Where can I find a list of all event types (service start, authentication failure, etc) that are logged at each of the different log levels (Info, Verbose, etc)? Our company wants to track what events are logged for each of our software products (such as Octopus). I’m not seeing any documentation on your website about this. Specifically we’re looking for, does Octopus log these events…
Unsuccessful attempts to read security logs
Successful and unsuccessful attempts to modify security logs other than by the logging mechanism
Successful and unsuccessful attempts to modify the configuration of the auditing, access control, and identification and authentication mechanisms of the system
Unsuccessful attempts to access files
Successful and unsuccessful attempts to startup and shutdown the system
Unsuccessful attempts to read security logs
Only users with “EventView” permissions may access the Audit Log. Users without permission will not be presented with a button and if they manually edit the URL to try to navigate to the Audit Log, they will be presented with this message:
Successful and unsuccessful attempts to modify security logs other than by the logging mechanism
The Audit Logs come from the Octopus SQL database. Authorized/Unauthorized manual access would be directly managed by SQL. Keep in mind that permissions are very controlled and granular within the product. However, this obviously does not apply to files on the server that may be accessed outside the product.
Successful and unsuccessful attempts to modify the configuration of the auditing, access control, and identification and authentication mechanisms of the system
Successful modifications to anything related to user permissions will show in the Audit Log. Changes to the identification and authentication mechanisms of Octopus Server are logged in the Server Logs, accessible locally on the machine that Octopus Server is installed on.
Unsuccessful attempts to access files
Denied access attempts are not logged within Octopus Server as Octopus only logs changes. Attempts to access files related to Octopus on the local machine that Octopus Server is installed on would be managed by that machine.
Successful and unsuccessful attempts to startup and shutdown the system
Since Octopus Server runs as a Windows Service, you will find a record of the service changing state in both the Octopus Server logs (via the Home directory listed in Octopus Manager) as well as in the Windows Event Logs for that machine.
Web Request logging is available as well. This will log things such as 403 errors in the event users try to access URLs directly they are not supposed to.
I hope that answers your questions. If you have any more questions or would like additional clarification, please let me know.
