Repository
The event audit logs are stored in a configurable storages, we call them repositories. To use an extension, you have to choose one of the available repositories.
The following repositories are available:
redis- the default repository, stores logs in Redis.postgres- stores logs in a PostgreSQL database.cloudwatch- stores logs in AWS CloudWatch.
redis |
postgres |
cloudwatch |
|
|---|---|---|---|
| Durable | only as much as your Redis persistence settings | yes | yes |
| Filtering | scans all the events | SQL, with indexes | FilterLogEvents query |
| Remove one event | yes | yes | no |
| Remove by time range (retention) | yes | yes | no |
| Remove all events | yes | yes | yes, recreates the log group |
Note
If the cloudwatch repository is used, the extension will automatically create a log group in CloudWatch. Also, check the CloudWatch repository documentation for additional configuration options.
Tip
Redis is the default because it needs no setup, but every read scans all the events, and nothing removes old ones on its own. For an audit log that you keep and query, prefer postgres.
Active repository
The default repository is redis, but it can be changed to a different one. To do this, we have to set the following configuration options in the CKAN configuration file:
ckanext.event_audit.active_repo = postgres
The postgres repository needs the extension's tables, see Installation.
The repository is picked when the application starts, so this option can't be changed from the admin panel of a running site. To switch the repository, change the config file and restart the application.
List of available repositories
You can restrict a list of available repositories by setting the following configuration option in the CKAN configuration file:
ckanext.event_audit.active_repo = cloudwatch
ckanext.event_audit.restrict_available_repos = cloudwatch
Note
By default, we're not restricting the list of available repositories. It means that all registered repositories are available for use.
This could be useful if you want to limit the available repositories to a specific set of options due to some security concerns. This config option won't be available in the admin interface and can't be changed in real time.