Issue

• After installing the Audit Trail plugin, an “operation X” is not being showed on logs.

Environment

• CloudBees Jenkins Enterprise - Managed controller (CJEMM)
• CloudBees Jenkins Enterprise - Operation Center (CJEMM)
• CloudBees Jenkins Platform - Client controller (CJPCM)
• CloudBees Jenkins Platform - Operation Center (CJPCM)
• CloudBees Jenkins Team
• Jenkins LTS
• Audit Trail Plugin

Resolution

Firstly, Audit Trail plugin needs to be configured in Manage Jenkins > Configure System > Audit Trail section and one Logger type needs to be added at least.

Having done that, Audit Trail plugin keeps audit trail of those particular Jenkins operations which their particular request matches with one of the following patterns. At the moment of writing this articles the patterns are:

• configSubmit
• doDelete
• postBuildResult
• enable
• disable
• cancelQueue
• stop
• toggleLogKeep
• doWipeOutWorkspace
• createItem
• createView
• toggleOffline
• cancelQuietDown
• quietDown
• restart
• exit
• safeExit

Also, it receives notifications about builds thanks to AuditTrailRunListener extends RunListener.

Examples of Jenkins operation being audited

• Run a build from testJob by testUser

yyyy-MM-dd HH:mm:ss:SSS - job/testJob/ #<BUILD_NUMBER> Started by user testUser@mail.com

• Creating a new job (testUser) or editing an existing one (testUser) have the same output

yyyy-MM-dd HH:mm:ss:SSS - /job/testJob/configSubmit by testUser

• Updating the email of the logged user

yyyy-MM-dd HH:mm:ss:SSS - /me/configSubmit by testUser

• Adding new logger to Audit Trail configuration

yyyy-MM-dd HH:mm:ss:SSS - /configSubmit by admin

Examples of Jenkins operation NOT being audited

• Creating new users (sign up) in Jenkins owns Database
  see JENKINS-27028

Adding an operation

Audit trail plugin allows to specify custom patterns to log.
You can find the pattern to log by looking which endpoint Jenkins is making a POST to when you do an operation.

As an example, when you uninstall a plugin, Jenkins is making a POST request to doUninstall so you can simply add this pattern to the Url Patterns to Log in advanced section of the Audit Trail configuration.
Once done, uninstalling a plugin will display:

May 20, 2019 10:32:28,608 AM /pluginManager/plugin/<plugin_name>/doUninstall by admin

In case you have trouble finding the endpoint to log, please contact CloudBees Support for help.