[SOLR-13919] RefGuide: Add example for AuditLogger to use log4j to log into separate files

• Type: Improvement
• Status: Open
• Priority: Minor
• Resolution: Unresolved
• Affects Version/s: 8.3
• Component/s: documentation, SolrCloud
• Assignee: Unassigned
• Reporter: Jörn Franke
• Created: 10/Nov/19 19:37
• Updated: 05/Mar/20 14:07

Description

At the moment, the Solr reference guide provides an example on how to log audit events to the standard Solr log (see https://lucene.apache.org/solr/guide/8_3/audit-logging.html). Those events are logged in the standard Solr log.

This enhancement proposes to include a simple explanation in the reference guide on how to configure log4j to log audit events in a separate file (this is possible already now with log4j, this issue is just about adding an example log4j configuration file for the Solr audit logger).

Reasoning behind this is that it can reduce the load on a SIEM system significantly as it only needs to process the relevant audit logs.

To be discussed: Should there be a standard log4j configuration when installing Solr to log into a separate file (maybe even the same log directory by default) all audit event