**As** an administrator of an OpenProject installation
**I want to** have a standardized logging and auditing mechanism that is easily configurable and observable
**so that** I can monitor, observe and audit the application in a secure and compliant way

**Acceptance criteria**

* **Auditing** Begin of the insertion

End of the insertion Begin of the deletion
End of the deletion * Check and unify the different auditing options we currently have Begin of the insertion

End of the insertion Begin of the deletion
End of the deletion * paper\_trail on attachments, projects, principal, work\_package Begin of the insertion

End of the insertion Begin of the deletion
End of the deletion * Visualize these paper trails through an administrative UI, allow filtering them Begin of the insertion

End of the insertion Begin of the deletion
End of the deletion * **Logging data** Begin of the insertion

End of the insertion Begin of the deletion
End of the deletion * Log created audits in a standardized way Begin of the insertion

End of the insertion Begin of the deletion
End of the deletion * Log all failed authorization attempts in a standardized way Begin of the insertion

End of the insertion Begin of the deletion
End of the deletion * Log all succesful login attempts, including authentication methods Begin of the insertion

End of the insertion Begin of the deletion
End of the deletion * Log changes to RBAC and roles assignments Begin of the insertion

End of the insertion Begin of the deletion
End of the deletion * Log Begin of the insertionchanges to project memberships, anytime a permissions is granted or revoked

* LogEnd of the insertion all system administration activities (e.g. changes made to the system settings) Begin of the insertion

End of the insertion Begin of the deletion
End of the deletion * Logging of all user activities (e.g. who created, deleted, sent, released, shared which project and when) and which action was performed. Begin of the insertion

End of the insertion Begin of the deletion
End of the deletion * Verify and correct all login attempts for internal and external authentication Begin of the insertion

End of the insertion Begin of the deletion
End of the deletion * Document all categories of logged data with examples Begin of the insertion

End of the insertion Begin of the deletion
End of the deletion * Configure the above logging categories globally for privacy reasons Begin of the insertion

End of the insertion Begin of the deletion
End of the deletion * **Logging capabilities** Begin of the insertion

End of the insertion Begin of the deletion
End of the deletion * Verify and document structured logging capabilities (e.g., LogRage JSON formatter) Begin of the insertion

End of the insertion Begin of the deletion
End of the deletion * Document these capabilities Begin of the insertion

End of the insertion Begin of the deletion
End of the deletion * **Open / for discussion:** Begin of the insertion

End of the insertion Begin of the deletion
End of the deletion * Tamper-proof audits, write-only columns (need to check technical feasibility) Begin of the insertion


End of the insertion Begin of the deletion

End of the deletion **BSI Grundschutz Requirements**

> **SYS1.6**
>
> Die Ausgabe von Informationen über das Betriebssystem und der Zugriff auf Protokoll- und Konfigurationsdateien SOLLTE für Benutzende auf das notwendige Maß beschränkt werden.

> [SYS.1.1.A10](https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Grundschutz/Kompendium_Einzel_PDFs_2021/07_SYS_IT_Systeme/SYS_1_1_Allgemeiner_Server_Edition_2021.pdf?__blob=publicationFile&v=2)
>
> Generell MÜSSEN alle sicherheitsrelevanten Systemereignisse protokolliert werden, dazu gehören mindestens:
>
> * erfolgreiche und erfolglose Anmeldungen am der Anwendungssoftware
> Begin of the insertion
>End of the insertion * fehlgeschlagene Berechtigungsprüfungen
> Begin of the insertion
>End of the insertion * blockierte Datenströme (Verstöße gegen ACLs oder Firewallregeln),
> Begin of the insertion
>End of the insertion * Einrichtung oder Änderungen von Benutzern, Gruppen und Berechtigungen,
> Begin of the insertion
>End of the insertion * sicherheitsrelevante Fehlermeldungen (z. B. Hardwaredefekte, Überschreitung von Kapazitätsgrenzen) sowie
> Begin of the insertion
>End of the insertion * Warnmeldungen von Sicherheitssystemen (z. B. Virenschutz) Begin of the insertion
End of the insertion Begin of the deletion

End of the deletion > Begin of the insertion

>End of the insertion [APP3.2](https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Grundschutz/IT-GS-Kompendium_Einzel_PDFs_2023/06_APP_Anwendungen/APP_3_2_Webserver_Edition_2023.pdf?__blob=publicationFile&v=3)
>
> APP.3.2.A4 Protokollierung von Ereignissen (B)
>
> * Der Webserver MUSS mindestens folgende Ereignisse protokollieren:
> Begin of the insertion
>End of the insertion * erfolgreiche Zugriffe auf Ressource
> Begin of the insertion
>End of the insertion * fehlgeschlagene Zugriffe auf Ressourcen aufgrund von mangelnder Berechtigung, nicht vorhandenen Ressourcen und Server-Fehlern
> Begin of the insertion
>End of the insertion * allgemeine Fehlermeldungen. Begin of the insertion
>

End of the insertion Begin of the deletion

End of the deletion * [BSI OPS1.1.5 Protokollierung](https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Grundschutz/IT-GS-Kompendium_Einzel_PDFs_2023/04_OPS_Betrieb/OPS_1_1_5_Protokollierung_Edition_2023.html)