Configuring auditing for a DSE Search cluster

Steps to configure auditing for DSE Search with the filter-mapping element in the Apache Solr™ web.xml file.

If auditing is enabled, DSE Search nodes do not require additional configuration. If the filter-mapping element in the Apache Solr™ web.xml file is commented out, the auditor cannot log anything from Solr.

web.xml

The default location of the web.xml file depends on the type of installation:

Package installations
Installer-Services installations

/usr/share/dse/solr/web/solr/WEB-INF/web.xml

Tarball installations
Installer-No Services installations

installation_location/resources/solr/web/solr/WEB-INF/web.xml

Procedure

If necessary, uncomment the filter-mapping element in the Solr web.xml file.
<filter-mapping>
    <filter-name>DseAuditLoggingFilter</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>

Here is an example of the data audit log of a Solr query:

host:/10.245.214.159|source:127.0.0.1|user:jdoe|timestamp:1356045339910|category:QUERY
  |type:SOLR_QUERY|ks:wiki|cf:solr|operation:/wiki.solr/select/?q=body:trains