Log / audit what user / identity executed an (write) action

[TraGicCode]

Hello,

It would be nice if users had to authenticate and that could be used to audit what users perform what actions. Right now i feel as if there is no visibility in what users are doing what.

I want to be able to see:

• Who archived a mesage
• Who retried a message

[tmasternak]

Hi, @TraGicCode thank you for opening the issue. I think you are right that better support for authentication and authorization (e.g. roles) would be a necessary step to enable such an auditing functionality.

I've marked this issue as a potential feature to be added in the future. We will share any updates in the description so that you get notified.

[ramonsmits]

@TraGicCode There are basically 2 separate things:

1. Access control
2. Auditing of tasks

For clarity, this issue focusses on the 2nd

[YurivanRuler]

Hi, I would find the functionality of auditing tasks very useful. As discussed with @ramonsmits in a Particular Support Ticket we experienced some issues with deleting large message groups. We lacked insight in what happened in the system after starting the deletion task in the UI. After some months of repeately restarting the deletion task the issue resolved itself without human interaction (as far as I know). It would be nice to have some insight in what tasks are initiated by users.

[ramonsmits]

This could potentially we expanded. Not only log that task was executed but also who VIEWED which message (group), etc. Especially message details can contain sensitive information.

I think this first should start with:

• Track what actions have been performed
• Track WHO performed this

Especially now that more users are hosting ServicePulse/Control behind a authenticating reverse proxy passing/logging information from commonly used headers for identity like X-Remote-User, X-Remote-Email could be used.

What header(s) to use could be a configuration option. (i.e. SERVICECONTROL_AUTH_HEADER=X-Remote-Email)

[andreasohlund]

I've been in touch with a Swedish company in the banking sector that would be interested in this given the high requirements for traceability in the banking sector

[jasontaylordev]

Good news! ServiceControl 6.11.0 and ServicePulse 2.5.0 will include authentication support (JWT, OpenID Connect, OAuth 2.0).

This is an important step toward enabling the audit logging requested here. With authentication in place, we'll have the foundation needed to track user identities for actions like archiving/retrying messages and initiating tasks.

Documentation will be available at https://docs.particular.net/ once released.

We look forward to your feedback once these features are released!

[fredricadell]

I work in the insurance sector in the EU and we would want to have the following in the log:

• Track what actions have been performed
• Track the user that performed the action
• If a message was edited before sending, what was edited
• Timestamp

The above is a minimum for us to have the possiblility to enable edit a message before resending.

• Structured log format that can be sent to a central logging system (Elastic, Splunk .. ) We have long storage time for logs, minimum 5 years.

[ramonsmits]

• Structured log format that can be sent to a central logging system (Elastic, Splunk .. ) We have long storage time for logs, minimum 5 years.

@fredricadell thanks for your input. Do you have any structure preference? There is potentially Elastic Common Schema (ECS) that can be used.

Can you suggest any schemas?

[fredricadell]

@ramonsmits For us ECS would be great since we use Elastic, but as long as its structured and we can map the logs thats fine. We use logstash for our custom logevents today and just make a mapping of those events.

[ramonsmits]

Help us design authorization for ServicePulse and ServiceControl. We'd appreciate your feedback in our community discussion on our forum or on this issue, or privately via support@particular.net

[WilliamBZA]

This will released in 6.18.0