nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

As we transition to the new Hyland Community, some post links may be temporarily disrupted as we finalize redirects. We apologize for the inconvenience and are working to resolve this as quickly as possible. Details.

Audit Alfresco 3.4.c: Nothing audited

othlen

I'm trying to set up Alfresco Community 3.4.c 's Audit.

I've enabled the audit audit serice: audit.enabled=true in alfresco-global.properties file.

After this, I created two xml file with my audit application definitions:

The first file contains login/logout audit application:

<?xml version='1.0' encoding='UTF-8'?>
<Audit
    xmlns="http://www.alfresco.org/repo/audit/model/3.2"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.alfresco.org/repo/audit/model/3.2 alfresco-audit-3.2.xsd"
>
    <DataExtractors>
       <DataExtractor name="simpleValue" registeredName="auditModel.extractor.simpleValue" />
    </DataExtractors>
    <DataGenerators>
        <DataGenerator name="currentUser" registeredName="auditModel.generator.user" />
        <DataGenerator name="systemTime" registeredName="auditModel.generator.time" />
    </DataGenerators>
    <PathMappings>
        <PathMap source="/alfresco-api/post/AuthenticationService/authenticate" target="/login/login" />
      <PathMap source="/alfresco-api/post/AuthenticationService/clearCurrentSecurityContext" target="/logout/logout" />
    </PathMappings>
    <Application name="Login" key="login">
        <AuditPath key="login">
            <AuditPath key="no-error">
                <RecordValue key="username" dataExtractor="simpleValue" dataSource="/auditexamplelogin1/login/args/userName" />
            <GenerateValue key="systime" dataGenerator="systemTime" />
            </AuditPath>
         <AuditPath key="error">
            <GenerateValue key="systime" dataGenerator="systemTime" />
            </AuditPath>
        </AuditPath>
    </Application>
    <Application name="Logout" key="logout">
        <AuditPath key="logout">
            <AuditPath key="no-error">
            <GenerateValue key="username" dataGenerator="currentUser" />
            <GenerateValue key="systime" dataGenerator="systemTime" />
         </AuditPath>
        </AuditPath>
    </Application>
</Audit>
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

The second file contains node related audit applications:

<?xml version='1.0' encoding='UTF-8

<Audit
    xmlns="http://www.alfresco.org/repo/audit/model/3.2"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.alfresco.org/repo/audit/model/3.2 alfresco-audit-3.2.xsd"
>

    <DataExtractors>
       <DataExtractor name="simpleValue" registeredName="auditModel.extractor.simpleValue" />
       <DataExtractor name="nodeType" registeredName="auditModel.extractor.nodeType" />
    </DataExtractors>

    <DataGenerators>
        <DataGenerator name="currentUser" registeredName="auditModel.generator.user" />
        <DataGenerator name="systemTime" registeredName="auditModel.generator.time" />      
        <DataGenerator name="personFullName" registeredName="auditModel.generator.personFullName" />
    </DataGenerators>

    <PathMappings>
                <PathMap source="/alfresco-api/post/FileFolderService/copy" target="/nodecopy/copy" />
      <PathMap source="/alfresco-api/post/FileFolderService/create" target="/nodecreate/create" />
      <PathMap source="/alfresco-api/post/FileFolderService/delete" target="/nodedelete/delete" />
                <PathMap source="/alfresco-api/post/FileFolderService/move" target="/nodemove/move" />
      <PathMap source="/alfresco-api/post/FileFolderService/rename" target="/noderename/rename" />
    </PathMappings>   
   
    <Application name="NodeCopy" key="nodecopy">
        <AuditPath key="copy">
                <RecordValue key="sourcenode" dataExtractor="nodeType" dataSource="/auditexamplelogin1/login/args/sourceNodeRef" />
                <RecordValue key="targetparent" dataExtractor="nodeType" dataSource="/auditexamplelogin1/login/args/targetParentRef" />
                <RecordValue key="newname" dataExtractor="simpleValue" dataSource="/auditexamplelogin1/login/args/newName" />
        </AuditPath>
    </Application>   

    <Application name="NodeCreate" key="nodecreate">
        <AuditPath key="create">
       <RecordValue key="parentNode" dataExtractor="simpleValue" dataSource="/auditexamplelogin1/login/args/parentNodeRef" />
            <RecordValue key="name" dataExtractor="simpleValue" dataSource="/auditexamplelogin1/login/args/name" />
            <RecordValue key="type" dataExtractor="simpleValue" dataSource="/auditexamplelogin1/login/args/typeQName" />
        </AuditPath>
    </Application>
   
    <Application name="NodeDelete" key="nodedelete">
        <AuditPath key="delete">
                <RecordValue key="node" dataExtractor="simpleValue" dataSource="/auditexamplelogin1/login/args/nodeRef" />
        </AuditPath>
    </Application>
      
    <Application name="NodeMove" key="nodemove">
        <AuditPath key="move">
                <RecordValue key="sourcenode" dataExtractor="simpleValue" dataSource="/auditexamplelogin1/login/args/sourceNodeRef" />
                <RecordValue key="targetparent" dataExtractor="simpleValue" dataSource="/auditexamplelogin1/login/args/targetParentRef" />
                <RecordValue key="newname" dataExtractor="simpleValue" dataSource="/auditexamplelogin1/login/args/newName" />
        </AuditPath>
    </Application>
   
    <Application name="NodeRename" key="noderename">
        <AuditPath key="rename">      
            <RecordValue key="filefolder" dataExtractor="simpleValue" dataSource="/auditexamplelogin1/login/args/fileFolderRef" />
                                <RecordValue key="newname" dataExtractor="simpleValue" dataSource="/auditexamplelogin1/login/args/newName" />
             <GenerateValue key="username" dataGenerator="currentUser" />
            <GenerateValue key="systime" dataGenerator="systemTime" />
       </AuditPath>
    </Application>   
</Audit>
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Using "/alfresco/service/api/audit/control" service i can see all seven audit application enabled,
but except the login audit application (it traces correctly login informations) the others singles queries services return an empty json:

{
   "count":0,
   "entries": 
   [
   ]
}
‍‍‍‍‍‍‍‍

In the tomcat log file I can see the Extracted of audit data but in the line below, log reports "Nothing audited".
An example from my Tomcat log:

2011-01-27 17:52:10,784 User:System DEBUG [org.alfresco.repo.audit.AuditComponentImpl] 
Extracted audit data: 
   Application:    AuditApplication[ name=NodeCreate, id=19, disabledPathsId=24410]
   Values:         
      /nodecreate/create/args/typeQName={http://www.alfresco.org/model/content/1.0}folder
      /nodecreate/create/args/name=pqoe
      /nodecreate/create/result=FileInfo[name=pqoe, isFolder=true, nodeRef=workspace://SpacesStore/6ddb10ab-b04e-4be8-99b3-24b2cf53659d]
      /nodecreate/create/args/parentNodeRef=workspace://SpacesStore/330bf3c9-5b37-430d-8e54-353e6b2405fd
      /nodecreate/create/no-error=null

   New Data: 

2011-01-27 17:52:10,784 User:paglialu DEBUG [org.alfresco.repo.audit.AuditComponentImpl] 
Nothing audited: 
   Application ID: 19
   Entry ID:       null
   Values:         
      /nodecreate/create/args/typeQName={http://www.alfresco.org/model/content/1.0}folder
      /nodecreate/create/args/name=pqoe
      /nodecreate/create/result=FileInfo[name=pqoe, isFolder=true, nodeRef=workspace://SpacesStore/6ddb10ab-b04e-4be8-99b3-24b2cf53659d]
      /nodecreate/create/args/parentNodeRef=workspace://SpacesStore/330bf3c9-5b37-430d-8e54-353e6b2405fd
      /nodecreate/create/no-error=null
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

There are some error in xml configurations or this is the right behaviour of alfresco audit?

Find more posts tagged with

Comments

kiddinho

@ othlen

<Application name="NodeCopy" key="nodecopy">
<AuditPath key="copy">
<RecordValue key="sourcenode" dataExtractor="nodeType" dataSource="/auditexamplelogin1/login/args/sourceNodeRef" />

I think it must be:
<Application name="NodeCopy" key="nodecopy">
         <AuditPath key="copy">
                 <RecordValue key="sourcenode" dataExtractor="nodeType" dataSource="/nodecopy/copy/args/sourceNodeRef" />

I have a question. I try to get auditing information with url:
http://localhost:8080/alfresco/service/api/audit/query/DTSCAuditContent with DTSCAuditContent is name attribute of Application tag. But I only get following information:
{
   "count":17,
   "entries":
   [
      {
         "id":146,
         "application"

TSCAuditContent,
"user"

ystem,
         "time":"2011-03-01T09:15:06.437+07:00",
         "values":
null
      },
      …
      {
         "id":232,
         "application"

TSCAuditContent,
         "user":admin,
         "time":"2011-03-01T10:36:22.750+07:00",
         "values":
null
      }
   ]
}

It does'nt have any information that I audited.
Here is my auditing config:
<Audit
    xmlns="http://www.alfresco.org/repo/audit/model/3.2"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.alfresco.org/repo/audit/model/3.2 alfresco-audit-3.2.xsd"
    >

    <DataExtractors>
       <DataExtractor name="simpleValue" registeredName="auditModel.extractor.simpleValue"/>
      <DataExtractor name="nodeRefExtractor" registeredName="auditModel.extractor.nodeType"/>
    </DataExtractors>

    <DataGenerators>
      <DataGenerator name="personFullName" registeredName="auditModel.generator.personFullName"/>
      <DataGenerator name="user" registeredName="auditModel.generator.user"/>
    </DataGenerators>

    <PathMappings>
        <PathMap source="/alfresco-api/post/ContentService/getReader" target="/dtscAuditContent/read" />
        <PathMap source="/alfresco-api/post/ContentService/getWriter" target="/dtscAuditContent/write" />
    </PathMappings>

    <Application name="DTSCAuditContent" key="dtscAuditContent">
        <AuditPath key="read">
         <AuditPath key="no-error">
            <RecordValue key="nodeRef" dataExtractor="nodeRefExtractor" dataSource="/dtscAuditContent/read/args/nodeRef" />
            <RecordValue key="result" dataExtractor="simpleValue" dataSource="/dtscAuditContent/read/result" />
         </AuditPath>
         <AuditPath key="error">
            <RecordValue key="nodeRef" dataExtractor="nodeRefExtractor" dataSource="/dtscAuditContent/read/args/nodeRef" />
            <RecordValue key="result" dataExtractor="simpleValue" dataSource="/dtscAuditContent/read/result" />
         </AuditPath>
      </AuditPath>
      <AuditPath key="write">
         <AuditPath key="no-error">
            <RecordValue key="nodeRef" dataExtractor="nodeRefExtractor" dataSource="/dtscAuditContent/write/args/nodeRef" />
         </AuditPath>
         <AuditPath key="error">
            <RecordValue key="nodeRef" dataExtractor="nodeRefExtractor" dataSource="/dtscAuditContent/write/args/nodeRef" />
         </AuditPath>
        </AuditPath>
    </Application>

</Audit>

Can anyone help me?

dallaz

@ othlen:

have you been able to get your audit working with the corrections suggested by kiddinho? I've been trying implementing the same solution, but I keep getting no audits

davidfg85

Works for me

http://localhost:8080/alfresco/service/api/audit/query/DTSCAuditContent?verbose=true&user=admin&forward=false

I have other problems with the audit
http://forums.alfresco.com/en/viewtopic.php?f=9&t=38605

robinflow

Hi!

I will try to give a working example of a complete audit mechanism with DB query here.
When I started writing my audit scripts, I searched up & down the wiki and the forum,
and did not find a complete auditing example, so here you can find my results.

My main source was:
http://wiki.alfresco.com/wiki/Auditing_%28from_V3.4%29

Based on the sample codes and the example above I managed to get my auditing process working.
I used the audit trail as a source. To enable audit trail, add the following lines to "\WEB-INF\classes\log4j.properties":

### Enable Audit Trail
# log4j.logger.org.alfresco.repo.audit.AuditComponentImpl=DEBUG
# log4j.logger.org.alfresco.repo.audit.inbound=DEBUG   
‍‍‍‍

To enable auditing, add the following code to "\WEB-INF\classes\alfresco-global.properties":

### Enable Audit
audit.enabled=true‍‍

Then I created 3 XML files, to enable login-, node- and action-related auditing.

First XML is located at: "WEB-INF\classes\alfresco\audit\alfresco-audit-login.xml" and it's purpose is to enable auditing the login processes.
(If you take a look at the commented code, you will find that I tried to audit "logout" process as well, but when someone logs out, I found that 2 things happen: a "validate" and a "guest login" - both actions happen at other occasions too, so I could not identify a single "logout". If someone can help me with auditing the "logout" process, I would really appreciate it, but the audit trail didn't show anything relevant about it.)

<?xml version='1.0' encoding='UTF-8'?>

<!– Login/GuestLogin(=Logout)/Validate –>

<Audit
    xmlns="http://www.alfresco.org/repo/audit/model/3.2"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.alfresco.org/repo/audit/model/3.2 alfresco-audit-3.2.xsd"
    >

    <DataExtractors>
       <DataExtractor name="simpleValue" registeredName="auditModel.extractor.simpleValue"/>
    </DataExtractors>

    <DataGenerators>
       <DataGenerator name="personFullName" registeredName="auditModel.generator.personFullName"/>
       <DataGenerator name="currentUser" registeredName="auditModel.generator.user"/>
       <DataGenerator name="systemTime" registeredName="auditModel.generator.time"/>
    </DataGenerators>

    <PathMappings>
        <PathMap source="/alfresco-api/post/AuthenticationService/authenticate" target="/auditlogin/login"/>
        <!– <PathMap source="/alfresco-api/post/AuthenticationService/validate" target="/auditvalidate/validate"/>
        <PathMap source="/alfresco-api/post/AuthenticationService/guestUserAuthenticationAllowed" target="/auditguestlogin/guestlogin"/> –>
    </PathMappings>

    <Application name="AuditLogin" key="auditlogin">
        <AuditPath key="login">
            <AuditPath key="no-error">
                <RecordValue key="user" dataExtractor="simpleValue" dataSource="/auditlogin/login/args/userName"/>
                <GenerateValue key="personFullName" dataGenerator="personFullName" />
                <GenerateValue key="currentUser" dataGenerator="currentUser" />
                <GenerateValue key="systemTime" dataGenerator="systemTime" />
            </AuditPath>
            <AuditPath key="error">
                <RecordValue key="user" dataExtractor="simpleValue" dataSource="/auditlogin/login/args/userName"/>
                <RecordValue key="error" dataExtractor="simpleValue" dataSource="/auditlogin/login/error"/>
                <GenerateValue key="personFullName" dataGenerator="personFullName" />
                <GenerateValue key="currentUser" dataGenerator="currentUser" />
                <GenerateValue key="systemTime" dataGenerator="systemTime" />
            </AuditPath>
        </AuditPath>
    </Application>

    <!– <Application name="AuditValidate" key="auditvalidate">
        <AuditPath key="validate">
            <AuditPath key="no-error">
                <GenerateValue key="personFullName" dataGenerator="personFullName" />
                <GenerateValue key="currentUser" dataGenerator="currentUser" />
                <GenerateValue key="systemTime" dataGenerator="systemTime" />
            </AuditPath>
            <AuditPath key="error">
                <RecordValue key="error" dataExtractor="simpleValue" dataSource="/auditvalidate/validate/error"/>
                <GenerateValue key="personFullName" dataGenerator="personFullName" />
                <GenerateValue key="currentUser" dataGenerator="currentUser" />
                <GenerateValue key="systemTime" dataGenerator="systemTime" />
            </AuditPath>
        </AuditPath>
    </Application>
    
    <Application name="AuditGuestLogin" key="auditguestlogin">
        <AuditPath key="guestlogin">
            <AuditPath key="no-error">
                <RecordValue key="result" dataExtractor="simpleValue" dataSource="/auditguestlogin/guestlogin/result"/>
                <GenerateValue key="personFullName" dataGenerator="personFullName" />
                <GenerateValue key="currentUser" dataGenerator="currentUser" />
                <GenerateValue key="systemTime" dataGenerator="systemTime" />
            </AuditPath>
            <AuditPath key="error">
                <RecordValue key="error" dataExtractor="simpleValue" dataSource="/auditguestlogin/guestlogin/error"/>
                <GenerateValue key="personFullName" dataGenerator="personFullName" />
                <GenerateValue key="currentUser" dataGenerator="currentUser" />
                <GenerateValue key="systemTime" dataGenerator="systemTime" />
            </AuditPath>
        </AuditPath>
    </Application> –>    

</Audit>
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

The second XML is located at: "WEB-INF\classes\alfresco\audit\alfresco-audit-node.xml", and it audits node actions (create/copy/move/delete/rename/contentRead/contentWrite).
(There are 2 kind of "create" calls: NodeService.createNode and FileFolderService.create - both were used in the application, so I decided to audit both calls).

<?xml version='1.0' encoding='UTF-8'?>

<!– Node Functions –>

<Audit
    xmlns="http://www.alfresco.org/repo/audit/model/3.2"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.alfresco.org/repo/audit/model/3.2 alfresco-audit-3.2.xsd"
    >

    <DataExtractors>
       <DataExtractor name="simpleValue" registeredName="auditModel.extractor.simpleValue"/>
    </DataExtractors>

    <DataGenerators>
       <DataGenerator name="personFullName" registeredName="auditModel.generator.personFullName"/>
       <DataGenerator name="currentUser" registeredName="auditModel.generator.user"/>
       <DataGenerator name="systemTime" registeredName="auditModel.generator.time"/>
    </DataGenerators>

    <PathMappings>
        <PathMap source="/alfresco-api/post/NodeService/createNode" target="/node/createNode"/>
        <PathMap source="/alfresco-api/post/FileFolderService/copy" target="/node/copy"/>
        <PathMap source="/alfresco-api/post/FileFolderService/move" target="/node/move"/>
        <PathMap source="/alfresco-api/post/NodeService/deleteNode" target="/node/delete"/>
        <PathMap source="/alfresco-api/post/FileFolderService/rename" target="/node/rename"/>
        <PathMap source="/alfresco-api/post/FileFolderService/create" target="/node/create"/>
        <PathMap source="/alfresco-api/post/ContentService/getWriter" target="/node/write"/>
        <PathMap source="/alfresco-api/post/ContentService/getReader" target="/node/read"/>
    </PathMappings>

    <Application name="Node" key="node">
        
        <AuditPath key="createNode">
            <AuditPath key="no-error">
                <RecordValue key="nodeTypeQName" dataExtractor="simpleValue" dataSource="/node/createNode/args/nodeTypeQName"/>
                <RecordValue key="parentRef" dataExtractor="simpleValue" dataSource="/node/createNode/args/parentRef"/>
                <RecordValue key="assocQName" dataExtractor="simpleValue" dataSource="/node/createNode/args/assocQName"/>
                <RecordValue key="assocTypeQName" dataExtractor="simpleValue" dataSource="/node/createNode/args/assocTypeQName"/>
                <RecordValue key="properties" dataExtractor="simpleValue" dataSource="/node/createNode/args/properties"/>
                <RecordValue key="result" dataExtractor="simpleValue" dataSource="/node/createNode/result"/>
                <GenerateValue key="personFullName" dataGenerator="personFullName"/>
                <GenerateValue key="currentUser" dataGenerator="currentUser"/>
                <GenerateValue key="systemTime" dataGenerator="systemTime"/>
            </AuditPath>
            <AuditPath key="error">
                <RecordValue key="error" dataExtractor="simpleValue" dataSource="/node/createNode/error"/>
                <GenerateValue key="personFullName" dataGenerator="personFullName" />
                <GenerateValue key="currentUser" dataGenerator="currentUser" />
                <GenerateValue key="systemTime" dataGenerator="systemTime" />
            </AuditPath>
        </AuditPath>
        
        <AuditPath key="copy">
            <AuditPath key="no-error">
                <RecordValue key="targetParentRef" dataExtractor="simpleValue" dataSource="/node/copy/args/targetParentRef"/>
                <RecordValue key="sourceNodeRef" dataExtractor="simpleValue" dataSource="/node/copy/args/sourceNodeRef"/>
                <RecordValue key="newName" dataExtractor="simpleValue" dataSource="/node/copy/args/newName"/>
                <RecordValue key="result" dataExtractor="simpleValue" dataSource="/node/copy/result"/>
                <GenerateValue key="personFullName" dataGenerator="personFullName"/>
                <GenerateValue key="currentUser" dataGenerator="currentUser"/>
                <GenerateValue key="systemTime" dataGenerator="systemTime"/>
            </AuditPath>
            <AuditPath key="error">
                <RecordValue key="targetParentRef" dataExtractor="simpleValue" dataSource="/node/copy/args/targetParentRef"/>
                <RecordValue key="sourceNodeRef" dataExtractor="simpleValue" dataSource="/node/copy/args/sourceNodeRef"/>
                <RecordValue key="newName" dataExtractor="simpleValue" dataSource="/node/copy/args/newName"/>
                <RecordValue key="error" dataExtractor="simpleValue" dataSource="/node/copy/error"/>
                <GenerateValue key="personFullName" dataGenerator="personFullName" />
                <GenerateValue key="currentUser" dataGenerator="currentUser" />
                <GenerateValue key="systemTime" dataGenerator="systemTime" />
            </AuditPath>
        </AuditPath>
        
        <AuditPath key="move">
            <AuditPath key="no-error">
                <RecordValue key="targetParentRef" dataExtractor="simpleValue" dataSource="/node/move/args/targetParentRef"/>
                <RecordValue key="sourceNodeRef" dataExtractor="simpleValue" dataSource="/node/move/args/sourceNodeRef"/>
                <RecordValue key="newName" dataExtractor="simpleValue" dataSource="/node/move/args/newName"/>
                <RecordValue key="result" dataExtractor="simpleValue" dataSource="/node/move/result"/>
                <GenerateValue key="personFullName" dataGenerator="personFullName"/>
                <GenerateValue key="currentUser" dataGenerator="currentUser"/>
                <GenerateValue key="systemTime" dataGenerator="systemTime"/>
            </AuditPath>
            <AuditPath key="error">
                <RecordValue key="targetParentRef" dataExtractor="simpleValue" dataSource="/node/move/args/targetParentRef"/>
                <RecordValue key="sourceNodeRef" dataExtractor="simpleValue" dataSource="/node/move/args/sourceNodeRef"/>
                <RecordValue key="newName" dataExtractor="simpleValue" dataSource="/node/move/args/newName"/>
                <RecordValue key="error" dataExtractor="simpleValue" dataSource="/node/move/error"/>
                <GenerateValue key="personFullName" dataGenerator="personFullName" />
                <GenerateValue key="currentUser" dataGenerator="currentUser" />
                <GenerateValue key="systemTime" dataGenerator="systemTime" />
            </AuditPath>
        </AuditPath>        
        
        <AuditPath key="delete">
            <AuditPath key="no-error">
                <RecordValue key="nodeRef" dataExtractor="simpleValue" dataSource="/node/delete/args/nodeRef"/>
                <GenerateValue key="personFullName" dataGenerator="personFullName"/>
                <GenerateValue key="currentUser" dataGenerator="currentUser"/>
                <GenerateValue key="systemTime" dataGenerator="systemTime"/>
            </AuditPath>
            <AuditPath key="error">
                <RecordValue key="nodeRef" dataExtractor="simpleValue" dataSource="/node/delete/args/nodeRef"/>
                <RecordValue key="error" dataExtractor="simpleValue" dataSource="/node/delete/error"/>
                <GenerateValue key="personFullName" dataGenerator="personFullName" />
                <GenerateValue key="currentUser" dataGenerator="currentUser" />
                <GenerateValue key="systemTime" dataGenerator="systemTime" />
            </AuditPath>
        </AuditPath>        
        
        <AuditPath key="rename">
            <AuditPath key="no-error">
                <RecordValue key="fileFolderRef" dataExtractor="simpleValue" dataSource="/node/rename/args/fileFolderRef"/>
                <RecordValue key="newName" dataExtractor="simpleValue" dataSource="/node/rename/args/newName"/>
                <RecordValue key="result" dataExtractor="simpleValue" dataSource="/node/rename/result"/>
                <GenerateValue key="personFullName" dataGenerator="personFullName"/>
                <GenerateValue key="currentUser" dataGenerator="currentUser"/>
                <GenerateValue key="systemTime" dataGenerator="systemTime"/>
            </AuditPath>
            <AuditPath key="error">
                <RecordValue key="fileFolderRef" dataExtractor="simpleValue" dataSource="/node/rename/args/fileFolderRef"/>
                <RecordValue key="newName" dataExtractor="simpleValue" dataSource="/node/rename/args/newName"/>
                <RecordValue key="error" dataExtractor="simpleValue" dataSource="/node/rename/error"/>
                <GenerateValue key="personFullName" dataGenerator="personFullName" />
                <GenerateValue key="currentUser" dataGenerator="currentUser" />
                <GenerateValue key="systemTime" dataGenerator="systemTime" />
            </AuditPath>
        </AuditPath>          

        <AuditPath key="create">
            <AuditPath key="no-error">
                <RecordValue key="parentNodeRef" dataExtractor="simpleValue" dataSource="/node/create/args/parentNodeRef"/>
                <RecordValue key="name" dataExtractor="simpleValue" dataSource="/node/create/args/name"/>
                <RecordValue key="typeQName" dataExtractor="simpleValue" dataSource="/node/create/args/typeQName"/>
                <RecordValue key="result" dataExtractor="simpleValue" dataSource="/node/create/result"/>
                <GenerateValue key="personFullName" dataGenerator="personFullName"/>
                <GenerateValue key="currentUser" dataGenerator="currentUser"/>
                <GenerateValue key="systemTime" dataGenerator="systemTime"/>
            </AuditPath>
            <AuditPath key="error">
                <RecordValue key="error" dataExtractor="simpleValue" dataSource="/node/create/error"/>
                <GenerateValue key="personFullName" dataGenerator="personFullName" />
                <GenerateValue key="currentUser" dataGenerator="currentUser" />
                <GenerateValue key="systemTime" dataGenerator="systemTime" />
            </AuditPath>
        </AuditPath>        

        <AuditPath key="write">
            <AuditPath key="no-error">
                <RecordValue key="update" dataExtractor="simpleValue" dataSource="/node/write/args/update"/>
                <RecordValue key="nodeRef" dataExtractor="simpleValue" dataSource="/node/write/args/nodeRef"/>
                <RecordValue key="propertyQName" dataExtractor="simpleValue" dataSource="/node/write/args/propertyQName"/>
                <RecordValue key="result" dataExtractor="simpleValue" dataSource="/node/write/result"/>
                <GenerateValue key="personFullName" dataGenerator="personFullName"/>
                <GenerateValue key="currentUser" dataGenerator="currentUser"/>
                <GenerateValue key="systemTime" dataGenerator="systemTime"/>
            </AuditPath>
            <AuditPath key="error">
                <RecordValue key="update" dataExtractor="simpleValue" dataSource="/node/write/args/update"/>
                <RecordValue key="nodeRef" dataExtractor="simpleValue" dataSource="/node/write/args/nodeRef"/>
                <RecordValue key="propertyQName" dataExtractor="simpleValue" dataSource="/node/write/args/propertyQName"/>
                <RecordValue key="error" dataExtractor="simpleValue" dataSource="/node/write/error"/>
                <GenerateValue key="personFullName" dataGenerator="personFullName" />
                <GenerateValue key="currentUser" dataGenerator="currentUser" />
                <GenerateValue key="systemTime" dataGenerator="systemTime" />
            </AuditPath>
        </AuditPath>
        
        <AuditPath key="read">
            <AuditPath key="no-error">
                <RecordValue key="nodeRef" dataExtractor="simpleValue" dataSource="/node/read/args/nodeRef"/>
                <RecordValue key="propertyQName" dataExtractor="simpleValue" dataSource="/node/read/args/propertyQName"/>
                <RecordValue key="result" dataExtractor="simpleValue" dataSource="/node/read/result"/>
                <GenerateValue key="personFullName" dataGenerator="personFullName"/>
                <GenerateValue key="currentUser" dataGenerator="currentUser"/>
                <GenerateValue key="systemTime" dataGenerator="systemTime"/>
            </AuditPath>
            <AuditPath key="error">
                <RecordValue key="nodeRef" dataExtractor="simpleValue" dataSource="/node/read/args/nodeRef"/>
                <RecordValue key="propertyQName" dataExtractor="simpleValue" dataSource="/node/read/args/propertyQName"/>
                <RecordValue key="error" dataExtractor="simpleValue" dataSource="/node/read/error"/>
                <GenerateValue key="personFullName" dataGenerator="personFullName" />
                <GenerateValue key="currentUser" dataGenerator="currentUser" />
                <GenerateValue key="systemTime" dataGenerator="systemTime" />
            </AuditPath>
        </AuditPath>        
                
    </Application>

</Audit>
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Finally my third XML, located at "WEB-INF\classes\alfresco\audit\alfresco-audit-action.xml", auditing the checkin/checkout/executeAction/search/ticket-request processes:

<?xml version='1.0' encoding='UTF-8'?>

<!– Node Functions –>

<Audit
    xmlns="http://www.alfresco.org/repo/audit/model/3.2"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.alfresco.org/repo/audit/model/3.2 alfresco-audit-3.2.xsd"
    >

    <DataExtractors>
       <DataExtractor name="simpleValue" registeredName="auditModel.extractor.simpleValue"/>
    </DataExtractors>

    <DataGenerators>
       <DataGenerator name="personFullName" registeredName="auditModel.generator.personFullName"/>
       <DataGenerator name="currentUser" registeredName="auditModel.generator.user"/>
       <DataGenerator name="systemTime" registeredName="auditModel.generator.time"/>
    </DataGenerators>

    <PathMappings>
        <PathMap source="/alfresco-api/post/CheckoutCheckinService/checkin" target="/action/checkin"/>
        <PathMap source="/alfresco-api/post/CheckoutCheckinService/checkout" target="/action/checkout"/>
        <PathMap source="/alfresco-api/post/CheckoutCheckinService/cancelCheckout" target="/action/cancelCheckout"/>
        <PathMap source="/alfresco-api/post/ActionService/executeAction" target="/action/executeAction"/>
        <PathMap source="/alfresco-api/post/SearchService/query" target="/action/searchQuery"/>
        <PathMap source="/alfresco-api/post/FileFolderService/searchSimple" target="/action/searchSimple"/>
        <PathMap source="/alfresco-api/post/AuthenticationService/getCurrentTicket" target="/action/getCurrentTicket"/>
    </PathMappings>

    <Application name="Action" key="action">
        
        <AuditPath key="checkin">
            <AuditPath key="no-error">
                <RecordValue key="contentUrl" dataExtractor="simpleValue" dataSource="/action/checkin/args/contentUrl"/>
                <RecordValue key="versionProperties" dataExtractor="simpleValue" dataSource="/action/checkin/args/versionProperties"/>
                <RecordValue key="keepCheckedOut" dataExtractor="simpleValue" dataSource="/action/checkin/args/keepCheckedOut"/>
                <RecordValue key="workingCopyNodeRef" dataExtractor="simpleValue" dataSource="/action/checkin/args/workingCopyNodeRef"/>
                <RecordValue key="result" dataExtractor="simpleValue" dataSource="/action/checkin/result"/>
                <GenerateValue key="personFullName" dataGenerator="personFullName"/>
                <GenerateValue key="currentUser" dataGenerator="currentUser"/>
                <GenerateValue key="systemTime" dataGenerator="systemTime"/>
            </AuditPath>
            <AuditPath key="error">
                <RecordValue key="contentUrl" dataExtractor="simpleValue" dataSource="/action/checkin/args/contentUrl"/>
                <RecordValue key="versionProperties" dataExtractor="simpleValue" dataSource="/action/checkin/args/versionProperties"/>
                <RecordValue key="keepCheckedOut" dataExtractor="simpleValue" dataSource="/action/checkin/args/keepCheckedOut"/>
                <RecordValue key="workingCopyNodeRef" dataExtractor="simpleValue" dataSource="/action/checkin/args/workingCopyNodeRef"/>
                <RecordValue key="error" dataExtractor="simpleValue" dataSource="/action/checkin/error"/>
                <GenerateValue key="personFullName" dataGenerator="personFullName" />
                <GenerateValue key="currentUser" dataGenerator="currentUser" />
                <GenerateValue key="systemTime" dataGenerator="systemTime" />
            </AuditPath>
        </AuditPath>
        
        <AuditPath key="checkout">
            <AuditPath key="no-error">
                <RecordValue key="nodeRef" dataExtractor="simpleValue" dataSource="/action/checkout/args/nodeRef"/>
                <RecordValue key="result" dataExtractor="simpleValue" dataSource="/action/checkout/result"/>
                <GenerateValue key="personFullName" dataGenerator="personFullName"/>
                <GenerateValue key="currentUser" dataGenerator="currentUser"/>
                <GenerateValue key="systemTime" dataGenerator="systemTime"/>
            </AuditPath>
            <AuditPath key="error">
                <RecordValue key="nodeRef" dataExtractor="simpleValue" dataSource="/action/checkout/args/nodeRef"/>
                <RecordValue key="error" dataExtractor="simpleValue" dataSource="/action/checkout/error"/>
                <GenerateValue key="personFullName" dataGenerator="personFullName" />
                <GenerateValue key="currentUser" dataGenerator="currentUser" />
                <GenerateValue key="systemTime" dataGenerator="systemTime" />
            </AuditPath>
        </AuditPath>
        
        <AuditPath key="cancelCheckout">
            <AuditPath key="no-error">
                <RecordValue key="workingCopyNodeRef" dataExtractor="simpleValue" dataSource="/action/cancelCheckout/args/workingCopyNodeRef"/>
                <RecordValue key="result" dataExtractor="simpleValue" dataSource="/action/cancelCheckout/result"/>
                <GenerateValue key="personFullName" dataGenerator="personFullName"/>
                <GenerateValue key="currentUser" dataGenerator="currentUser"/>
                <GenerateValue key="systemTime" dataGenerator="systemTime"/>
            </AuditPath>
            <AuditPath key="error">
                <RecordValue key="workingCopyNodeRef" dataExtractor="simpleValue" dataSource="/action/cancelCheckout/args/workingCopyNodeRef"/>
                <RecordValue key="error" dataExtractor="simpleValue" dataSource="/action/cancelCheckout/error"/>
                <GenerateValue key="personFullName" dataGenerator="personFullName" />
                <GenerateValue key="currentUser" dataGenerator="currentUser" />
                <GenerateValue key="systemTime" dataGenerator="systemTime" />
            </AuditPath>
        </AuditPath>            
        
        <AuditPath key="executeAction">
            <AuditPath key="no-error">
                <RecordValue key="actionedUponNodeRef" dataExtractor="simpleValue" dataSource="/action/executeAction/args/actionedUponNodeRef"/>
                <RecordValue key="action" dataExtractor="simpleValue" dataSource="/action/executeAction/args/action"/>
                <GenerateValue key="personFullName" dataGenerator="personFullName"/>
                <GenerateValue key="currentUser" dataGenerator="currentUser"/>
                <GenerateValue key="systemTime" dataGenerator="systemTime"/>
            </AuditPath>
            <AuditPath key="error">
                <RecordValue key="actionedUponNodeRef" dataExtractor="simpleValue" dataSource="/action/executeAction/args/actionedUponNodeRef"/>
                <RecordValue key="action" dataExtractor="simpleValue" dataSource="/action/executeAction/args/action"/>
                <RecordValue key="error" dataExtractor="simpleValue" dataSource="/action/executeAction/error"/>
                <GenerateValue key="personFullName" dataGenerator="personFullName" />
                <GenerateValue key="currentUser" dataGenerator="currentUser" />
                <GenerateValue key="systemTime" dataGenerator="systemTime" />
            </AuditPath>
        </AuditPath>        
        
        <AuditPath key="searchQuery">
            <AuditPath key="no-error">
                <RecordValue key="language" dataExtractor="simpleValue" dataSource="/action/searchQuery/args/language"/>
                <RecordValue key="query" dataExtractor="simpleValue" dataSource="/action/searchQuery/args/query"/>
                <RecordValue key="store" dataExtractor="simpleValue" dataSource="/action/searchQuery/args/store"/>
                <GenerateValue key="personFullName" dataGenerator="personFullName"/>
                <GenerateValue key="currentUser" dataGenerator="currentUser"/>
                <GenerateValue key="systemTime" dataGenerator="systemTime"/>
            </AuditPath>
            <AuditPath key="error">
                <RecordValue key="language" dataExtractor="simpleValue" dataSource="/action/searchQuery/args/language"/>
                <RecordValue key="query" dataExtractor="simpleValue" dataSource="/action/searchQuery/args/query"/>
                <RecordValue key="store" dataExtractor="simpleValue" dataSource="/action/searchQuery/args/store"/>
                <RecordValue key="error" dataExtractor="simpleValue" dataSource="/action/searchQuery/error"/>
                <GenerateValue key="personFullName" dataGenerator="personFullName" />
                <GenerateValue key="currentUser" dataGenerator="currentUser" />
                <GenerateValue key="systemTime" dataGenerator="systemTime" />
            </AuditPath>
        </AuditPath>                        

        <AuditPath key="searchSimple">
            <AuditPath key="no-error">
                <RecordValue key="name" dataExtractor="simpleValue" dataSource="/action/searchSimple/args/name"/>
                <RecordValue key="contextNodeRef" dataExtractor="simpleValue" dataSource="/action/searchSimple/args/contextNodeRef"/>
                <GenerateValue key="personFullName" dataGenerator="personFullName"/>
                <GenerateValue key="currentUser" dataGenerator="currentUser"/>
                <GenerateValue key="systemTime" dataGenerator="systemTime"/>
            </AuditPath>
            <AuditPath key="error">
                <RecordValue key="name" dataExtractor="simpleValue" dataSource="/action/searchSimple/args/name"/>
                <RecordValue key="contextNodeRef" dataExtractor="simpleValue" dataSource="/action/searchSimple/args/contextNodeRef"/>
                <RecordValue key="error" dataExtractor="simpleValue" dataSource="/action/searchSimple/error"/>
                <GenerateValue key="personFullName" dataGenerator="personFullName" />
                <GenerateValue key="currentUser" dataGenerator="currentUser" />
                <GenerateValue key="systemTime" dataGenerator="systemTime" />
            </AuditPath>
        </AuditPath>                        

        <AuditPath key="getCurrentTicket">
            <AuditPath key="no-error">
                <RecordValue key="result" dataExtractor="simpleValue" dataSource="/action/getCurrentTicket/result"/>
                <GenerateValue key="personFullName" dataGenerator="personFullName"/>
                <GenerateValue key="currentUser" dataGenerator="currentUser"/>
                <GenerateValue key="systemTime" dataGenerator="systemTime"/>
            </AuditPath>
            <AuditPath key="error">
                <RecordValue key="error" dataExtractor="simpleValue" dataSource="/action/getCurrentTicket/error"/>
                <GenerateValue key="personFullName" dataGenerator="personFullName" />
                <GenerateValue key="currentUser" dataGenerator="currentUser" />
                <GenerateValue key="systemTime" dataGenerator="systemTime" />
            </AuditPath>
        </AuditPath>                        
        
    </Application>

</Audit>
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Now it all works and fine, and I can see the alf_audit_entry table growing with every action I carry out, but this single table doesn't give us any information about what's happening really. So I found an old script in the Alfresco wiki, which I configured a little bit, to get as much information as possible from the audit:

    select

      /*Data extract*/
        entry.id                    as Entry_ID,
            entry.audit_app_id               as Application_ID,
            sv_entry.string_value            as Entry_String_Value,
            sv_app.string_value               as Application_String_Value,
            sv_pl.string_value               as ALF_PROP_LINK_String_Value,
            sv_pl2.string_value               as ALF_PROP_LINK_String_Value,

      /*alf_audit_entry TABLE as entry*/
        entry.id                    as alf_audit_entry___id,
            entry.audit_app_id               as alf_audit_entry___audit_app_id,
        entry.audit_time            as alf_audit_entry___audit_time,
        entry.audit_user_id         as alf_audit_entry___audit_user_id,
        entry.audit_values_id       as alf_audit_entry___audit_values_id,

      /*alf_audit_app TABLE as app*/
        app.id                                  as alf_audit_app___id,
        app.version                         as alf_audit_app___version,
            app.app_name_id                     as alf_audit_app___app_name_id,
            app.audit_model_id                as alf_audit_app___audit_model_id,
            app.disabled_paths_id          as alf_audit_app___disabled_paths_id,

      /*alf_audit_model TABLE as model*/
            model.id                               as alf_audit_model___id,
            model.content_data_id          as alf_audit_model___content_data_id,
            model.content_crc                as alf_audit_model___content_crc,

      /*alf_content_data TABLE as dat*/
            dat.id                                  as alf_content_data___id, 
            dat.version                         as alf_content_data___version,
            dat.content_url_id               as alf_content_data___content_url_id,
            dat.content_mimetype_id         as alf_content_data___content_mimetype_id,
            dat.content_encoding_id         as alf_content_data___content_encoding_id,
            dat.content_locale_id            as alf_content_data___content_locale_id,

      /*alf_prop_link TABLE as pl*/
        pl.root_prop_id             as alf_prop_link___root_prop_id,
        pl.prop_index               as alf_prop_link___prop_index,
        pl.contained_in             as alf_prop_link___contained_in,
        pl.key_prop_id              as alf_prop_link___key_prop_id,
        pl.value_prop_id            as alf_prop_link___value_prop_id,

      /*alf_prop_value TABLE as pv*/
        pv.actual_type_id           as alf_prop_value___actual_type_id,
        pv.persisted_type           as alf_prop_value___persisted_type,
        pv.long_value               as alf_prop_value___long_value,

      /*alf_prop_double_value TABLE as dv*/
        dv.double_value             as alf_prop_double_value___double_value,

      /*alf_prop_string_value TABLE as sv*/
            sv.id                                    as alf_prop_string_value___id,
            sv.string_value             as alf_prop_string_value___string_value,
            sv.string_end_lower               as alf_prop_string_value___string_end_lower,
            sv.string_crc                        as alf_prop_string_value___string_crc,

      /*alf_prop_serializable_value_value TABLE as serv*/
        serv.serializable_value     as prop_serializable_value

    from

        alf_audit_app app
        join alf_audit_entry entry on (entry.audit_app_id = app.id)

        /*Condition from iBatis query: <isEqual property="keyOrValueSearch" compareValue="true">
               join alf_prop_link sp_pl on (sp_pl.root_prop_id = entry.audit_values_id)*/

        join alf_prop_link pl on (pl.root_prop_id = entry.audit_values_id)
        join alf_prop_value pv on (pl.value_prop_id = pv.id)

        left join alf_prop_double_value dv on (dv.id = pv.long_value and pv.persisted_type = 2)
        left join alf_prop_string_value sv on (sv.id = pv.long_value and (pv.persisted_type = 3 OR pv.persisted_type = 5))
        left join alf_prop_serializable_value serv on (serv.id = pv.long_value and pv.persisted_type = 4)

        left join alf_audit_model model on (model.id = app.audit_model_id)
            left join alf_content_data dat on (dat.id = model.content_data_id)

            left join alf_prop_string_value sv_entry on (sv_entry.id = entry.audit_user_id and (pv.persisted_type = 3 OR pv.persisted_type = 5))
            left join alf_prop_string_value sv_app on (sv_app.id = app.app_name_id and (pv.persisted_type = 3 OR pv.persisted_type = 5))
            left join alf_prop_string_value sv_pl on (sv_pl.id = pl.key_prop_id and (pv.persisted_type = 3 OR pv.persisted_type = 5))
            left join alf_prop_string_value sv_pl2 on (sv_pl2.id = pl.value_prop_id and (pv.persisted_type = 3 OR pv.persisted_type = 5))

    ORDER BY entry.id ASC‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

But this still wasn't enough to retrieve all audited properties from the database. So I managed to discover the auditing tables links and relations to some point, and came up with a slightly more informative script, which gave me enough information about the audit entry (although it is still missing some relavant, but less important information):

select entry.id as Entry_ID,

    entry.audit_values_id as Entry_Value_ID,
    link.root_prop_id,
    link.key_prop_id as Key_ID,
    link.value_prop_id as Value_ID,
    /*val_value.long_value as Value_Time_epoch,*/
    FROM_UNIXTIME(LEFT(val_value.long_value,10)) as Value_Time,
    str_val.string_value as Value_String,
    /*val_key.id as apv_Key_ID,
    val_key.long_value as apv_Value_ID,*/
    apsv_result.string_value as Value_PT3,
    key_string.string_value as Audit_Path,
      node.uuid as NodeRef,
      val_ser.serializable_value as Object_Serialized
    
    from alf_audit_entry entry
    left join alf_prop_link link on (entry.audit_values_id = link.root_prop_id)
    left join alf_prop_value val_value on (link.value_prop_id = val_value.id and (val_value.persisted_type = 1) and LENGTH(val_value.long_value) > 9) /* EPOCH TIME*/
    left join alf_prop_string_value str_val on (link.value_prop_id = str_val.id)
    left join alf_prop_value val_key on (link.key_prop_id = val_key.id and (val_key.persisted_type = 3))
    left join alf_prop_string_value key_string on (val_key.long_value = key_string.id)
    
    left join alf_prop_value apv_result on (link.value_prop_id = apv_result.id and (apv_result.persisted_type = 3))
    left join alf_prop_string_value apsv_result on (apv_result.long_value = apsv_result.id)

      left join alf_prop_value val_result on (link.value_prop_id = val_result.id and (val_result.persisted_type = 4))
      left join alf_prop_serializable_value val_ser on (val_result.long_value = val_ser.id)

      left join alf_node node on (entry.audit_values_id = node.id and ( key_string.string_value = '/node/create/no-error/result'))
    
      ORDER BY entry.id ASC
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

If you have a soul entry that you want to list from the DB, you can use the "entry.id" to identify the entry.
Here's an example audit trail for deleting a node:

Inbound audit values:
   /alfresco-api/post/NodeService/deleteNode/no-error=null
   /alfresco-api/post/NodeService/deleteNode/args/nodeRef=workspace://SpacesStore/14ae1679-5701-4c8d-8b52-56fdaae22969
15:12:10,656 DEBUG [org.alfresco.repo.audit.AuditComponentImpl] 
Extracted audit data: 
   Application:    AuditApplication[ name=Node, id=14, disabledPathsId=327]
   Values:         
      /node/delete/args/nodeRef=workspace://SpacesStore/14ae1679-5701-4c8d-8b52-56fdaae22969
      /node/delete/no-error=null

   New Data: 
      /node/delete/no-error/nodeRef=workspace://SpacesStore/14ae1679-5701-4c8d-8b52-56fdaae22969

15:12:10,687 DEBUG [org.alfresco.repo.audit.AuditComponentImpl] 
New audit entry: 
   Application ID: 14
   Entry ID:       320
   Values:         
      /node/delete/args/nodeRef=workspace://SpacesStore/14ae1679-5701-4c8d-8b52-56fdaae22969
      /node/delete/no-error=null

   Audit Data: 
      /node/delete/no-error/currentUser=admin
      /node/delete/no-error/systemTime=Wed Jul 27 15:12:10 CEST 2011
      /node/delete/no-error/personFullName=Administrator
      /node/delete/no-error/nodeRef=workspace://SpacesStore/14ae1679-5701-4c8d-8b52-56fdaae22969‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Based on this, we now know the audit entry id = 320.

So we modify the DB query to show only this single audit entry, like this (check the last-but-one line, starting with the "WHERE" clause):

select entry.id as Entry_ID,

    entry.audit_values_id as Entry_Value_ID,
    link.root_prop_id,
    link.key_prop_id as Key_ID,
    link.value_prop_id as Value_ID,
    /*val_value.long_value as Value_Time_epoch,*/
    FROM_UNIXTIME(LEFT(val_value.long_value,10)) as Value_Time,
    str_val.string_value as Value_String,
    /*val_key.id as apv_Key_ID,
    val_key.long_value as apv_Value_ID,*/
    apsv_result.string_value as Value_PT3,
    key_string.string_value as Audit_Path,
      node.uuid as NodeRef,
      val_ser.serializable_value as Object_Serialized
    
    from alf_audit_entry entry
    left join alf_prop_link link on (entry.audit_values_id = link.root_prop_id)
    left join alf_prop_value val_value on (link.value_prop_id = val_value.id and (val_value.persisted_type = 1) and LENGTH(val_value.long_value) > 9) /* EPOCH TIME*/
    left join alf_prop_string_value str_val on (link.value_prop_id = str_val.id)
    left join alf_prop_value val_key on (link.key_prop_id = val_key.id and (val_key.persisted_type = 3))
    left join alf_prop_string_value key_string on (val_key.long_value = key_string.id)
    
    left join alf_prop_value apv_result on (link.value_prop_id = apv_result.id and (apv_result.persisted_type = 3))
    left join alf_prop_string_value apsv_result on (apv_result.long_value = apsv_result.id)

      left join alf_prop_value val_result on (link.value_prop_id = val_result.id and (val_result.persisted_type = 4))
      left join alf_prop_serializable_value val_ser on (val_result.long_value = val_ser.id)

      left join alf_node node on (entry.audit_values_id = node.id and ( key_string.string_value = '/node/create/no-error/result'))

          WHERE entry.id = '320'
      ORDER BY entry.id ASC
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

So this is how far I got. If someone comes up with better auditing stratetgy, or a complete DB query that lists all the information the audit trail shows, please share!

g_rathod

Hi robinflow,

Thanks for posting an audit configuration file, but I am eager to know in following scenario.

1) I have my own custom property (e.g. xz:cargoId ) which is under path :

/{http://www.alfresco.org/model/system/1.0}system/{http://www.alfresco.org/model/system/1.0}people‍

2) I tried applying filter in alfresco-global.properties for type filter below :

audit.filter.alfresco-access.default.type=cm:content;cm:person;cm:folder;‍

3) I have following configuration for audit in global.properties file

### Enable audit in general ###
audit.enabled=true
audit.alfresco-access.enabled=true
audit.alfresco-access.sub-actions.enabled=true
audit.alfresco-access.sub-events.enabled=true



# Enable debug from the PropertyAuditFilter
log4j.logger.org.alfresco.repo.audit.PropertyAuditFilter=debug

### Audit Filter ###
audit.filter.alfresco-access.default.enabled=true
audit.filter.alfresco-access.default.type=cm:content;cm:person;cm:folder;
audit.filter.alfresco-access.default.path=.*
audit.filter.alfresco-access.default.user=.*;~System;‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

4) Now when I change anything user properties like firstName/lastName or even my custom id xz:cargoId
it is not showing anything in log.

Any idea how do I include my custom content type or property in audit ?

eric_soto

Hi g_rathod,

You might want to try adding the following property to your alfresco-global.properties file (and perhaps eliminate the audit.filter.alfresco-access.default.type property):

audit.filter.alfresco-access.transaction.type=cm:folder;cm:content;cm:person;xz:cargoId 
‍‍‍

I hope this helps. Cheers.