jerryshao opened a new issue, #11230:
URL: https://github.com/apache/gravitino/issues/11230
### What would you like to be improved?
Currently, Gravitino's audit log is dispatched at the application
(dispatcher) layer, which means any HTTP request that fails before reaching
Jersey — malformed JSON, unknown routes, authentication rejection at the Jetty
level — produces no record whatsoever. There is no way to observe these
requests after the fact.
An HTTP-level access log (similar to Nginx/Apache access logs) would provide
a complete, unfiltered record of every request the server receives, regardless
of whether it reaches the application layer. This should be supported across
all three servers: the main Gravitino server, the Iceberg REST server, and the
Lance REST server.
### How should we improve?
Jetty 9.4 (already used by all three servers via `JettyServer` in
`server-common`) natively supports access logging via `NCSARequestLog`, shipped
in `jetty-server` with no additional dependencies required.
The implementation involves:
1. Add config entries to `JettyServerConfig` under `accessLog.*`:
- `enabled` (default: `false`)
- `path` — log file path supporting date-rolling pattern (e.g.
`gravitino-access-yyyy_mm_dd.log`)
- `retainDays` (default: `30`)
2. In `JettyServer.initialize()`, wire up Jetty's built-in `NCSARequestLog`
via `server.setRequestLog(...)` when enabled.
Since all three servers each own a separate `JettyServer` instance and
independently load their own `JettyServerConfig`, each server can be configured
and enabled independently. The change is made once in `JettyServer` and applies
to all three.
The access log complements the existing audit log: the audit log provides
rich business context (operation type, resource, result count) while the access
log provides complete HTTP-level coverage including requests that never reach
the audit framework.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
