3.8.3. About a Management Interface Audit Logging Formatter

The formatter specifies the format of the log entries. Only one formatter is available, which outputs log entries in JSON format. Each log entry begins with an optional timestamp, then the fields listed in the JSON Formatter Fields table.
The JSON Formatter Attributes table lists all the attributes which can be used to change the formatting of the log entries.

Table 3.5. JSON Formatter Attributes

Attribute Description
include-date Boolean value which defines whether or not the timestamp is included in the formatted log records.
date-separator A string containing characters to separate the date and the rest of the formatted log message. This is ignored if include-date=false.
date-format The date format to use for the timestamp as understood by java.text.SimpleDateFormat. Ignored if include-date=false.
compact If true it will format the JSON on one line. There may still be values containing new lines, so if having the whole record on one line is important, set escape-new-line or escape-control-characters to true.
escape-control-characters If true it will escape all control characters (ASCII entries with a decimal value < 32) with the ASCII code in octal; for example, a new line becomes '#012'. If this is true, it will override escape-new-line=false.
escape-new-line If true it will escape all new lines with the ASCII code in octal; for example #012.

Table 3.6. JSON Formatter Fields

Field Name Description
type This can have the values core, meaning it is a management operation, or jmx meaning it comes from the JMX subsystem (see the JMX subsystem for configuration of the JMX subsystem's audit logging).
r/o Has the value true if the operation does not change the management model, false otherwise.
booting Has the value true if the operation was executed during the bootup process, false if it was executed once the server is up and running.
version The version number of the JBoss EAP instance.
user The username of the authenticated user. If the operation occurs via the Management CLI on the same machine as the running server, the special user $local is used.
domainUUID An ID to link together all operations as they are propagated from the domain controller to its servers, slave host controllers, and slave host controller servers.
access This can have one of the following values:
  • NATIVE - The operation came in through the native management interface, for example the Management CLI.
  • HTTP - The operation came in through the domain HTTP interface, for example the Management Console.
  • JMX - The operation came in through the JMX subsystem. See JMX for how to configure audit logging for JMX.
remote-address The address of the client executing this operation.
success Has the value true if the operation succeeded, false if it was rolled back
ops The operations being executed. This is a list of the operations serialized to JSON. At boot this is the operations resulting from parsing the XML. Once booted the list typically contains a single entry.