Audit Logger

Listens for fresh quotes and audit events on RMQ and writes them to an xml log file.

Installing

git clone https://github.com/DistributedDesigns/audit_logger.git

.scripts/install

# Start dependent services
# Assumes there's an RMQ running somewhere
docker-compose up

# Run with one of
$GOPATH/bin/audit_logger
go run *.go

Prod deploy notes

CentOS enables SE linux by default. This prevents sql/auditInit.sql from running on startup. The solution, as will all security inconveniences, is to disable security!

• su -c "setenforce 0"

Monitored Queues

Active

Other services intentionally create messages to send to the logger on these queues.

• audit_event -> Something to be written to the audit log, like a <userCommand>. Message is a serialized AuditEvent.
• dumplog -> Requests for user activity logs. Message is a serialized DumplogRequest.

Passive

The logger snoops on these messages and records them.

• quote_broadcast -> #.fresh quotes are logged as <quoteServer> events.

Sending RMQ messages

Sending messages to control / debug the logger is useful. You can do this through the Management interface or with the rabbitmqadmin CLI. You can also generate quote traffic for snooping with the fake_quote_server, quote_manager and rmq_proto repos.

Notes

• Insertion is slow! With a high volume of logs it takes a while for PG to chew through the backlog of events in Redis.
• Validate logs with ./script/validate logs/<your-log>.xml