Audit trail module events

The Audit module contains the default implementations of the collection, processing, and logging of audit information. The Audit module subscribes to a number of Sitefinity CMS events to track what is taking place in the system.

The workflow of processing an event is as follows:

1. The event handler receives an event and applies a number of filters (IAuditFilter), registered in the ObjectFactory. If any filter discards the event, the event is not processed.
2. The event handler uses a converter (IAuditInfoConverter) to convert the event object to a uniform representation - IAuditInfo.
3. The converted events are buffered and grouped by their Key property.
4. On a regular interval, the groups are scanned and the ones that have stayed unmodified for some time are aggregated into a single event.
   The aggregation uses a combination of event and property reducers.
5. The aggregated event is run through a number of post processors that can modify or augment it.
   The default processors add a user-friendly message and filter-friendly tags to describe the event.
6. The final event information is handed to a collection of registered loggers that store the information in a storage.

Event handlers are registered by calling the AuditRegistry.RegisterEventHandler and specifying the event type or interface and the IAuditEventConverter type handles the conversion. The event handler queues the converted event to the aggregator.

The IAuditInfo interface defines the abstract uniform representation of audit events.

The interface has the following properties:

• Key - used to form the groups for aggregation (required)
• Timestamp - UTC time the event took place (required)
• EventType - the type of the raised event
• Fields - a dictionary mapping any number of property names to the corresponding values. The purpose of this is twofold:
  • to allow uniform field names for the values of properties which names differ among event interfaces
  • to allow adding additional properties on the fly
• MetaFields - not part of the logged information but used throught the processing pipe

The IAuditEventConverter interface has a single Convert method, which returns the IAuditInfo.

When an event is converted, the IAuditInfo item is pushed to the AuditAggregator. If an item with the same key is pushed shortly after this, both items are aggregated into one. When an item is older than few seconds (you can configure the exact time interval), the item is passed to the IAuditLogger loggers.

Post processors

The post processors of the audit information are handed the aggregated instance and are given the opportunity to modify the information before sending it to the loggers (the order is currently unspecified, so avoid relying on other processor's changes).