2

I am trying to find audit logs corresponding to users in the Sitecore domain - in application insights for my CM web app. I am looking at the -ai app and searching with EventType = Trace.

I have validated that the log level in the config is set to INFO. But no login records are being returned for months.

I logged in myself several times within the past month, but those records are not reflected either. Is there a reliable way to get Login Audit logs from Application Insights?

2 Answers 2

2

Assume that the Application Insights have been configured and the logging data is being collected correctly.

The info/audit information to trace the Login events you can find in the traces table. A simple query will be:

traces
| where itemType == "trace"
| where customDimensions.Role == "CM" 
| where operation_Name contains "login"

Sitecore Identity role registers log messages into the customEvents table.

0

Application insights may not be a reliable source for logs in Sitecore as they have daily storage limits of 0.33GB. once you reach the limit, it will stop recording the logs.

Instead of depending on Application Insight, you can capture the Audit log files within the Sitecore Content Management instance by adding the config patch as below

<configuration xmlns:patch="http://www.sitecore.net/xmlconfig/" xmlns:x="http://www.sitecore.net/xmlconfig/">
    <sitecore>
        <log4net>
            <appender name="CustomLogFileAppender" type="log4net.Appender.SitecoreLogFileAppender, Sitecore.Logging">
                <file value="$(dataFolder)/logs/CustomAudit/Custom.Audit.Log.{date}.txt" />
                <filter type="log4net.Filter.StringMatchFilter">
                        <stringToMatch value="AUDIT" />
                        <acceptOnMatch value="true" />
                </filter>
                <filter type="log4net.Filter.DenyAllFilter" />
                  <appendToFile value="true" />
                  <rollingStyle value="Date" />
                  <maxSizeRollBackups value="-1" />
                  <layout type="log4net.Layout.PatternLayout">
                    <conversionPattern value="%d{yyyy-MM-dd HH:mm:ss.fff} %-5p %m%n" />                
                  </layout>
                <encoding value="utf-8" />
            </appender>
            <root>
              <priority value="INFO" />
              <appender-ref ref="CustomLogFileAppender" />
            </root>
            <logger name="CustomLogFileAppender" additivity="false">
              <level value="INFO" />
              <appender-ref ref="CustomLogFileAppender" />
            </logger>
        </log4net>
    </sitecore>
</configuration>```

This config will capture all the Audit details.
 

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.