AUDIT LOG FILE - Githubissues

joaosimoes08 commented 10 months ago

Attempted Debugging

[X] I have read the debugging page

Searched GitHub Issues

[X] I have searched GitHub for the issue.

Describe the Scenario

I want to filter some logs to my SIEM but I can´t find any file on bookstack's docker that contains that info. Are audit logs saved to a file?

Exact BookStack Version

v23.10.4

Log Content

No response

Hosting Environment

Docker on Ubuntu 22.04

ssddanbrown commented 10 months ago

Are audit logs saved to a file?

No. The audit log you see in the BookStack interface is sourced from the activities table within the database. If desired, our logical theme system has the ability to use PHP code to hook into activity events to run custom logic (where you could then write to a log file if desired).

joaosimoes08 commented 10 months ago

No. The audit log you see in the BookStack interface is sourced from the activities table within the database. If desired, our logical theme system has the ability to use PHP code to hook into activity events to run custom logic (where you could then write to a log file if desired).

I am trying to send all the logs to a file but I am deploying bookstack using docker. Should I add APP_THEME= to the compose.yml? My code looks like this (still need to add the other activities but I am not able to output any file and I don´t see any error...):

`<?php

use BookStack\Actions\ActivityType; use BookStack\Entities\Models\Page; use BookStack\Facades\Theme; use BookStack\Theming\ThemeEvents;

Theme::listen(ThemeEvents::ACTIVITY_LOGGED, function (string $activityType, $detail) {

if (!$detail instanceof Page) {
    return;
}

$validTypes = [ActivityType::PAGE_UPDATE, ActivityType::PAGE_CREATE];
if (!in_array($activityType, $validTypes)) {
    return;
}

$outPath = "/config/{$detail->id}.html";
file_put_contents($outPath, $detail->html);

});

?>`

ssddanbrown commented 10 months ago

Should I add APP_THEME= to the compose.yml?

Yes, it'll need to align with the name of your theme folder, and your theme folder will need to be in the right place. I have a video on setting up the theme folder in a linuxserver.io stack here: https://www.youtube.com/watch?v=Tf74_2iphz0

As a theme functions.php example:

<?php

use BookStack\Activity\ActivityType;
use BookStack\Activity\Models\Loggable;
use BookStack\Theming\ThemeEvents;
use BookStack\Facades\Theme;

Theme::listen(ThemeEvents::ACTIVITY_LOGGED, function (string $type, string|Loggable $detail) {

    // The path to log events to.
    // The webserver/php process will need permission to write here
    $logFile = storage_path('logs/activity.log');

    // Activities to log.
    // Remove this and the below "if" block to not filter by activity.
    $activitiesToLog = [
        ActivityType::BOOK_CREATE,
        ActivityType::BOOK_UPDATE,
        ActivityType::PAGE_UPDATE,
    ];
    if (!in_array($type, $activitiesToLog)) {
        return;
    }

    // Build the log line
    $detailMsg = is_string($detail) ? $detail : $detail->logDescriptor();
    $user = user();
    $date = date(DATE_RFC3339);
    $logMessage = "[{$date}] {$type} :: user {$user->id} :: $detailMsg \n";

    // Append the log line
    file_put_contents($logFile, $logMessage, FILE_APPEND);
});