Publishing Login events over HTTP or Log files in WSO2 IS

This article contains the quick steps to publish the Login events over HTTP in WSO2 IS & Log Files. This will help to integrate with other analytics engines like ELK stack or Splunk.

Follow the steps to publish events over HTTP

1. Enable data publishing by adding the following configuration to deployment.toml (refer doc)

2. The publisher configs can be found in location {IS_HOME}/repository/deployment/server/eventpublishers directory. We can make a copy of IsAnalytics-Publisher-wso2event-AuthenticationData.xml and rename it as IsAnalytics-Publisher-wso2event-AuthenticationDataCustom.xml

3. Modify the IsAnalytics-Publisher-wso2event-AuthenticationDataCustom.xml file to publish data over HTTP.

(Note: Authorization tokens created can be included as HTTP header in the event publisher)

4. Now restart the server.

Follow the steps to publish events to Logs

1. Enable data publishing by adding the following configuration to deployment.toml (refer doc)

2. The publisher configs can be found in location {IS_HOME}/repository/deployment/server/eventpublishers directory. We can make a copy of IsAnalytics-Publisher-wso2event-AuthenticationData.xml and rename it as IsAnalytics-Publisher-wso2event-AuthenticationDataCustom.xml

3. Modify the IsAnalytics-Publisher-wso2event-AuthenticationDataCustom.xml file to publish data over Logs.

(Note: Using uniqueID different events published can be separated out easily)

4. Add the following config to {IS_HOME}/repository/conf/log4j2.properties to publish data into a different log file

Add to appenders like

appenders = {other appenders} , CUSTOM_LOGFILE

Then add appender configs

(Note: To change the file location & name, edit parameter fileName & filePattern )

appender.CUSTOM_LOGFILE.type = RollingFile
appender.CUSTOM_LOGFILE.name = CUSTOM_LOGFILE
appender.CUSTOM_LOGFILE.fileName =${sys:carbon.home}/repository/logs/custom.log
appender.CUSTOM_LOGFILE.filePattern = ${sys:carbon.home}/repository/logs/custom-%d{MM-dd-yyyy}.%i.log
appender.CUSTOM_LOGFILE.layout.type = PatternLayout
appender.CUSTOM_LOGFILE.layout.pattern=TID: [%tenantId] [%appName] [%d] [%X{Correlation-ID}] %5p {%c} — %mm%ex%n
appender.CUSTOM_LOGFILE.policies.type = Policies
appender.CUSTOM_LOGFILE.policies.time.type = TimeBasedTriggeringPolicy
appender.CUSTOM_LOGFILE.policies.time.interval = 1
appender.CUSTOM_LOGFILE.policies.time.modulate = true
appender.CUSTOM_LOGFILE.policies.size.type = SizeBasedTriggeringPolicy
appender.CUSTOM_LOGFILE.policies.size.size=10MB
appender.CUSTOM_LOGFILE.strategy.type = DefaultRolloverStrategy
appender.CUSTOM_LOGFILE.strategy.max = 20
appender.CUSTOM_LOGFILE.filter.threshold.type = ThresholdFilter
appender.CUSTOM_LOGFILE.filter.threshold.level = INFO

Now point component the org.wso2.carbon.event.output.adapter.logger.LoggerEventAdapter to the custom appender. Refer doc for more details.

logger.org-wso2-carbon-event.output-adapter-logger-LoggerEventAdapter.name=org.wso2.carbon.event.output.adapter.logger.LoggerEventAdapter
logger.org-wso2-carbon-event.output-adapter-logger-LoggerEventAdapter.level=INFO
logger.org-wso2-carbon-event.output-adapter-logger-LoggerEventAdapter.appenderRef.CUSTOM_LOGFILE.ref=CUSTOM_LOGFILE

Now add org.wso2.carbon.event.output.adapter.logger.LoggerEventAdapter to loggers

loggers = {existing loggers}, org-wso2-carbon-event.output-adapter-logger-LoggerEventAdapter

4. Now restart the server

(Note: publisher.xmls & log4j2.properties are hot deployments file which means you can alter them in the run time as well)

Depend on the environment traffic & fault tolerance you can choose either option to publish data. Similar to the login publisher we can publish the events from other publisher.xml as well.