FSC audit log format specifications

Format specifications, also known as field renderers, determine the content of the log file. Some are simple and render a single value into the log. These values may come from transactional information, request or response headers, or even a string constant. Others are more complex and provide some analysis. For an example, see the ResponseStreamStatus field renderer. Any renderer can be specified in any audit point but may not be able to produce useful information. They are grouped depending on how they are intended to be used. General renderers Available on all audit points. Text(...) Renders the constant value provided between the parentheses. All white space is ignored. This is used to identify the audit point type. Examples are priopstart, subopstop, and so forth, but could be anything in your environment. Request related renderers Available on all audit points. RequestLine Renders the HTTP request line as presented to the server. RequestMethod Renders the HTTP request method (PUT, GET, POST, and so forth). RequestRemoteAddr Renders the request (client) IP address. RequestHeader(…) Renders the value of any request header. The request name is provided between the parentheses. PrimaryTransactionID Shows the base (primary) transaction ID that can be used to track and correlate a request though the FMS system. Ticket related renderers Available whenever a ticket is available at the given audit point. TicketAccessMethod Renders the numeric access the ticket provides (2, 4, and so forth; see TicketAccessMethodNice). TicketAccessMethodNice Renders the numeric access the ticket provides (see TicketAccessMethod) into easily understood access names: READ, WRITE, ADMINREAD, ADMINWRITE. TicketExpiresTime Renders the ticket expiry time in Coordinated Universal Time (UTC). TicketFileName Renders the file name included in the ticket if there is one. TicketFilestoreIDs Renders the list of filestore IDs (volume IDs) referenced in the ticket. TicketGUID Renders the file GUID. TicketIsBinary Renders the binary flag for the ticket as T or F (see TicketIsBinaryNice). TicketIsBinaryNice Renders the binary flag (see TicketIsBinary) for the ticket in a string as TEXT or BINARY. TicketRaw Renders the entire content of the ticket. TicketRawURLEncoded Renders the entire content of the ticket in URL encoded form. TicketRelativePath Renders the relative path and file name included in the ticket based from the volume root. TicketSignature Renders the signature of the ticket. TicketSiteID Renders the site ID that generated the ticket. This is the same as the fmsenterprise ID. TicketUserID Renders the user ID (userid value) that generated the ticket. TicketVersion Renders the ticket version related to the encryption key as v100, F100, or M050. General operation renderers Available on stop and start audit points. Operation Renders a short description of the operation the FSC is performing. TransactionID For subordinate audit points, renders the transaction ID of the subordinate action with additional decoration to identify the nth subordinate call. For primary audit points, it is the same as the PrimaryTransactionID renderer. Operation stop renderers Available on stop audit points. DeltaMS Renders the delta time in milliseconds from start to stop audit points. StatusCode Renders the resulting status code; it may be an HTTP status or an FSC error code. Message Renders the resulting message; it may be the HTTP status message or some form of error text. TargetBytes Renders the target bytes of the operation. If the value is not known, the output is -1. ActualBytes Renders the actual bytes of the operation. If the value is not known, the output is -1. Response related renderers that require a complete HTTP response Available only on priopstop and webopstop audit points. ResponseHeader(...) Renders the value of any HTTP response header. The name is provided between the parentheses. ResponseStreamStatus Renders the status of the response stream. This renderer attempts to detect if a client’s stream was downloaded completely or truncated. The possible outputs are UNKNOWN, COMPLETE, or TRUNCATED. Any renderer can be included in any audit point output, although it may not be useful. Format errors, such as unknown renderer names (misspellings), do not cause configuration load errors, but the audit log output contains FORMATERROR in the problem fields. Fields that do not have required information present, such as ticket-related renderers when no ticket is present, generally result in null in the output for that field in the audit log. The first output to the audit log writes the current formatting for all enabled audit points. The formatting is also output whenever the audit configuration changes. It does not contain information about audit points that have no formatting configured and are therefore disabled. The following is a sample audit log format output: Copy INFO - 2022/01/26-07:54:51,365 UTC - myhost123 - Active audit entry formats: INFO - 2022/01/26-07:54:51,378 UTC - myhost123 - |,|Text(request)|,|PrimaryTransactionID |,|RequestRemoteAddr|,|RequestHeader(X-Route)|,|RequestHeader(User-Agent)|,|RequestLine|, |RequestHeader(Range)|,| INFO - 2022/01/26-07:54:51,378 UTC - myhost123 - |,|Text(priopstart)|,|PrimaryTransactio nID|,|Operation|,|RequestMethod|,|RequestRemoteAddr|,|RequestHeader(X-Route)|,|RequestHea der(User-Agent)|,|RequestHeader(Range)|,|TicketVersion|,|TicketAccessMethodNice|,|TicketI sBinaryNice|,|TicketSignature|,|TicketExpiresTime|,|TicketUserID|,|TicketSiteID|,|TicketG UID|,|TicketFilestoreIDs|,|TicketRelativePath|,| INFO - 2022/01/26-07:54:51,378 UTC - myhost123 - |,|Text(priopstop)|,|PrimaryTransaction ID|,|StatusCode|,|Message|,|ResponseHeader(Content-Encoding)|,|TargetBytes|,|ActualBytes| ,|ResponseStreamStatus|,|DeltaMS|,| INFO - 2022/01/26-07:54:51,378 UTC - myhost123 - |,|Text(subopstart)|,|TransactionID|,|O peration|,|TicketVersion|,|TicketAccessMethodNice|,|TicketIsBinaryNice|,|TicketSignature| ,|TicketExpiresTime|,|TicketUserID|,|TicketSiteID|,|TicketGUID|,|TicketFilestoreIDs|,|Tic ketRelativePath|,| INFO - 2022/01/26-07:54:51,378 UTC - myhost123 - |,|Text(subopstop)|,|TransactionID|,|St atusCode|,|Message|,|DeltaMS|,| INFO - 2022/01/26-07:54:51,378 UTC - myhost123 - |,|Text(webopstart)|,|PrimaryTransactio nID|,|Operation|,|RequestMethod|,|RequestRemoteAddr|,|RequestHeader(User-Agent)|,|Request Line|,| INFO - 2022/01/26-07:54:51,378 UTC - myhost123 - |,|Text(webopstop)|,|PrimaryTransaction ID|,|StatusCode|,|Message|,|ResponseHeader(Content-Encoding)|,|TargetBytes|,|ActualBytes| ,|ResponseStreamStatus|,|DeltaMS|,| The following is sample audit log output based on the previous configuration: Copy INFO - 2022/01/26-07:54:51,379 UTC - myhost123 - |,|request|,|(-7316198962075068416)fsc _s6|,|127.0.0.1|,|null|,|FMS-FSCJavaClientProxy/8.2 (bd:20220119)|,|GET /mapClientIPToFS Cs?client= HTTP/1.1|,|null|,| INFO - 2022/01/26-07:54:51,380 UTC - myhost123 - |,|webopstart|,|(-7316198962075068416) fsc_s6|,|BootstrapHandler|,|GET|,|127.0.0.1|,|FMS-FSCJavaClientProxy/8.2 (bd:20220119)|, |GET /mapClientIPToFSCs?client= HTTP/1.1|,| INFO - 2022/01/26-07:54:51,381 UTC - myhost123 - |,|webopstop|,|(-7316198962075068416)f sc_s6|,|200|,|OK|,|null|,|57|,|57|,|COMPLETE|,|1|,| INFO - 2022/01/26-07:54:51,384 UTC - myhost123 - |,|request|,|(-7316198962075068415)fsc s6|,|127.0.0.1|,|null|,|FMS-FSCAdmin/8.2 (bd:20220225) Java/1.5.0_11|,|GET / HTTP/1.1|, |null|,| INFO - 2022/01/26-07:54:51,385 UTC - myhost123 - |,|priopstart|,|(-7316198962075068415) fsc_s6|,|CacheCommands$ClearCommand|,|GET|,|127.0.0.1|,|null|,|FMS-FSCAdmin/8.2 (bd:2022 0125) Java/1.5.0_11|,|null|,|v100|,|ADMINREAD|,|BINARY|,|739388a12ef48c3473e19bd78049661 6b989cf3b8bab1f5d5dfd0bb22a7d71db|,|2022/01/26 07:56:51|,|FSCAdmin|,||,|noguid |,|[]|,|./clearcache|,| INFO - 2022/01/26-07:54:51,388 UTC - myhost123 - |,|priopstop|,|(-7316198962075068415)f sc_s6|,|200|,|OK|,|null|,|17|,|17|,|COMPLETE|,|3|,| INFO - 2022/01/26-07:55:14,180 UTC - myhost123 - |,|request|,|(-362480191128027786)fsc s7[1]>fsc_s6|,|127.0.0.1|,|fms.teamcenter.com^fsc_s7,fms.teamcenter.com^fsc_s6|,|FMS-FSC /8.2 (bd:20220225) Java/1.5.0_11|,|GET /tc/fms/fms.teamcenter.com/g2/fsc_s6 HTTP/1.1|,|n ull|,| INFO - 2022/01/26-07:55:14,180 UTC - myhost123 - |,|priopstart|,|(-362480191128027786)f sc_s7[1]>fsc_s6|,|CoordinatorVolumeState|,|GET|,|127.0.0.1|,|fms.teamcenter.com^fsc_s7,f ms.teamcenter.com^fsc_s6|,|FMS-FSC/8.2 (bd:20220225) Java/1.5.0_11|,|null|,|v100|,|ADMIN READ|,|BINARY|,|ca124695734bb33ee6e65ba0fdbc087587214de0b43d8da2c2eb8353a3d92e89|,|2022/ 01/26 07:57:11|,|nouser|,||,| |,|[]|,|fsc_s6/config/volum estate/nvargs/action=get;enterpriseid=fms.teamcenter.com|,| INFO - 2022/01/26-07:55:14,181 UTC - myhost123 - |,|priopstop|,|(-362480191128027786)fs c_s7[1]>fsc_s6|,|200|,|OK|,|null|,|6|,|6|,|COMPLETE|,|1|,| The following figure shows a sample format specification for a primary start operation that can be used to track access to a dataset files by users, the associated portion of the format output, and the resulting portion in the log file output for a sample transaction. The TicketFileName and TicketUserID renders are added to the format specification as shown in the top section. This results in the user ID and accessed file name values in the output file as shown in the bottom section. You may also notice the file name value appears in the output for the TicketRelativePath render, making it unnecessary to include the TicketFileName render in this instance.