This module provides infrastructure for audit logging inside Prosody.
Audit logs will contain security sensitive events, both for server-wide incidents as well as user-specific.
This module, however, only provides the infrastructure for audit
logging. It does not, by itself, generate such logs. For that, other
modules, such as mod_audit_auth or
mod_audit_user_accounts need to be loaded.
Audit logging is intended to ensure the security of a system. As such, its contents are often at the same time highly sensitive (containing user names and IP addresses, for instance) and allowed to be stored under common privacy regulations.
Before using these modules, you may want to ensure that you are legally allowed to store the data for the amount of time these modules will store it. Note that it is currently not possible to store different event types with different expiration times.
You can view the log using prosodyctl. This works even when Prosody is not running.
For example, to view the full audit log for example.com:
prosodyctl mod_audit example.comTo view only host-wide events (those not attached to a specific user
account), use the --global option (or use
--no-global to hide such events):
prosodyctl mod_audit --global example.comTo narrow results to a specific user, specify their JID:
prosodyctl mod_audit user@example.comWith the plugin installer in Prosody 0.12 you can use:
sudo prosodyctl install --server=https://modules.prosody.im/rocks/ mod_auditFor earlier versions see the documentation for installing 3rd party modules