Main settings:
Changed in version 2.17.0.
Attention
Regexp must start and end with a slash / character.
LemonLDAP::NG provides 5 levels of error and has two kinds of logs:
Each category can be handle by a different logging framework. You can choose between:
Attention
Except for Apache2 and Log4Perl, log level is defined by logLevel parameter set in lemonldap-ng.ini file. Logger configurations are defined in lemonldap-ng.ini. Example:
[all]
logger = Lemonldap::NG::Common::Logger::Log4perl
userLogger = Lemonldap::NG::Common::Logger::Syslog
logLevel = notice
You can also modify these values in each lemonldap-ng.ini section to have different values for portal, manager and handlers.
Therefore, LLNG provides a username that can be used by web servers in their access logs. To configure the user identifier to write into access logs, go to Manager, General Parameters > Logging > REMOTE_USER.
Note
The user name set in user log messages is set with whatToTrace parameter, except for messages corresponding to failed authentifications, when the user name logged is the login used by the user.
Authentication:
[info] User dwho successfully authenticated at level 2
[info] User dwho connected from LDAP (81.20.13.21)
Failed authentication:
[warn] foo.bar was not found in LDAP directory (81.20.13.21)
[warn] Bad password for dwho (81.20.13.21)
Failed authentication with Combination module:
[warn] All schemes failed for user dwho (81.20.13.21)
Logout:
[notice] User dwho has been disconnected from LDAP (81.20.13.21)
Password change:
[notice] Password changed for dwho (81.20.13.21)
Access to a CAS application non registered in configuration (when CAS server is open):
[notice] User dwho is redirected to https://cas.service.url
Access to a CAS application whose configuration key is app-example:
[notice] User dwho is authorized to access to app-example
Access to an SAML SP whose configuration key is sp-example:
[notice] User dwho is authorized to access to sp-example
Access to an OIDC RP whose configuration key is rp-example:
[notice] User dwho is authorized to access to rp-example
Access to a Get application whose vhost configuration key is host.example.com:
[notice] User dwho is authorized to access to host.example.com
Nothing to configure except logLevel.
The log level can be set with Apache LogLevel parameter. It can be configured globally, or inside a virtual host.
See http://httpd.apache.org/docs/current/mod/core.html#loglevel for more information.
You can choose facility in lemonldap-ng.ini file. Default values:
syslogFacility = daemon
userSyslogFacility = auth
You can also override options. Default values:
syslogOptions = cons,pid,ndelay
userSyslogOptions = cons,pid,ndelay
Tip
You can find more information on Syslog options in Sys::Syslog Perl module.
You can define the Log4perl configuration file and classes to use. Default values:
log4perlConfFile = /etc/log4perl.conf
log4perlLogger = LLNG
log4perlUserLogger = LLNGuser
Sample log4perl.conf file
log4perl.logger.LLNG = DEBUG, Syslog
log4perl.logger.LLNGuser = INFO, Syslog
log4perl.appender.Syslog = Log::Dispatch::Syslog
log4perl.appender.Syslog.ident = LLNG
log4perl.appender.Syslog.layout = PatternLayout
log4perl.appender.Syslog.layout.ConversionPattern = [%p] %m
For additional information, please read the Log4Perl documentation
New in version 2.0.14.
New in version 2.17.
New in version 2.19.
You just have to give your DSN:
sentryDsn = https://...
Attention
This experimental logger requires Sentry::Raven Perl module.
Use it to enable more than one logger. Example:
logger = Lemonldap::NG::Common::Logger::Dispatch
userLogger = Lemonldap::NG::Common::Logger::Dispatch
logDispatchError = Lemonldap::NG::Common::Logger::Sentry
logDispatchNotice = Lemonldap::NG::Common::Logger::Syslog
userLogDispatchError = Lemonldap::NG::Common::Logger::Sentry
; Other parameters
syslogFacility = daemon
sentryDsn = https://...
Attention
At least logDispatchError (or userLogDispatchError for user logs) must be defined. All sub level will be dispatched on it, until another lever is declared. In the above example, Sentry collects error and warn levels and all user actions, while syslog stores technical notice, info and debug logs.
New in version 2.19.
This feature may change in a future version, event codes and format should not be considered stable.
LemonLDAP::NG user logs (see above) are being replaced with a new facility: Audit logs.
Audit logs are structured logs that are meant to be easier to process than the current log messages.
At the moment, audit logs are transmitted by default to the configured userLogger. But you can plug-in your own custom implementation.
auditLogger=My::Logger::Class
Your logger class can look something like this:
package My::Logger::Class;
use Scalar::Util qw(weaken);
sub new {
my ( $class, $psgi_or_handler ) = @_;
my $self = bless {}, $class;
# Populate $self with options read from $psgi_or_handler
# ...
return $self;
}
sub log {
my ( $self, $req, %fields ) = @_;
# Your logging actions here. %fields is the structured
# data from the logging context, which you can enrich with
# data from the HTTP request ($req).
# The "code" field generally contains an upper case event code such as
# AUTHENTICATED or 2FA_REQUIRED
# my $code = $fields{code};
# ...
};
1;