Gateway's audit log of user actions is designed for machine parsing so it can be used for auditing, compliance monitoring, API request analysis, and SLA reporting.

See Gateway Configuration for configuring the logging output.

Audit Log Message Fields

This section focuses on the format of the audit logs to allow for integration and development of applications that use them.

These are the fields that appear in logging output. These are only definitions and not the format of any particular log message.

Audit Log Message Formats

Following are the output formats for all event types. All log messages share a common set of prefix fields, which includes a message type. The suffix fields in a log message are variable based on the message type. This allows for automated parsing of log messages.

The fields in each log message are separated by spaces. If a field value is missing, the string (none) is substituted. Field values are subject to HTML URL encoding to make spaces, UTF-8, and other special characters safe for inclusion in the audit log entry.

• Alphanumeric characters "a" through "z", "A" through "Z" and "0" through "9" remain unchanged

• Characters ".", "-", "*", and "_" remain unchanged

• Space character is converted into a plus sign "+"

• All other characters are converted into %HH byte values using UTF-8 encoding

Common Prefix Fields

All messages are prefixed by the following fields in this order:

1. Timestamp

2. Log Level

3. Request ID

4. Record Format Version

5. Source IP

6. DNS Domain

7. Message Type

8. Operation

9. Auth User

10. Auth Domain

11. HTTP Code

12. Source Bytes

13. Response Bytes

14. Elapsed Time

Suffix Fields

This table defines the suffix fields that are included with each log message following the common prefix fields.

Example Log Messages

These are examples of a variety of audit log messages.

Successful login for user muser1 to the domain nom.dom.com

Successful POST of a bucket named redbucket by user admin1

401 authentication challenge on a HEAD to an unauthenticated request

Writing an object named water.jpg to bucket bluebucket without being required to authenticate

Reading an object named water.jpg to bucket bluebucket without being required to authenticate

Listing a bucket without being required to authenticate

Listing a domain as user admin1

Administrative override and replacement of domain's Policy by user superuser from root IDSYS

Behaviors of Operations

Interrupted GET: When a GET operation is interrupted, such as if the socket closed unexpectedly prior to reading all data, the audit log may record an HTTP 200 response with response bytes equal to the size of the object. When interruption takes place, an HTTP 500 response is logged with response bytes equal to the actual number of bytes transmitted.

Duplicate Request IDs: All messages have the same Request ID so they can be correlated with the client request if multiple messages are logged from one client operation. For example, the recursive delete operation generates synthetic delete requests all with the same Request ID.

INVOKE operations: The optional feature Video Clipping (v11.0) logs INVOKE operations. Each video clipping event logs multiple events to provide auditing through the process, which may take a while to complete. When you create a video clip, Gateway acknowledges the request with an INVOKE message. See Video Clipping for Partial File Restore.

Application-Supplied Tag

Gateway's audit logging allows for the client application to supply a custom tag that can be used to correlate multiple audit log entries to one application-level transaction. The application specifies this tag in a Gateway-Audit-Id request header and it must be alpha-numeric and is truncated at 32 characters. When this optional tag is received, the Request ID field of the audit log entry contains the automatically-generated request identifier from the Gateway, a dash ("-"), and the application-supplied tag.

Example of a normal request identifier and one with the application supplied tag trans123

When the application-supplied tag is used for multiple operations, even across multiple Gateway servers, the request identifiers remain unique with a common suffix.