We recently moved upgraded our linux (Ubuntu Hardy) server from an older version of Wildfire to the newest version (3.5.1) and I noticed that the audit function no longer writes log files. At first, it would only write them after 12:00 pm, which I thought was strange. Now, it won’t write any logs. In fact, it even deleted the logs we had before the update.
The audit settings are:
Folder: /var/log/openfire-audit
Max size of all files (MB): 10000
Max file size (MB): 10
Maximum days to archive: 999999
Flush interval (seconds): 60
Packets to audit: Message Packets Only
I checked the folder permissions and the openfire user and group has full access (the folder is set to 0775). We have a custom application that we use the read the audit log files, so we can’t use the new Monitoring Service plugin. Plus we need the “Ignore packets from/to users” feature. The Monitoring Service plugin does not have this feature.