Tracking user activity on php using log4php

Question

I already have a simple audit trail for my system. But my professor wants to add what the user did for the audit trail. I can't even imagine how to do that. I discovered log4php http://logging.apache.org/log4php/index.html I've learned that it makes a text file every access to the site. But how do I incorporate that in the table that i already have in mysql and fill up the activity column in my page?

Answer 1

Your table is unable to store this information. I see columns for login and logout timestamps, and something with "activity", but the data you will generate will be more than one activity per login session.

Additionally, audit trails usually are not stored inside a system that can be altered easily.

Unless you want to write your own appender, the one that is included in Log4PHP is described here: https://logging.apache.org/log4php/docs/appenders/pdo.html

It has details on how the storage table has to be defined:

timestamp DATETIME
logger VARCHAR
level VARCHAR
message VARCHAR
thread VARCHAR
file VARCHAR
line VARCHAR

Whenever you feel that your code should generate an entry in the audit log, you'd probably get hold of the audit logger object and send a message to it:

Logger::get('audit')->info('Stuff happened');

This will create a log message with all the info needed for the database. Additionally you can use the MDC feature: You can set permanent information that might get added to your log message. MDC is short for "mapped diagnostic context", and can add values like "current user" to the message.

But this will only happen if you configure a proper log message format with this MDC value included. The configuration might happen via the LoggerLayoutPattern, see https://logging.apache.org/log4php/docs/layouts/pattern.html for details.

Bottom line: I'd rather not add Log4PHP for audit logging if you haven't used it so far for generic application logging. It is a powerful tool with plenty of abilities, but I see many issues with trying to make it a perfect fit for your current use case. It seems to be easier for you if you just do the audit logging yourself, because you can then include all the info you need in your database.