Configuring auditing for a DSE Search cluster

Steps to configure auditing for DSE Search with the filter-mapping element in the Apache Solr web.xml file.

If auditing is enabled, DSE Search nodes do not require additional configuration. If the filter-mapping element in the Apache Solr web.xml file is commented out, the auditor cannot log anything from Solr.

web.xml

The default location of the web.xml file depends on the type of installation:

Package installations
Installer-Services installations

/usr/share/dse/solr/web/solr/WEB-INF/web.xml

Tarball installations
Installer-No Services installations

installation_location/resources/solr/web/solr/WEB-INF/web.xml

Procedure

If necessary, uncomment the filter-mapping element in the Solr web.xml file.
<filter-mapping>
    <filter-name>DseAuditLoggingFilter</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>

Here is an example of the data audit log of a Solr query:

host:/10.245.214.159|source:127.0.0.1|user:jdoe|timestamp:1356045339910|category:QUERY
  |type:SOLR_QUERY|ks:wiki|cf:solr|operation:/wiki.solr/select/?q=body:trains