Package com.oorian.security

Class SecurityAuditLog

java.lang.Object

com.oorian.security.SecurityAuditLog

public class SecurityAuditLog
extends Object

Structured audit logging for security-related events.

SecurityAuditLog provides a centralized facility for recording security events such as authentication, authorization, session lifecycle, and rate limiting. Each event is logged with structured context including timestamp, session ID, user ID, IP address, and event-specific details.

The logger uses the JDK System.Logger SPI, so output can be directed to any logging backend (SLF4J, Log4j2, java.util.logging, etc.) by configuring a System.LoggerFinder.

Usage:

 // Log a successful authentication
 SecurityAuditLog.log(SecurityEventType.AUTH_SUCCESS, "user123", "Login via form");

 // Log an access denial
 SecurityAuditLog.log(SecurityEventType.ACCESS_DENIED, "user456", "Missing ADMIN role for /admin/users");

 // Log a custom security event
 SecurityAuditLog.log(SecurityEventType.CUSTOM, "user789", "Exported sensitive data: report-2024.csv");
 

Since:

2.1

Version:

1.0

Author:

Marvin P. Warble Jr.

See Also:

• SecurityEventType

Method Summary

Modifier and Type	Method	Description
static boolean	isEnabled()	Returns whether security audit logging is enabled.
static void	log(SecurityEventType eventType, String detail)	Logs a security event without a user ID.
static void	log(SecurityEventType eventType, String userId, String detail)	Logs a security event with the specified details.
static void	setEnabled(boolean enabled)	Enables or disables security audit logging.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Details

setEnabled

public static void setEnabled(boolean enabled)

Enables or disables security audit logging.

When disabled (the default), calls to log() are no-ops.

Parameters:

enabled - true to enable audit logging

isEnabled

public static boolean isEnabled()

Returns whether security audit logging is enabled.

Returns:

true if enabled

log

public static void log(SecurityEventType eventType,
 String userId,
 String detail)

Logs a security event with the specified details.

The log entry includes the event type, user ID, session ID, IP address (if available from the current session), and the detail message.

Parameters:

eventType - the type of security event

userId - the user identifier (may be null for unauthenticated events)

detail - a description of the event

log

public static void log(SecurityEventType eventType,
 String detail)

Logs a security event without a user ID.

Convenience method for events where the user is not yet identified (e.g., failed authentication).

Parameters:

eventType - the type of security event

detail - a description of the event