# Audit Trail

yCrash records all user activity within the application to a dedicated audit log. The audit trail captures page visits, file uploads, analysis runs, and report views, providing your security and compliance teams with a complete, timestamped record of how the platform is being used.

When engineers troubleshoot production issues, they work with diagnostic artifacts such as GC logs, heap dumps, and thread dumps. These artifacts can contain sensitive information including class names, memory details, configuration data, and application data present at the time the dump was taken.

Because yCrash is deployed entirely within the customer's own environment, the customer is responsible for managing access and maintaining visibility into platform usage. The audit trail feature provides that visibility without requiring any external tooling or third-party services.

# How it works?

yCrash writes audit data to two log files on the application server:

  • usage-stats.log - Plain text format, one entry per line.
  • usage-stats-json.log - JSON format, suitable for ingestion into log management tools.

Both files are written automatically from the time of deployment. No additional configuration is required to enable basic logging.

Each log entry includes a timestamp and the action performed. When SSO authentication is configured, the authenticated username is included in every entry. Without SSO, activity is still logged but the username field is empty.

# Log format

The following example shows a complete user session in usage-stats.log:

2025-12-30 20:15:02,278 - john.smith - visited URL http://appserver:8090/gc-index.jsp
2025-12-30 20:15:19,752 - john.smith - GC log: gc.log file upload started.
2025-12-30 20:15:21,395 - john.smith - GC log: gc.log file upload completed.
2025-12-30 20:15:24,828 - john.smith - gc.log analyzed successfully.
2025-12-30 20:15:33,269 - john.smith - viewed gc.log GC report
1
2
3
4
5

Each entry records the timestamp, the username (when SSO is enabled), and the action performed. The example above shows a single engineer navigating to the GC analysis page, uploading a log file, and viewing the resulting report.

# Enable username tracking with SSO

By default, audit logs capture activity without user identity. To associate each log entry with an authenticated username, SSO must be configured.

yCrash supports SSO via SAML. To configure it, update the saml.xml file with your Identity Provider (IdP) and Service Provider (SP) URLs. Once configured, all log entries will automatically include the authenticated username.

For detailed SSO configuration steps, see SSO Authentication

# Integrate with log management and SIEM tools

Because yCrash runs inside the customer's own infrastructure, the audit log files reside on the customer's servers. The logs can be forwarded to any log management or SIEM tool already in use, including:

The JSON log format (usage-stats-json.log) is recommended for automated ingestion into these tools.

# Compliance and access review

The audit trail supports access reviews and compliance audits by providing a queryable record of all platform activity. Security teams can filter logs by username to review all actions performed by a specific user over a given time period, including which files were uploaded and which reports were accessed.

This is particularly relevant for organizations in regulated industries where access logging is a compliance requirement. Common audit scenarios include:

  • Verifying that only authorized personnel accessed a specific diagnostic report.
  • Confirming that a former employee no longer has active access.
  • Providing evidence of access controls during an internal or external audit.
  • Investigating a security incident by reviewing who accessed which data and when.

# Next steps

Audit logging is active by default. To get full user-level visibility:

  • Configure SSO to associate log entries with authenticated usernames.
  • Forward logs to your existing SIEM or log management tool for centralized monitoring.
  • Review access periodically to ensure only authorized users are active on the platform.

← Export Summary - Calendar →