Integrate SonarQube with your AI agent, scan for secrets and dependency risks, and explore and manage issues—all from the command line.
Start using SonarQube CLI
We need to logging user actions on issues (resolve as false positive, resolve as fixed, resolve as won’t fix). We are collecting audit and access logs, but we cannot find any of the logs which can identify that user/developer made one of these particular actions on issue.
We need evidence if somebody made exception from quality gate by these actions.
I would like to ask you if somebody solved similar issue and can advice us how to change settings of Sonar to be able to log it properly.
Thank you for your tip, but we do not have this “Activity” field in our SonarQube Enterprise 9.9.1.69595.
Moreover we need to log this “Activity” to external logging solution for case of regulation/compliance.
Do you know setup of access/audit logs configuration to see “Activity” in logs?
I figured out that maybe POST api/issues/set_type could give us appropriate logs, but I don’t have evidence yet.
While these activities are logged per-issue (and not in the audit logs), you may be able to monitor POST api/issues/do_transition… or trust the users who are granted the Administer Issues permission!
Could you please give me hint in which log we can monitor it (Access or Audit log)?
We are gather data from access and audit logs and we cannot find it in any of these logs. Is there any possibilities that we can setup access log that we will logs user actions?
our access log settings:
If we do monitoring on API/ISSUES/DO_TRANSITION then all users actions(how, what, when) which use sonar web application can be logged? Could you please share guidline how to setup it?
Thank you for you answer, but I don’t know what I should do with that.
We have a audit issue with regulatory entity. We use SonarQube Enterprise:
Server ID: FD52F9B4-18aaf215224c855, Version: 9.9.1.69595, Date: 2023-08-09
Based on regulatory procedures we need to logging (let say to ELK) all user actions in sonarqube (do_transition- who, when, what).
We setup audit and access logs and we don’t have any information about action there - there is only user made “action” - we are missing which action and where(which project/issue).
To able to keep sonar in our company we need to setup elementary logging that we have evidence about user actions.
Could you please help me with clear instruction how I should setup sonar to be able log user action within issues?
It sounds like you have some high expectations for support in your Enterprise environment – SonarSource offers commercial support that you might want to talk to your account representative about.
If you want to log further details in access.log, you can adjust the sonar.web.accessLogs.pattern in your conf/sonar.properties file (or via environment variables if deploying through a container) like so:
Documentation for further configuration of sonar.web.accessLogs.pattern is included in the conf/sonar.properties file or the aforementioned environment variables documentation.
