Configuring auditing for a DSE Search cluster

The filter-mapping element in the Solr web.xml file enables auditing.

If auditing is enabled, DSE Search nodes do not require additional configuration. If the filter-mapping element in the Solr web.xml file is commented out, the auditor cannot log anything from Solr.

Procedure

If necessary, uncomment the filter-mapping element in the Solr file.

The default location of the web.xml file depends on the type of installation:

Installer-Services and Package installations	/usr/share/dse/solr/web/solr/WEB-INF/web.xml
Installer-No Services and Tarball installations	`install_location`/resources/solr/web/solr/WEB-INF/web.xml

<filter-mapping>
    <filter-name>DseAuditLoggingFilter</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>

Here is an example of the data audit log of a Solr query:

host:/10.245.214.159|source:127.0.0.1|user:jdoe|timestamp:1356045339910|category:QUERY
  |type:SOLR_QUERY|ks:wiki|cf:solr|operation:/wiki.solr/select/?q=body:trains