Link the audit message record to its associated log records in syslog

Products

• CA API Gateway

Issue/Introduction

User want to find out if there is a way to add the AuditRecord to the associated logs in the Policy Manager. Our logs are sent to syslog ng and it is difficult to tell what logs are from the same AuditRecord, especially in the case where multiple users' logs are coming in at the same time. In this case, their logs overlap and it is difficult to discern which logs correspond to which user without a unique identifier. User would like to know if there is a way to add the AuditRecord to these logs.

Environment

ssg 10.x

Resolution

The  AuditRecord Id is generated internally by the gateway and is not able to referenced manully in the policy or audit sink log policy.  On the other hand it can use the generally defined ${requestId} context variable to link the audit main (or audit message) record and the audit detail log records for the syslog. 

It can be done using the cluster-wide property: 

audit.log.service.detailFormat = ${requestId}: {0}: {1} 

https://techdocs.broadcom.com/us/en/ca-enterprise-software/layer7-api-management/api-gateway/10-1/administer-the-gateway/gateway-auditing-threshold-and-format.html