Meta-Issue: Auditing

[dannylamb]

This is a meta issue to track other issues related to auditing functionality. Please refer to this issue in any subsequent issues to link them.

Some initial thoughts:

• We need to further clarify what is the expected behaviour w/r/t auditing.
• Do Fedora's auditing capaibilities meet our needs?
• How do we handle migrating audit data from 7.x?
• Are there other preservationy things like checksum checking, etc... that fall under the purview of this?

[mjordan]

The Fedora 4.7 community implementation provides an audit service but there is nothing in the spec that mentions auditing directly. Section 6, "Notifications", describes the messaging that external services can use to perform auditing functions. In the interests of being implementation agnostic, CLAW's auditing functionality should probably stick to the spec as opposed to a specific implementation's feature set.

Some relevant CLAW issues:

• Migrate AUDIT datastream
• Storing fixity auditing outcomes

and there may be others. Personally, I'd like us to develop a profile/functional requirements for auditing in CLAW, like you suggest. Fixity auditing could be our first requirement since we've already started that work, but we might have others that could be addressed with their own microservices if necessary.

I notice that in #929 and #930 you mention this pattern:

• Emit events from Drupal to an activemq queue
• Read events from the queue using a camel listener issue a request to the microservice, storing the results in the repository.

I'm curious why in this pattern microservices listen to Drupal and not FCREPO. Is it because not all assets might be persisted in the repository? Or because Context mediates a lot of workflows that might potentially bypass FCREPO? Or because CLAW is "Drupal first"?

[mjordan]

... and if we want to spin off a group to tackle specing out auditing, I am happy to coral/lead that group.