RHEL: Logging

1. Graphlytic logging

Graphlytic uses slf4j and logback binding.

Location of log directory is configured, see RHEL: 3. Install Graphlytic

1.1. Common log

file: graphlytic.log

Contains all logs.

1.2. Audit log

file: graphlytic-audit.log

Contains audit logs:

  • when user was successfully logged into Graphlytic (time, name of user)

  • information about unsuccessful authentication (time, name of user)

  • information about change operations for nodes and relationships (create, update, delete) (time, name of user, name of operation). This can be used with audit information of neo4j plugin. Neo4j plugin log audit data but without name of current Graphlytic user.

2. Neo4j Graphlytic plugin

Plugin uses slf4j and logback binding.

Default log file location is default Neo4j log directory. (<NEO4J_HOME>/logs/).

configuration file: logback.xml (loccated in plugin jar file, see RHEL: Important directories). This file can be used to set location of log files, set level of logging or to disable logging.

2.1. Common log

file: neo4j-gl.log

Contains all logs but without audit logs (additivity=false).

2.2. Audit log

file: neo4j-gl-audit.log

Contains audit logs:

  • operations for nodes and relationships: create, update, delete. For every change commit JSON with detailed information is written into log file.

Example of JSON from audit log:

15.12.10 10:47:25.420 INFO s.d.n.p.a.AuditTransactionEventHandler:197 - AUDIT DB {"nodes":{"created":[8995],"deleted":[],"property_changes":[{"node":8995,"key":"LOGICAL_NAME","new_value":"test125","old_value":null}],"assigned_labels":[{"node":8995,"label":"Ci"}],"removed_labels":[]},"relationships":{"created":[],"deleted":[],"property_changes":[]}}

Data audit can slow down Graphlytic application. Audit logging can be disabled by setting "OFF" level for AuditTransactionEventHandler in logback.xml file located in neo4j-gl-plugin-<version>.jar. There is need to restart neo4j after this change. Example how to disable audit log:

<logger name="sk.demtec.neo4j.plugins.audit.AuditTransactionEventHandler" level="OFF" additivity="false">
<appender-ref ref="AUDIT" />