GSoC'26 : Extend Audit Module - Project Updates

Community GSoC
,
1

Hi everyone,
This long post has been due from my side, so here it is and my progress so far.

About this project in brief : Audit module has the goal of audit the activities we do in OpenMRS, it can be read, write, security or administrative activities. Suppose a patient admitted and here there can be many activities like many health providers or doctor do take care of patient they do update the health condition, they do read the patient health history, they do suggest the drugs, treatments, so here there are many read and write activities going on the EMR database . Like for write, we know the who did change when but we don’t know what was the previous value for that record and that’s where write auditing comes, and suppose many guys viewing the records of patient and we will also not able know who viewed the record , when viewed and what all data viewed and that’s where read auditing comes in .

Read Auditing : More on the read audit part. Example in a EMR like OpenMRS , sensitive clinical data is constantly accessed by multiple providers like who is viewing patient charts or it’s medical history. So this feature will intercept these data fetch actions to log exactly who accessed that records, when they accessed and the specific medical data viewed. And this also ensures we following the EMR privacy compliances.

Security Auditing: Apart from healthcare care data, we probably also want to know the security events like who login , when is that failed or is that a bad user who brute forcing the authentication, when the person changed or reset the password or a bad guy trying to brute forcing the password reset, when did the person logout and that’s where Security Auditing comes in .

Administrative action auditing : And we also want to know track the administrative action like when a admin has updated any module, or updated any global settings and that’s comes in Administrative Auditing .

So this is what our Audit Module provides us or I mean some features already there, some got shipped now, and some probably will get added till the end of this GSoC project.

And this whole story, what my part is to do or implement these things, again in

  • Read Auditing( like who viewed what and when) [DONE]
  • Security Auditing ( like login success/failed, password update) [IN_REVIEW]
  • Administrative Auditing ( like admin activities)
  • Create REST Endpoint to fetch all these audits
  • And probably add the export audits to the file like CSV format.
2

This is Jira Epic for this project here, it contains all the progress, tickets and related PRs.

3

And here is my all medium blogs list till now here

4

And this is the presentation demo video showing the progress and work demo till now.

5

Seeking the Advice !

Hi everyone,

While working on implementing the Administrative Audit Logging which is for auditing the admin actions which is generally action performed by mainly the read events like who loaded module or who viewed the logs etc.

Currently I’m at a point where I need to audit the who has stopped, started, loaded, unloaded, removed the modules, simply the module actions. Currently we lack this kind of audit where we would know who performed these , when and what exactly changed .

And these actions are done on ModuleFactory class where it’s method do perform these actions. So to audit these module actions generally I should put AOP on these methods but as these methods are static methods we can’t do it. As we know for AOP it needs to create the proxy around the class and implement or override those class methods in their proxy, either by JDK dynamic or CGLIB proxy way. And since these are static methods we cannot go with this AOP option.

Then probably these are the option we have and each has their CONS and I need your feedback and suggestion on it on which it better and should consider.

1. AspectJ Weaving (Bytecode Modification)

We can use AspectJ(ajc) which literally modifies the bytecode of class and injects the aspect logic inside that and then loads into the memory. To use we have two ways :

a. Compile-Time Weaving (CTW) : In this we replace the existing standard complier(javac) with the AspectJ complier(ajc). So this complier now do the compilation and modifies the bytecode of the class. We can do this by adding the AspectJ maven plugin. CONS : Since ModuleFactory is in OpenMRS core, we need to replaced the standard compiler with new one which seems to effect whole build phase.

b. Load-Time Weaving(LTW) : We not change the compiler but do pass the aspectjweaver.jar file . We do this by passing this argument during the application launch -javaagent:path/to/aspectjweaver.jar . And this jar then do the bytecode modification and inject the aspect logics. CONS : We need to modify the existing build pipeline to inject this arg during the build.

2. Intercepting via Entry Points (Controllers/Resources)

Instead of intercepting the factory directly, we place interceptors on the layers initiating the actions (e.g., ModuleListController for the Legacy UI, and specific REST endpoints like ModuleActionResource1_8 , MainResourceController). We need especially go to that places from where these actions are getting initiated and then track how they are handling it.

CONS : As we are not directly intercepting on the actual method, we need little complex logic to intercept through the controller methods and find where all this ModuleFactory methods are used and intercept those also. But brittle thing is that, in future if we calling these module methods form somewhere else or may be some new places, we also to need to update the audit logging code so that we can track the actions happening from there too.

3. Use the application event

We can create the custom ModuleActionEvent extending ApplicationEvent and then publish these actions form the ModuleFactory methods and then on audit log module we will listen to those events. Probably easiest and clean way.

CONS : We need to create extra class and modify the existing methods to publish those events in core.

@ian @dkayiwa @wikumc @manojll

6

Hey guys, here’s my final demo video of audit module

GSoC’26 OpenMRS Extend Audit Module Project Demo

And the final submission blog and the project doc page