Audit Logging

Description

@Pengfei Cui - Are you familiar with Envers? If this is a feasible solution, @Mary Jo Kochendorfer and I will work through our ERD model and define which classes and class variables should be audited. Please schedule some time to discuss with me.

As an administrator, I want an audit log/trail on any object or process in the system. For example, I want to know who changed values on a Facility record, changes to a Requisition template, a log of the approvals on a Requisition, log of all requisition status changes.

These examples were deliberately chosen to show logging on 1) individual record/entity 2) to a composed entity (a Req template is likely a composition of many sub-objects), or a process. This may call for different types of logging. We may also wish to configure which entities are logged, e.g. do we really need to log changes on everything?

Levels
Individual record/entity logging
Composed entity (requisition template, order file template)
Process

Application usage

This might be its own epic.

Acceptance:

The system logs changes for entities, including the old value, new value, the user who made the change, and the change date.
The audit trail for a given object may be easily retrieved (via API) and displayed in the UI
Audit log feature may be easily leveraged by any OpenLMIS independent Service

Linked work items

is blocked by

OLMIS-1389

Spike on JaVers / Envers

relates to

OLMIS-737

Publish OpenLMIS logging convention

OLMIS-1102

RequisitionEvent capability for extension

QAlity Plus - Test Management

Checklists

Activity

Show:

Mary Jo Kochendorfer

January 26, 2017 at 5:20 PM

Let's audit everything wholesale for now.

Brandon Bowersox-Johnson

January 26, 2017 at 6:37 AM

Okay, I marked this Dead. I'll ask MJ (and you and Josh) about how much to audit when we talk at stand-up in the morning.

Ben Leibert

January 26, 2017 at 6:33 AM

(edited)

Hi @Brandon Bowersox-Johnson. This ticket is highly important because it documents the fact that I should have been awarded 21 points, rather than 5, for OLMIS-1389. We should definitely thus keep the ticket! ; )

On a serious note, most of the work in this ticket:

A) Has been done already, or
B) Will likely be described in tickets Josh (and perhaps I) plan to write tomorrow.

This ticket mentions one thing, however, which hasn’t been obviated by other work or planned tickets. It says that “Mary Jo Kochendorfer and I will work through our ERD model and define which classes and class variables should be audited.” It’s worth considering whether we want to do this work rather than simply auditing everything wholesale.

Given that a fair amount of this ticket’s work has been addressed, I’d suggest marking it as dead and perhaps creating a ticket to explore what we really want audited. (Maybe the answer is simple and we really do want everything. I’ve seen/heard conflicting things, though, and think it may thus be good to clarify.)

Brandon Bowersox-Johnson

January 26, 2017 at 5:59 AM

@Ben Leibert I just noticed this ticket in our 3.0 backlog. Now that the audit logging spike is mostly complete, is this ticket relevant at all? Or should we mark it "Dead"?

Josh Zamor

November 18, 2016 at 6:54 AM

A spike has been created, OLMIS-1389, after this story was estimated. The 21 points should likely be re-visited after the spike is complete.

Resize work item view side panel

Won't Fix

Pinned fields

Click on the next to a field label to start pinning.

Details

Assignee

Unassigned

Reporter

Kevin Cussen(Deactivated)

Story Points

Components

Architecture

Priority

Major

Parent

OLMIS-584 OpenLMIS Dev and Build infrastructure

Time Assistant

Created May 9, 2016 at 11:35 PM

Updated February 8, 2023 at 1:29 PM

Resolved January 26, 2017 at 6:36 AM