Audit logs for openreplay-ui about openreplay

[mehrdad-khojastefar]

Thanks for the response.

Is "Audit Trail Log File Format" from jfrog standard in anyway?

Yes, it is pretty standard and complete and covers every aspect of user interactions with the jfrog system. Upon that it is very comprehensive so we can play with it in our pipeline and extract the information we need.

The idea of connecting to postgresql should properly work but I don't think this is the best approach since almost every big project has some sort of audit trailing support inside of it I think the openreplay itself should support it.
Keep in mind that with the openreplay's growing community and more production instances this feature is a must.

For the format of the audit trail it can be anything and it can also support multiple formats, the most used format is json.

[amirouche]

This is available in ee edition, see the directory ee/

Closing duplicate the feature is already implemented.

[mehrdad-khojastefar]

thanks for the response, but I couldn't find any logic that shows it saves the audit in a file or log it to the stdout. showing them on the admin dashboard is one thing and having the logs collected is another, could you please provide some more information since I couldn't find any, digging documents and code.

[amirouche]

Spoiler: I am new to the project. I will try to be accurate.

Accessing user recorded sessions can be very dangerous and I would love to have the auditing of the system under my control and have one or two alerts on it.

No everybody can access all replays, of all projects. There are ACLs based on RBAC (Role Based Access Control).

If you are admin, you can review access directly from the Audit menu, here is a screenshot:

Look for the function trace inside the file ee/api/chalicelib/core/traces.py.

Hope it answer your question.

[mehrdad-khojastefar]

So let me explain myself more.
In our infrastructure there are a lot of different services. I am responsible for collecting their audit logs and store them in elasticsearch, that way we can easily follow a suspicious user actions across all of our infrastructure.
That would be hard if I had to login to each and every service from their UI and look for the trace.
Please take a look at this page to see what I mean by having the audit logs
With this approach I can easily collect logs and store them wherever I want. After that I can set some alerts on top of the collected logs.
This is my requirement and it would be very good to have this feature in the openreplay-ui, becase as I said openreplay sessions may contain sensetive data and we need to be aware when an unauthorized access even tried to be achieved.
This owasp article about Logs should be helpful.

[mehrdad-khojastefar]

@amirouche Any thoughts ?

[amirouche]

Thanks for the ping, I missed the previous comment.

collect logs and store them wherever I want. After that I can set some alerts on top of the collected logs.

For programmatic use, you need to read the postgresql table traces, and possibly rely on created_at column in a script that you will create to copy the audit trail logs to your elatissearch cluster. Here is the interesting code snippets from api service in ee:

openreplay/ee/api/chalicelib/core/traces.py

Lines 73 to 81 in 3ada6ae

	async def write_trace(trace: TraceSchema):
	data = __process_trace(trace)
	with pg_client.PostgresClient() as cur:
	cur.execute(
	cur.mogrify(
	f"""INSERT INTO traces(user_id, tenant_id, created_at, auth, action, method, path_format, endpoint, payload, parameters, status)
	VALUES (%(user_id)s, %(tenant_id)s, %(created_at)s, %(auth)s, %(action)s, %(method)s, %(path_format)s, %(endpoint)s, %(payload)s::jsonb, %(parameters)s::jsonb, %(status)s);""",
	data)
	)

Here is the schema of the table traces:

openreplay/ee/scripts/schema/db/init_dbs/postgresql/init_schema.sql

Lines 1274 to 1287 in 3ada6ae

	CREATE TABLE public.traces
	(
	user_id integer NULL REFERENCES public.users (user_id) ON DELETE CASCADE,
	tenant_id integer NOT NULL REFERENCES public.tenants (tenant_id) ON DELETE CASCADE,
	created_at bigint NOT NULL DEFAULT (EXTRACT(EPOCH FROM now() at time zone 'utc') * 1000)::bigint,
	auth text NULL,
	action text NOT NULL,
	method text NOT NULL,
	path_format text NOT NULL,
	endpoint text NOT NULL,
	payload jsonb NULL,
	parameters jsonb NULL,
	status int NULL
	);

If you do not want to connect directly to postgresql, we can consider adding a webhook.

Please take a look at this page to see what I mean by having the audit logs

Is "Audit Trail Log File Format" from jfrog standard in anyway?

Let me know what you think.