNWRITTEN) and the
dashboard warns
refuse actions of the "always written at once" kind (ImmediateEvents[]) are refused
while their channel cannot be written, so nothing security-relevant happens
unrecorded: a POST to a view of AlwaysModules[] by a signed-in user (503 with
an error page), a settings write (exp:ini, debug bar), and exp:audit's manage
actions (exit 2). Pages, content editing, GET requests, anonymous visitors,
reading and verifying the audit are never refused. Each refusal is logged as
AUDIT-REFUSED in error.log. Guide: "When the audit cannot write".
Default: continue (a full disk must not take the site down).

Default: continue.

<?php /* #?ini charset="utf-8"?
# settings/override/audit.ini.append.php
[AuditSettings]
OnWriteFailure=continue
*/ ?>

RefuseExemptViews #

With refuse: module/view POSTs that are never refused, so people can still sign in and
out (their records go to error.log as AUDIT-UNWRITTEN).

Default: a list of 2: user/login, user/logout.

<?php /* #?ini charset="utf-8"?
# settings/override/audit.ini.append.php
[AuditSettings]
# an empty "RefuseExemptViews[]" first replaces the shipped list; without it the items are added
RefuseExemptViews[]
RefuseExemptViews[]=user/login
RefuseExemptViews[]=user/logout
*/ ?>

Related #

• All blocks of audit.ini
• All INI files
• The settings page

Generated by ./console exp:help:examples from settings/audit.ini. Do not edit this page: change the source and generate again (how). Free documentation: GFDL 1.3 or later.