is it possible to limit the audit output

As we transition to the new Hyland Community, some post links may be temporarily disrupted as we finalize redirects. We apologize for the inconvenience and are working to resolve this as quickly as possible. Details.

mrksjs

Hello,

i configured auditing for community version of alfresco 3.4.d and i managed to receive most of the details i need. however the audit output is massive, when im browsing my sites it seems like the logfile is exploding!
i created a file in /tomcat/shared/classes/alfresco/extension/audit like the following

<?xml version='1.0' encoding='UTF-8'?>

<!–
   An example of how user login details can be captured.
–>

<Audit
    xmlns="http://www.alfresco.org/repo/audit/model/3.2"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.alfresco.org/repo/audit/model/3.2 alfresco-audit-3.2.xsd"
    >

    <DataExtractors>
       <DataExtractor name="simpleValue" registeredName="auditModel.extractor.simpleValue"/>
    </DataExtractors>

    <DataGenerators>
       <DataGenerator name="personFullName" registeredName="auditModel.generator.personFullName"/>
    </DataGenerators>

    <PathMappings>
        <PathMap source="/alfresco-api/post/NodeService/createNode/no-error" target="/auditexamplecreate/create"/>
    </PathMappings>

    <Application name="AuditExampleCreate" key="auditexamplecreate">
        <AuditPath key="create">
       <RecordValue key="file" dataExtractor="simpleValue" dataSource="/auditexamplecreate/create/args/assocQName"/>
            <GenerateValue key="user" dataGenerator="personFullName"/>
        </AuditPath>
    </Application>

</Audit>
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

i'd have 2 questions:
- how can i limit the audit output to my configured "sets" (application,pathmapping,datagenerator,..) only
- is it possible to write the audit trail into a seperate file?


thanks

mrksjs

i played around with the configuration a little and set

audit.filter.alfresco-access.default.user=~System;.*‍

but still, i receive many (many many) audit output from user: system. the filter should discard these lines for me, right?