[S] Logging is basic

[selatham]

Basic logging is done, but there's no set way of accessing the logs. Also note https required. Python wsgi logging module of use here? Also note https required. Maybe get done as part of OMII work.

[pmiller]

PML requirements for logging

We would like NDG to extend usage of our existing EO data, but to ensure the future funding of our NEODAAS service we need output measures, ie annual data usage statistics. It would be nice if we can break these down, by role, user institution, etc. At least initially this is more important to us than security, so we could start with catchall roles with broad access permissions and then monitor usage.

So for this we need very simple but complete logging of data access: date+time, user id, role used, data granule id. We need to be able to access these logs on demand (via web access?) or on request. Old logs must be preserved and dated, not reset whenever a program is restarted. I understand that some of this functionality may be provided in the Pylon logging module.

[selatham]

Can we do this as part of OMII? Is it part of NERC Portals?. Or is it necessary by end-of-Dec?

[pjkersha]

I did some work recently to complete logging for security services. There's extensive info reported back by the Session Manager (session management and user authentication), Attribute Authority (allocation of Attribute Certificates) and Gatekeeper (access requests status). e.g. From the current glue log for discovery:

INFO:ows_server.models.ndgSecurity:Gatekeeper: access granted for user "/CN=lawrence/CN=proxy/O=NDG/OU=BADC" to "<Element {http://ndg.nerc.ac.uk/csml}dgSecurityCondition at -49816054>" with attribute certificate:
... <<<content of attribute certificate>>> ...

From Peter's list:

• date+time: it should be possible to add this with a config param to the Paster log
• user id: done
• role used: I can easily add this in
• data granule id: I don't know how to get this and will ask Bryan

[pjkersha]

data granule ID now included. Sample log message:

Gatekeeper: access granted for user "/CN=lawrence/CN=proxy/O=NDG/OU=BADC" to "badc.nerc.ac.uk__NDG-A0__OAJkJNQV" secured with role "coapec" using attribute certificate:

<?xml version="1.0" encoding="utf-8"?>
<attributeCertificate...

See  http://proj.badc.rl.ac.uk/ndg/changeset/3018

[pmiller]

That's great Phil, just what me and Helen are looking for. I assume it will include the date and time in the log when running for real?