Log or notify about events
Sometimes it would be interesting to have important events logged (or admin notified):
- if you run a wiki in a security sensitive context you might want to get notified if someone tries to hack into the system:
- new accounts created (done)
- failed logins (done)
- denial by ACL(?) (done?)
- other (non-security) important system events:
- running out of disk space
- tracebacks happened
- high load (although this is maybe rather for general server monitoring) or rather high moin page request rate
- users / IPs getting blacklisted by surge protection
Much logging was added in the (not released at the time of this writing) 1.9.8 version, particularly the merge of commit 6081:3253536f55fe. The focus of these changes is to capture events that may indicate abuse of the wiki. However, there may remain unlogged events that indicate abuse. A comprehensive audit was not done. Further, all user events must be logged for an administrator to obtain an accurate picture. Just knowing that, say, a particular user was denied by ACL 10 times in a day is not enough. A very different picture is painted if that user made no other edits than if the user made hundreds of valid edits over the course of the day. Where the former might indicate someone attempting to abuse the wiki the latter might be nothing more than a very active wiki user. The existing event logging does not log most "normal", successful, events. It would be nice if moin v2 addressed the issue of user event logging in a more systematic way.
The events that are presently logged can be captured in a separate log file by altering logging configuration so that, instead of and in addition to it's current content, the config file contains something like the following:
[loggers] # Add moin_abuse as a key keys=root,moin_debug,moin_abuse [logger_moin_abuse] # adapt the next lines to your abuse logging needs: level=INFO handlers=abuse qualname=MoinMoin.util.abuse # Keep abuse log output out of regular log propagate=0 [handlers] # Add an abuse handler keys=stderr,abuse [handler_abuse] class=StreamHandler formatter=abuse level=DEBUG args=(sys.stderr, ) [formatters] # Add an abuse formatter keys=default,abuse [formatter_abuse] format=%(asctime)s %(levelname)s%(message)s datefmt= class=logging.Formatter