Skip to content

Disable auditing by default #16110

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
vpavic opened this issue Mar 6, 2019 · 3 comments
Closed

Disable auditing by default #16110

vpavic opened this issue Mar 6, 2019 · 3 comments
Labels
type: enhancement A general enhancement
Milestone
2.2.0.M3

Comments

@vpavic
Copy link
Contributor

vpavic commented Mar 6, 2019

Out-of-the-box auditing is backed by InMemoryAuditEventRepository which I believe, as already expressed in #11605 (comment), isn't appropriate for production use due to:

  • limited storage capabilities
  • memory consumption
  • not being cluster ready

I would propose to disable this by default and make the whole AuditAutoConfiguration conditional on presence of AuditEventRepository bean, rather than it having register InMemoryAuditEventRepository itself.

This would also be somewhat consistent with the #15039.
@spring-projects-issues spring-projects-issues added the status: waiting-for-triage An issue we've not yet triaged label Mar 6, 2019
@bclozel bclozel added type: enhancement A general enhancement and removed status: waiting-for-triage An issue we've not yet triaged labels Mar 8, 2019
@bclozel bclozel added this to the 2.2.x milestone Mar 8, 2019
@mrifni
Copy link
Contributor

mrifni commented Mar 8, 2019

Hi, I would like to work on this if possible with some guidance. Please let me know.

@wilkinsona
Copy link
Member

wilkinsona commented Mar 8, 2019 •
edited
Loading

Thanks for the offer, @mrifni. I think we might need to do a bit of design work until we're ready to implement something here. One option is to do as @vpavic suggests. Another would be to make AuditAutoConfiguration conditional on a property that's false by default. Whatever we do will need to consider #15039 at the same time so that things are consistent. Please leave it with us for now while we figure out what changes we'd like to make.

@wilkinsona wilkinsona added the status: pending-design-work Needs design work before any code can be developed label Mar 8, 2019
@mrifni
Copy link
Contributor

mrifni commented Mar 8, 2019

sure

@mbhave mbhave added for: team-attention An issue we'd like other members of the team to review and removed for: team-attention An issue we'd like other members of the team to review status: pending-design-work Needs design work before any code can be developed labels May 3, 2019
@mbhave mbhave modified the milestones: 2.2.x, 2.2.0.M3 May 3, 2019
@mbhave mbhave closed this as completed in 07d6eb6 May 3, 2019
@wilkinsona wilkinsona changed the title Consider disabling auditing by default Disable auditing by default Jun 3, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
type: enhancement A general enhancement
Projects
None yet
Milestone
2.2.0.M3
Development

No branches or pull requests
6 participants
@bclozel @wilkinsona @vpavic @mrifni @mbhave @spring-projects-issues