exp:audit

Available since Exponential 6.0.15 (in development, not in a release yet).

Summary

Audit log: tail, show one event, verify the hash chains, list the channels (the manage actions are a dry run unless --apply)

Usage

./console exp:audit [options]
php bin/php/audit.php [options]

Help

The output of ./console help exp:audit (the script run with --help), without the standard options:

Usage: bin/php/audit.php [OPTION]... [ACTION] [ID] [EXTRA]
Audit log: the records of the audit channels and their hash chains

  exp:audit status|channels
  exp:audit tail [--channel=<c>] [--name=<pattern>] [--lines=20] [--follow] [--json]
  exp:audit show <event id> [--json]
  exp:audit search [filters] [--files] [--limit=50] [--json]
  exp:audit verify [--channel=<c>] [--date=YYYY-MM-DD] [--archives] [--json]
  exp:audit rotate [--channel=<c>] [--apply]
  exp:audit archive [--channel=<c>] [--before=YYYY-MM-DD] [--format=gzip|bzip2|xz|zstd|zip] [--apply]
  exp:audit restore --channel=<c> --date=YYYY-MM-DD [--to=<dir>] [--apply]
  exp:audit purge [--channel=<c>] [--apply]
  exp:audit reindex [--incremental] [--archives] [--channel=<c>] [--apply]
  exp:audit pseudonymise [--apply]
  exp:audit export [filters] [--subject-user=<id>] [--format=jsonl|csv|bundle] --out=<path>
  exp:audit import [--dir=<old log dir>] [--file=login.log] [--keep-originals] [--apply]
  exp:audit key list|rotate [--apply]|fingerprint [--pseudonym]
  exp:audit checkpoint [--apply]
  exp:audit sinks list|test <name>|flush [<name>] [--apply]
  exp:audit alerts list|test <rule> [--replay=YYYY-MM-DD]|recipients [--rule=<rule>]
  exp:audit cron [--daily] [--apply]  one run of the cronjob part (--daily: the daily tasks now)

The manage actions (rotate, archive, restore, purge, reindex, pseudonymise, import, key rotate,
checkpoint, sinks flush, cron) only say what they would do unless --apply is given. --dry-run means
the same as no --apply; --apply together with --dry-run is a usage error (exit 2).

Filters (search, export): --name=<pattern> --user=<id> --login= --object=<type:id> --target=<type:id>
  --result=success|refused|failed --severity=<min> --request= --job= --run= --ip=<network>
  --from=YYYY-MM-DD[THH:MM[:SS]][Z|+HH:MM] --to=... (UTC unless an offset is given; --to includes that day,
  minute or second) --query=<text> --legacy-file=<4.x file name> --channel=
Name patterns: * | <domain>.* | a prefix ending in .* (access.session.*) | a whole name; anything else
  is refused (exit 2).


Options:
  --channel=VALUE       Only this channel (content, access, system, commerce, read)
  --name=VALUE          tail, search, export: only names matching this pattern: *, access.*, access.session.*, content.node.move
  --lines=VALUE         tail: how many records (default 20)
  --follow              tail: keep printing new records as they are written (Ctrl-C ends)
  --json                Print records and results as JSON
  --date=VALUE          verify: only that day's files; restore: the archived day (YYYY-MM-DD, UTC)
  --archives            verify: also the archives (manifests, HMAC, checksums, the chain through them); reindex: also the archives
  --apply               rotate, archive, restore, purge, reindex, pseudonymise, import, key rotate, checkpoint, sinks flush, cron: do it (the default is a dry run)
  --dry-run             The default, kept for scripts that pass it: only say what would be done
  --before=VALUE        archive: the days before this date (default: older than LiveDays)
  --format=VALUE        archive: the format handler; export: jsonl, csv or bundle
  --to=VALUE            restore: the directory (default <LogDir>/restored); search, export: up to and including this time (as --from)
  --incremental         reindex: only what is new (default: rebuild)
  --user=VALUE
  --login=VALUE
  --object=VALUE
  --target=VALUE
  --result=VALUE
  --severity=VALUE
  --request=VALUE
  --job=VALUE
  --run=VALUE
  --ip=VALUE
  --from=VALUE          search, export: from this time (YYYY-MM-DD[THH:MM[:SS]], UTC unless it ends in Z or +HH:MM)
  --query=VALUE         search, export: full-text search over names, object names and before/after values
  --legacy-file=VALUE
  --limit=VALUE         search: how many records (default 50); export: at most MaxExportRecords
  --files               search: read the files, not the index
  --out=VALUE           export: the file (jsonl, csv) or directory (bundle)
  --subject-user=VALUE  export: every record by or about this user id (an access request)
  --dir=VALUE           import: the directory of the 4.x audit files (default: the audit LogDir)
  --file=VALUE          import: only this 4.x file (login.log)
  --keep-originals      import: leave the 4.x files in place after archiving them
  --pseudonym           key rotate: replace the pseudonym key instead of the signing key
  --replay=VALUE        alerts test: run the rule over the records since this date, without firing
  --daily               cron: run the daily tasks now
  --rule=VALUE          alerts recipients: only this rule

Options

Arguments

[action][id][extra]

Standard options

Every script also takes the standard options of the script framework: --help, --quiet, --siteaccess, --debug, --colors, --no-colors, --logfiles, --no-logfiles, --verbose and --allow-root-user.

Source

bin/php/audit.php, kernel/private/classes/commands/audit.php

See also

Generated example: exp:audit

Added to the reference for Exponential 6.0.15.