Package org.forgerock.audit.handlers.splunk

Class SplunkAuditEventHandler

java.lang.Object

org.forgerock.audit.events.handlers.AuditEventHandlerBase

org.forgerock.audit.handlers.splunk.SplunkAuditEventHandler

All Implemented Interfaces:

AuditEventHandler, BatchConsumer

public final class SplunkAuditEventHandler
extends AuditEventHandlerBase
implements BatchConsumer

Audit event handler that writes out to Splunk's HTTP event collector RAW endpoint.

Field Summary

Fields inherited from class org.forgerock.audit.events.handlers.AuditEventHandlerBase

eventTopicsMetaData

Constructor Summary

Constructors

Constructor	Description
SplunkAuditEventHandler(SplunkAuditEventHandlerConfiguration configuration, EventTopicsMetaData eventTopicsMetaData, BatchPublisherFactory publisherFactory, Client client)	Constructs a new Splunk audit event handler.

Method Summary

Modifier and Type	Method	Description
void	addToBatch(String topic, JsonValue event, StringBuilder payload)	Adds an audit event to a batch payload.
Promise<Void,BatchException>	publishBatch(String payload)	Publishes the batch payload.
Promise<ResourceResponse,ResourceException>	publishEvent(Context context, String topic, JsonValue event)	Publishes an event to the provided topic.
Promise<QueryResponse,ResourceException>	queryEvents(Context context, String topic, QueryRequest query, QueryResourceHandler handler)	Query some events from the provided topic.
Promise<ResourceResponse,ResourceException>	readEvent(Context context, String topic, String resourceId)	Reads an event with the provided resource id from the provided topic.
void	shutdown()	Instruct this object to flush any buffers and close any open file handles or network connections.
void	startup()	Instruct this object that it is safe to initialize file handles and network connections.

Methods inherited from class org.forgerock.audit.events.handlers.AuditEventHandlerBase

getHandledTopics, getName, handleAction, isEnabled

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

SplunkAuditEventHandler

public SplunkAuditEventHandler(SplunkAuditEventHandlerConfiguration configuration,
                               EventTopicsMetaData eventTopicsMetaData,
                               BatchPublisherFactory publisherFactory,
                               Client client)

Constructs a new Splunk audit event handler.

Parameters:

configuration - the Splunk audit event handler configuration

eventTopicsMetaData - topic meta data

publisherFactory - the batch publisher factory or null

client - HTTP client or null

Method Detail

startup

public void startup()
             throws ResourceException

Description copied from interface: AuditEventHandler

Instruct this object that it is safe to initialize file handles and network connections.

Reconfiguration of the AuditService and its handlers is achieved by replacing rather than modifying the existing objects. Therefore, it's essential that the replacements do not perform any I/O that would interfere with the operation of the objects they are replacing until the old objects are shutdown. For example, when shutting down an old instance of a file-based AuditEventHandler, the old instance may need to flush buffers, apply file rotation or retention policies, or even add line or block signatures as part of tamper evident logging. Any of these operations could be broken if two handler instances are operating on the same set of files simultaneously.

Specified by:

startup in interface AuditEventHandler

Throws:

ResourceException - if starting the AuditEventHandler fails

shutdown

public void shutdown()
              throws ResourceException

Description copied from interface: AuditEventHandler

Instruct this object to flush any buffers and close any open file handles or network connections.

Specified by:

shutdown in interface AuditEventHandler

Throws:

ResourceException - if closing the AuditEventHandler fails

publishEvent

public Promise<ResourceResponse,ResourceException> publishEvent(Context context,
                                                                      String topic,
                                                                      JsonValue event)

Description copied from interface: AuditEventHandler

Publishes an event to the provided topic.

Note for implementors, it is imperative that the supplied event is not modified in any way as this may cause undesirable behaviour where multiple handlers are configured. If the event must be modified, then make a copy of it and work with that.

Specified by:

publishEvent in interface AuditEventHandler

Parameters:

context - The context chain that initiated the event.

topic - The topic where to publish the event.

event - The event to publish - which should be considered immutable.

Returns:

a promise with either a response or an exception

readEvent

public Promise<ResourceResponse,ResourceException> readEvent(Context context,
                                                                   String topic,
                                                                   String resourceId)

Description copied from interface: AuditEventHandler

Reads an event with the provided resource id from the provided topic.

Specified by:

readEvent in interface AuditEventHandler

Parameters:

context - The context chain that initiated the event.

topic - The topic where event is read.

resourceId - The identifier of the event.

Returns:

a promise with either a response or an exception

queryEvents

public Promise<QueryResponse,ResourceException> queryEvents(Context context,
                                                                  String topic,
                                                                  QueryRequest query,
                                                                  QueryResourceHandler handler)

Description copied from interface: AuditEventHandler

Query some events from the provided topic.

Specified by:

queryEvents in interface AuditEventHandler

Parameters:

context - The context chain that initiated the event.

topic - The topic on which query is performed.

query - The request with the query.

handler - The handler to process responses for the query.

Returns:

a promise with either a response or an exception

addToBatch

public void addToBatch(String topic,
                       JsonValue event,
                       StringBuilder payload)
                throws BatchException

Description copied from interface: BatchConsumer

Adds an audit event to a batch payload.

Specified by:

addToBatch in interface BatchConsumer

Parameters:

topic - event topic

event - event JSON payload

payload - batch payload

Throws:

BatchException - indicates failure to add-to-batch

publishBatch

public Promise<Void,BatchException> publishBatch(String payload)

Description copied from interface: BatchConsumer

Publishes the batch payload.

Specified by:

publishBatch in interface BatchConsumer

Parameters:

payload - batch payload

Returns:

a simple promise encapsulating any potential batch exception