Release Automation API requests log "superuser" in nolio_requests.log

Products

• CA Release Automation - Release Operations Center (Nolio)
• CA Release Automation - DataManagement Server (Nolio)

Issue/Introduction

Following an upgrade to Release Automation 6.8.5 or higher, administrators may observe automated internal API activity in the nolio_requests.log attributed to the superuser account.

After upgrade to 6.8.5 (or higher version) there is a change in nolio_requests.log for USER NAME field for some API requests.

Before 6.8.5 the username is logged inside the logs

Starting version 6.8.5 the USER NAME is superuser

 

Example :

An artifact download request, it contains the user name in version 6.8.4

2026-07-20T20:38:25.044Z [http-nio-8080-exec-1] INFO  (com.nolio.platform.server.dataservices.services.RequestLogFilter:83) - [HTTP METHOD: POST][STATUS CODE: 200][URL: http://<NAC_ADDRESS>:8080/datamanagement/a/artifactEngineDownloadTask?forceUploadToRepository=false][USER NAME: <username>][REMOTE HOST: <remote_host>][REMOTE ADDRESS: <ip_remote_address>][X-Forwarded-For: null][USER AGENT: Apache-HttpClient/4.5.14 (Java/1.8.0_282)][START TIME: 20/07/2026 08:38:24.892][DURATION: 151ms]

 

Starting version 6.8.5 we get this :

2026-07-20T21:12:44.114Z [http-nio-8080-exec-9] INFO  (com.nolio.platform.server.dataservices.services.RequestLogFilter:83) - [HTTP METHOD: POST][STATUS CODE: 200][URL: http://<NAC_ADDRESS>:8080/datamanagement/a/artifactEngineDownloadTask?forceUploadToRepository=false][USER NAME: superuser][REMOTE HOST: <remote_host>][REMOTE ADDRESS: <ip_remote_address>][X-Forwarded-For: null][USER AGENT: Apache-HttpClient/4.5.14 (Java/1.8.0_282)][START TIME: 20/07/2026 09:12:43.964][DURATION: 150ms]

 

This change has also been detected for following API requests

• POST /datamanagement/a/artifactEngineDownloadTask
• POST /datamanagement/a/token-value
• GET /datamanagement/a/full_applications/{id}
• POST /applications/{id}/artifact_packages/add_artifact?createIfNotExist=true
• PUT /releasecandidates/{id}/artifact_package

Environment

Release Automation 6.8.5 and higher
Release Automation 6.9.0 and higher

Resolution

There is no change in Release Automation code for API request executions.

The API activity are still executed with the same users as before.

Only the USER NAME information logged in nolio_requests.log is changed to superuser
This is due to a change/upgrade of a third party library embedded starting release automation 6.8.5