Auditing

Request traffic logging records per-request metadata (timing, status, user, client address, headers and optionally bodies) to file or SQLite storage.

Configuration ​

Storage types ​

File storage ​

With StorageType: "file", entries are written to rotating JSON files:

log/traffic/
├── proxy_traffic_20240120_103015.json
├── proxy_traffic_20240120_083045.json
└── proxy_traffic_20240119_154530.json

• One JSON object per line
• Rotation at MaxFileSizeMB
• The oldest files beyond MaxFileCount are deleted
• File names contain the creation time

SQLite storage ​

With StorageType: "sqlite", entries are written to this table:

CREATE TABLE TrafficLogs (
    Id INTEGER PRIMARY KEY AUTOINCREMENT,
    Timestamp TEXT NOT NULL,
    Method TEXT NOT NULL,
    Path TEXT NOT NULL,
    QueryString TEXT,
    Environment TEXT,
    EndpointName TEXT,
    TargetUrl TEXT,
    StatusCode INTEGER,
    RequestSize INTEGER,
    ResponseSize INTEGER,
    DurationMs INTEGER,
    Username TEXT,
    ClientIp TEXT,
    TraceId TEXT NOT NULL,
    RequestHeaders TEXT,
    RequestBody TEXT,
    ResponseBody TEXT
);

CREATE INDEX idx_timestamp ON TrafficLogs (Timestamp);

Log entry format ​

{
  "Id": 12345,
  "Timestamp": "2024-01-20T10:30:15Z",
  "Method": "GET",
  "Path": "/api/500/Products",
  "QueryString": "?$top=10",
  "Environment": "prod",
  "EndpointName": "Products",
  "TargetUrl": "http://localhost:8020/services/Exact.Entity.REST.EG/Product",
  "StatusCode": 200,
  "RequestSize": 0,
  "ResponseSize": 2048,
  "DurationMs": 45,
  "Username": "api-user",
  "ClientIp": "192.168.1.100",
  "TraceId": "a1b2c3d4",
  "RequestHeaders": {
    "Accept": "application/json",
    "Authorization": "[REDACTED]",
    "User-Agent": "MyApp/1.0"
  },
  "RequestBody": null,
  "ResponseBody": null
}

Id is present in SQLite storage only. TargetUrl is set for proxy requests. Body fields are null unless body capture is enabled.

Security features ​

Header sanitization ​

Redacted header values: Authorization, Cookie, X-API-Key, API-Key, Password, X-Auth-Token, Token, Secret, Credential, Access-Token, X-Access-Token, and every header and query parameter name declared in an environment's Authentication.Methods.

Body capture controls ​

Body capture is disabled by default, limited to MaxBodyCaptureSizeBytes (longer bodies end with ...) and applies to JSON and XML content only.

Storage access ​

Store traffic logs outside web-served directories, with file permissions limited to the Portway process.

Performance considerations ​

Entries are queued and written in background batches. Tuning for high volume:

Querying traffic logs ​

File storage queries ​

# Find slow requests
Get-Content "log/traffic/proxy_traffic_*.json" | 
    ConvertFrom-Json | 
    Where-Object { $_.DurationMs -gt 1000 } |
    Select-Object Timestamp, Method, Path, DurationMs

# Count requests by endpoint
Get-Content "log/traffic/proxy_traffic_*.json" | 
    ConvertFrom-Json | 
    Group-Object EndpointName | 
    Select-Object Count, Name | 
    Sort-Object Count -Descending

# Find failed requests
Get-Content "log/traffic/proxy_traffic_*.json" | 
    ConvertFrom-Json | 
    Where-Object { $_.StatusCode -ge 400 } |
    Select-Object Timestamp, Path, StatusCode

# Find slow requests
cat log/traffic/proxy_traffic_*.json |
    jq 'select(.DurationMs > 1000) | {Timestamp, Method, Path, DurationMs}'

# Count requests by endpoint
cat log/traffic/proxy_traffic_*.json |
    jq -r '.EndpointName' | sort | uniq -c | sort -rn

# Find failed requests
cat log/traffic/proxy_traffic_*.json |
    jq 'select(.StatusCode >= 400) | {Timestamp, Path, StatusCode}'

SQLite queries ​

-- Top 10 slowest requests
SELECT 
    Timestamp,
    Method,
    Path,
    DurationMs,
    StatusCode
FROM TrafficLogs
ORDER BY DurationMs DESC
LIMIT 10;

-- Request count by endpoint
SELECT 
    EndpointName,
    COUNT(*) as RequestCount,
    AVG(DurationMs) as AvgDuration,
    MAX(DurationMs) as MaxDuration
FROM TrafficLogs
GROUP BY EndpointName
ORDER BY RequestCount DESC;

Troubleshooting ​