audit_logging: Remove debug log header and JSON Authentication: prefix

Feedback from real-world users is that they really want raw JSON
strings in the log.

We can not easily remove the leading "  " but the other strings above
and before the JSON are really annoying to strip back off

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13714

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>

diff --git a/auth/auth_log.c b/auth/auth_log.c
index 2d4e33f53bf96be7824a01429c49528cd448f702..15a2c15c489b1b1fa7375f414e98d3bfd3928997 100644 (file)
--- a/auth/auth_log.c
+++ b/auth/auth_log.c
@@ -78,11 +78,10 @@ static const char* get_password_type(const struct auth_usersupplied_info *ui);
 static void log_json(struct imessaging_context *msg_ctx,
                     struct loadparm_context *lp_ctx,
                     struct json_object *object,
-                    const char *type,
                     int debug_class,
                     int debug_level)
 {
-       audit_log_json(type, object, debug_class, debug_level);
+       audit_log_json(object, debug_class, debug_level);
        if (msg_ctx && lp_ctx && lpcfg_auth_event_notification(lp_ctx)) {
                audit_message_send(msg_ctx,
                                   AUTH_EVENT_NAME,
@@ -102,9 +101,8 @@ static void log_json(struct imessaging_context *msg_ctx,
  *  To process the resulting log lines from the commend line use jq to
  *  parse the json.
  *
- *  grep "JSON Authentication" log file |
- *  sed 's;^[^{]*;;' |
- * jq -rc  '"\(.timestamp)\t\(.Authentication.status)\t
+ *  grep "^  {" log file |
+ *  jq -rc '"\(.timestamp)\t\(.Authentication.status)\t
  *           \(.Authentication.clientDomain)\t
  *           \(.Authentication.clientAccount)
  *           \t\(.Authentication.workstation)
@@ -272,7 +270,6 @@ static void log_authentication_event_json(
        log_json(msg_ctx,
                 lp_ctx,
                 &wrapper,
-                AUTH_JSON_TYPE,
                 DBGC_AUTH_AUDIT,
                 debug_level);
        json_free(&wrapper);
@@ -300,8 +297,7 @@ failure:
  *  To process the resulting log lines from the commend line use jq to
  *  parse the json.
  *
- *  grep "JSON Authentication" log_file |\
- *  sed "s;^[^{]*;;" |\
+ *  grep "^  {" log_file |\
  *  jq -rc '"\(.timestamp)\t
  *           \(.Authorization.domain)\t
  *           \(.Authorization.account)\t
@@ -409,7 +405,6 @@ static void log_successful_authz_event_json(
        log_json(msg_ctx,
                 lp_ctx,
                 &wrapper,
-                AUTHZ_JSON_TYPE,
                 DBGC_AUTH_AUDIT,
                 debug_level);
        json_free(&wrapper);

diff --git a/lib/audit_logging/audit_logging.c b/lib/audit_logging/audit_logging.c
index acccb9f7ab9611b90f388a66a6419c14c799d2df..644f72e09e129fa0578733cbb0f1295a54d656f0 100644 (file)
--- a/lib/audit_logging/audit_logging.c
+++ b/lib/audit_logging/audit_logging.c
@@ -105,13 +105,11 @@ const struct json_object json_empty_object = {.valid = false, .root = NULL};
  *
  * Write the json object to the audit logs as a formatted string
  *
- * @param prefix Text to be printed at the start of the log line
  * @param message The content of the log line.
  * @param debub_class The debug class to log the message with.
  * @param debug_level The debug level to log the message with.
  */
-void audit_log_json(const char* prefix,
-                   struct json_object* message,
+void audit_log_json(struct json_object* message,
                    int debug_class,
                    int debug_level)
 {
@@ -126,13 +124,20 @@ void audit_log_json(const char* prefix,
        ctx = talloc_new(NULL);
        s = json_to_string(ctx, message);
        if (s == NULL) {
-               DBG_ERR("json_to_string for (%s) returned NULL, "
-                       "JSON audit message could not written\n",
-                       prefix);
+               DBG_ERR("json_to_string returned NULL, "
+                       "JSON audit message could not written\n");
                TALLOC_FREE(ctx);
                return;
        }
-       DEBUGC(debug_class, debug_level, ("JSON %s: %s\n", prefix, s));
+       /*
+        * This is very strange, but we call this routine to get a log
+        * output without the header.  JSON logs all have timestamps
+        * so this only makes parsing harder.
+        *
+        * We push out the raw JSON blob without a prefix, consumers
+        * can find such lines by the leading {
+        */
+       DEBUGADDC(debug_class, debug_level, ("%s\n", s));
        TALLOC_FREE(ctx);
 }
 

diff --git a/lib/audit_logging/audit_logging.h b/lib/audit_logging/audit_logging.h
index 5f095c0df9a4413a4fde3c19e67743279c88b3f4..86e9134a86a0df79720cd0f85e7a37bc2e0a23e6 100644 (file)
--- a/lib/audit_logging/audit_logging.h
+++ b/lib/audit_logging/audit_logging.h
@@ -43,8 +43,7 @@ extern const struct json_object json_empty_object;
 
 #define JSON_ERROR -1
 
-void audit_log_json(const char *prefix,
-                   struct json_object *message,
+void audit_log_json(struct json_object *message,
                    int debug_class,
                    int debug_level);
 void audit_message_send(struct imessaging_context *msg_ctx,

diff --git a/source4/dsdb/samdb/ldb_modules/audit_log.c b/source4/dsdb/samdb/ldb_modules/audit_log.c
index 44726b65a3bb8f58b0093f5a6706b763cefbe163..86a02f2c406975e4a7c4de7f2d9d5f0ed8761978 100644 (file)
--- a/source4/dsdb/samdb/ldb_modules/audit_log.c
+++ b/source4/dsdb/samdb/ldb_modules/audit_log.c
@@ -1135,7 +1135,6 @@ static void log_standard_operation(
                struct json_object json;
                json = operation_json(module, request, reply);
                audit_log_json(
-                       OPERATION_JSON_TYPE,
                        &json,
                        DBGC_DSDB_AUDIT_JSON,
                        OPERATION_LOG_LVL);
@@ -1156,7 +1155,6 @@ static void log_standard_operation(
                        struct json_object json;
                        json = password_change_json(module, request, reply);
                        audit_log_json(
-                               PASSWORD_JSON_TYPE,
                                &json,
                                DBGC_DSDB_PWD_AUDIT_JSON,
                                PASSWORD_LOG_LVL);
@@ -1215,7 +1213,6 @@ static void log_replicated_operation(
                struct json_object json;
                json = replicated_update_json(module, request, reply);
                audit_log_json(
-                       REPLICATION_JSON_TYPE,
                        &json,
                        DBGC_DSDB_AUDIT_JSON,
                        REPLICATION_LOG_LVL);
@@ -1303,7 +1300,6 @@ static void log_transaction(
                        &audit_private->transaction_guid,
                        duration);
                audit_log_json(
-                       TRANSACTION_JSON_TYPE,
                        &json,
                        DBGC_DSDB_TXN_AUDIT_JSON,
                        log_level);
@@ -1374,7 +1370,6 @@ static void log_commit_failure(
                        reason,
                        &audit_private->transaction_guid);
                audit_log_json(
-                       TRANSACTION_JSON_TYPE,
                        &json,
                        DBGC_DSDB_TXN_AUDIT_JSON,
                        log_level);

diff --git a/source4/dsdb/samdb/ldb_modules/group_audit.c b/source4/dsdb/samdb/ldb_modules/group_audit.c
index 47b69435195ecf8c151e84839b2a90a166736eb6..7e6e16de137b22295fad45616baa3e0aca92fb12 100644 (file)
--- a/source4/dsdb/samdb/ldb_modules/group_audit.c
+++ b/source4/dsdb/samdb/ldb_modules/group_audit.c
@@ -504,7 +504,6 @@ static void log_primary_group_change(
                        group,
                        status);
                audit_log_json(
-                       AUDIT_JSON_TYPE,
                        &json,
                        DBGC_DSDB_GROUP_AUDIT_JSON,
                        GROUP_LOG_LVL);
@@ -577,7 +576,6 @@ static void log_membership_change(
                        group,
                        status);
                audit_log_json(
-                       AUDIT_JSON_TYPE,
                        &json,
                        DBGC_DSDB_GROUP_AUDIT_JSON,
                        GROUP_LOG_LVL);