Patterns in kernel/classes/audit
Note
This page is generated from the source code by php bin/php/exppatterncatalogue.php --write. Do not edit it by hand:
change the code or the generator, then run the command again. How the patterns are recognized: the pattern catalogue.
Every class, interface and trait of kernel/classes/audit with the patterns it was recognized as, followed by the module views, policy functions, fetch functions, template operators, cronjobs, event hooks and INI plugin points of the area. All patterns.
Classes (54)
| Class | Kind | Patterns | File | Description |
|---|---|---|---|---|
expAudit | class | Factory and static factory methods, Registry, Utility (static helper) | kernel/classes/audit/expaudit.php:26 | The audit: what happens in Exponential, recorded as hash-chained JSON lines per channel (doc/eng-us/bc/6.0/audit.md, "The developer API (Z3)"). |
expAuditAlertEvaluator | class | Utility (static helper) | kernel/classes/audit/alerts/expauditalertevaluator.php:23 | Evaluates the alert rules (doc/eng-us/bc/6.0/audit.md, "Alerts (F5)") and fires system.audit.alert. |
expAuditAlertRule | interface | Interface (contract) | kernel/classes/audit/expauditalertrule.php:14 | An alert rule class, registered in audit.ini: [AuditAlertSettings] RuleClasses[]= Counted by the RAD survey (registry "auditalertrules"). |
expAuditAlertRuleBase | abstract class implements expAuditAlertRule | Template Method / abstract base class | kernel/classes/audit/alerts/expauditalertrulebase.php:13 | Shared code of the built-in alert rule classes: the record fields a rule groups by, the time of a record, and the de-duplication (doc/eng-us/bc/6.0/a… |
expAuditAlertState | class | Factory and static factory methods | kernel/classes/audit/alerts/expauditalertstate.php:19 | The window state of one alert rule (doc/eng-us/bc/6.0/audit.md, "Alerts (F5)"): /alerts/.json, read and written under flock() only when a matching re… |
expAuditArchiver | class | – | kernel/classes/audit/archive/expauditarchiver.php:37 | Archives, manifests, verification, restore and retention of the audit channels (doc/eng-us/bc/6.0/audit.md, "The archive manifest and its HMAC", "Rot… |
expAuditBridge | class | Adapter / bridge / wrapper, Utility (static helper) | kernel/classes/audit/bridge/expauditbridge.php:24 | The ezpEvent bridge of the audit (doc/eng-us/bc/6.0/audit.md, "The ezpEvent bridge", Z3): kernel and extension events that already exist (ezpEvent::g… |
expAuditBuffer | class | – | kernel/classes/audit/expauditbuffer.php:11 | The records of one request (or one stretch of a command), per channel, until they are flushed (doc/eng-us/bc/6.0/audit.md, "Buffering and flushing (F… |
expAuditBzip2Format | class extends expAuditFormatBase | INI plugin point (extension point), Strategy / handler | kernel/classes/audit/format/expauditbzip2format.php:11 | The bzip2 archive format (PHP extension bz2): .jsonl.bz2. |
expAuditConfig | class | Factory and static factory methods, Utility (static helper) | kernel/classes/audit/expauditconfig.php:21 | The audit settings (settings/audit.ini, doc/eng-us/bc/6.0/audit.md "The settings reference") read once into one array. |
expAuditConsole | class | Utility (static helper) | kernel/classes/audit/console/expauditconsole.php:16 | What the views of the audit module share (doc/eng-us/bc/6.0/audit.md, "The console: module audit"): the channels the current user may read (audit/rea… |
expAuditExporter | class | – | kernel/classes/audit/archive/expauditexporter.php:26 | Searching the audit files and exporting records (exp:audit search --files, exp:audit export; doc/eng-us/bc/6.0/audit.md, "The command: exp:audit"). |
expAuditExportStream | class | Factory and static factory methods | kernel/classes/audit/console/expauditexportstream.php:28 | The audit records of a filter as CSV, JSON lines or JSON, newest first, written piece by piece to a callback as they are read: the download of audit/… |
expAuditFormatBase | abstract class implements expAuditFormatHandler | Strategy / handler, Template Method / abstract base class | kernel/classes/audit/format/expauditformatbase.php:14 | Shared code of the archive format handlers (doc/eng-us/bc/6.0/audit.md, "Rotation, archives and retention"): streaming compression through a PHP stre… |
expAuditFormatHandler | interface | Interface (contract), Strategy / handler | kernel/classes/audit/expauditformathandler.php:14 | An archive format (gzip, bzip2, xz, zstd, zip), registered in audit.ini: [AuditArchiveSettings] FormatHandlers[]= Counted by the RAD survey (registry… |
expAuditFormatRegistry | class | Registry, Utility (static helper) | kernel/classes/audit/format/expauditformatregistry.php:16 | The archive format registry: [AuditArchiveSettings] FormatHandlers[]= (RAD survey registry "auditformats"). |
expAuditFunctionCollection | class | Fetch function (Query Object, Facade), Utility (static helper) | kernel/classes/audit/console/expauditfunctioncollection.php:22 | The fetch functions of the audit module (kernel/audit/function_definition.php; doc/eng-us/bc/6.0/audit.md, "Template operator and fetch"): |
expAuditGuard | class | Utility (static helper) | kernel/classes/audit/expauditguard.php:32 | [AuditSettings] OnWriteFailure (doc/eng-us/bc/6.0/audit.md, "When the audit cannot write"): what happens to an action whose audit record cannot be wr… |
expAuditGzipFormat | class extends expAuditFormatBase | INI plugin point (extension point), Strategy / handler | kernel/classes/audit/format/expauditgzipformat.php:11 | The gzip archive format (zlib, always available): .jsonl.gz. |
expAuditHook | class | Utility (static helper) | kernel/classes/audit/hook/expaudithook.php:25 | The kernel's audit call sites (doc/eng-us/bc/6.0/audit.md, "The event catalogue", stage 3): one guarded way to record an event from a hook point, and… |
expAuditImporter | class | – | kernel/classes/audit/archive/expauditimporter.php:28 | Import of the 4.x text audit logs (doc/eng-us/bc/6.0/audit.md, "Import of the old logs (Z4)"; exp:audit import). |
expAuditIndexer | class | – | kernel/classes/audit/index/expauditindexer.php:20 | Fills the audit index from the channel files (doc/eng-us/bc/6.0/audit.md, "Incremental indexing", "Rebuild", "Pseudonymisation after 90 days"). |
expAuditIndexRow | class | Factory and static factory methods, Utility (static helper) | kernel/classes/audit/index/expauditindexrow.php:12 | One audit record as a row of expaudit_event (doc/eng-us/bc/6.0/audit.md, "Tables"): the columns the console filters on, the record itself (as written… |
expAuditIndexSchema | class | Utility (static helper) | kernel/classes/audit/index/expauditindexschema.php:18 | The audit index tables (doc/eng-us/bc/6.0/audit.md, "The index"): their definition in the generic schema format of share/db_schema.dba, creating them… |
expAuditIndexSettings | class | Utility (static helper) | kernel/classes/audit/index/expauditindexsettings.php:12 | The settings of the audit index and console (audit.ini [AuditIndexSettings], [AuditConsoleSettings] and [AuditPrivacySettings] PseudonymiseAfterDays)… |
expAuditJson | class | Utility (static helper) | kernel/classes/audit/expauditjson.php:16 | The canonical JSON of audit records (doc/eng-us/bc/6.0/audit.md, "Canonical JSON"). |
expAuditKeys | class | – | kernel/classes/audit/expauditkeys.php:23 | The audit keys (doc/eng-us/bc/6.0/audit.md, "Keys (Z7)", "Key handling"): the installation id (a UUID, part of every channel's genesis hash), the sig… |
expAuditMailRecipients | class | Utility (static helper) | kernel/classes/audit/sinks/expauditmailrecipients.php:30 | Who gets the audit's alert mail (doc/eng-us/bc/6.0/audit.md, "E-mail"; owner decision 2026-10-02). |
expAuditMailSink | class extends expAuditSinkBase | INI plugin point (extension point) | kernel/classes/audit/sinks/expauditmailsink.php:23 | The e-mail sink (doc/eng-us/bc/6.0/audit.md, "E-mail"): events at MinSeverity (critical) or matching Events[] are mailed through eZMail, one mail per… |
expAuditMaintenance | class | – | kernel/classes/audit/archive/expauditmaintenance.php:20 | The audit's scheduled work (doc/eng-us/bc/6.0/audit.md, "Rotation, archives and retention (Q8)"), run by the cronjob part audit (cronjobs/audit.php),… |
expAuditMatchRule | class extends expAuditAlertRuleBase | INI plugin point (extension point) | kernel/classes/audit/alerts/expauditmatchrule.php:20 | The alert rule class "match" (RuleClasses[match]=expAuditMatchRule): fires for every record matching Event (and, with Policies[], only when the role… |
expAuditPrivacy | class | – | kernel/classes/audit/expauditprivacy.php:16 | The privacy rules of audit records (doc/eng-us/bc/6.0/audit.md, "Fields", "Never recorded"; settings [AuditPrivacySettings] and [AuditRecordSettings]… |
expAuditQuery | class | – | kernel/classes/audit/index/expauditquery.php:21 | Searches the audit index (doc/eng-us/bc/6.0/audit.md, "The console", URL parameters): the console's filters turned into one WHERE clause that every e… |
expAuditReader | class | – | kernel/classes/audit/expauditreader.php:12 | Reads audit records from the live channel files: the newest records (read backwards from the end of the files, so a large day file is not read whole)… |
expAuditReauth | class | Utility (static helper) | kernel/classes/audit/console/expauditreauth.php:26 | Password re-entry before the audit's manage actions (doc/eng-us/bc/6.0/audit.md, Q9; [AuditConsoleSettings] ReauthForManage, ReauthMinutes). |
expAuditScheduleRule | class extends expAuditAlertRuleBase | INI plugin point (extension point) | kernel/classes/audit/alerts/expauditschedulerule.php:15 | The alert rule class "schedule" (RuleClasses[schedule]=expAuditScheduleRule): fires for records matching Event that happen outside business hours ([A… |
expAuditSink | interface | Interface (contract) | kernel/classes/audit/expauditsink.php:15 | A copy of the audit records outside the file (syslog, webhook, mail), registered in audit.ini: [AuditSinkSettings] SinkClasses[]= Counted by the RAD… |
expAuditSinkBase | abstract class implements expAuditSink | Template Method / abstract base class | kernel/classes/audit/sinks/expauditsinkbase.php:14 | Shared code of the audit sinks: the sink's settings block ([AuditSink_]), which records it wants (Events[] patterns and MinSeverity) and whether it d… |
expAuditSinkRegistry | class | Registry, Utility (static helper) | kernel/classes/audit/sinks/expauditsinkregistry.php:23 | The sink registry and delivery (doc/eng-us/bc/6.0/audit.md, "Sinks (Q7)", "The sink registry"). |
expAuditSource | interface | INI plugin point (extension point), Interface (contract) | kernel/classes/audit/console/expauditsource.php:23 | An optional source of the audit console: an extension that writes its own events (usually into a channel of its own) and tells the console's views ho… |
expAuditSourceBase | abstract class implements expAuditSource | Template Method / abstract base class | kernel/classes/audit/console/expauditsourcebase.php:11 | The base of an audit console source (expAuditSource): every method answers "nothing", so a source implements only what it shows. |
expAuditSourceRegistry | class | Factory and static factory methods, Registry, Utility (static helper) | kernel/classes/audit/console/expauditsourceregistry.php:16 | The registry of the audit console's sources (expAuditSource), from audit.ini [AuditSourceSettings] Sources[]: which are registered, which work here,… |
expAuditSpool | class | – | kernel/classes/audit/sinks/expauditspool.php:16 | The spool of a sink (doc/eng-us/bc/6.0/audit.md, "Webhook"): records for network sinks are appended at flush time to /.jsonl under flock(), so a web… |
expAuditSyslogSink | class extends expAuditSinkBase | INI plugin point (extension point) | kernel/classes/audit/sinks/expauditsyslogsink.php:36 | The syslog / journald sink (doc/eng-us/bc/6.0/audit.md, "Sinks", "syslog / journald"): one RFC 5424 message per record, |
expAuditTaxonomy | class | Utility (static helper) | kernel/classes/audit/expaudittaxonomy.php:21 | The audit taxonomy registry (doc/eng-us/bc/6.0/audit.md, "Taxonomy", "Naming rules", "The event catalogue"). |
expAuditTaxonomyBranch | interface | Interface (contract) | kernel/classes/audit/expaudittaxonomybranch.php:15 | An extension's branch of the audit taxonomy, registered in audit.ini: [AuditEventSettings] Branches[myext]=myExtAuditBranch Counted by the RAD survey… |
expAuditTemplateOperator | class | Template operator (Interpreter plugin) | kernel/classes/audit/console/expaudittemplateoperator.php:13 | The template operator audit_label (doc/eng-us/bc/6.0/audit.md, "Template operator and fetch"): the human label of an audit event name from the taxono… |
expAuditThresholdRule | class extends expAuditAlertRuleBase | INI plugin point (extension point) | kernel/classes/audit/alerts/expauditthresholdrule.php:16 | The alert rule class "threshold" (RuleClasses[threshold]=expAuditThresholdRule): fires when Threshold events matching Event fall within Window second… |
expAuditVerifier | class | – | kernel/classes/audit/expauditverifier.php:22 | Verifies the hash chain of audit channels (doc/eng-us/bc/6.0/audit.md, "Verification"). |
expAuditWebhookSink | class extends expAuditSinkBase | INI plugin point (extension point) | kernel/classes/audit/sinks/expauditwebhooksink.php:20 | The webhook sink (doc/eng-us/bc/6.0/audit.md, "Webhook"): POSTs batches of records as JSON, |
expAuditWriter | class | – | kernel/classes/audit/expauditwriter.php:29 | Appends audit records to a channel's live file and keeps the hash chain (doc/eng-us/bc/6.0/audit.md, "The hash chain"). |
expAuditXzFormat | class extends expAuditFormatBase | INI plugin point (extension point), Strategy / handler | kernel/classes/audit/format/expauditxzformat.php:11 | The xz archive format: .jsonl.xz, through the xz binary (no PHP extension is commonly available). |
expAuditZipFormat | class extends expAuditFormatBase | INI plugin point (extension point), Strategy / handler | kernel/classes/audit/format/expauditzipformat.php:12 | The zip archive format (PHP extension zip): .jsonl.zip, one archive per live file holding that one file, so a single file can be restored. |
expAuditZstdFormat | class extends expAuditFormatBase | INI plugin point (extension point), Strategy / handler | kernel/classes/audit/format/expauditzstdformat.php:11 | The zstd archive format: .jsonl.zst, through the PHP extension zstd when it is loaded, else the zstd binary. |