From bd2d6b2bbed1b5b676232c2094c2c65ed86d21e2 Mon Sep 17 00:00:00 2001 From: Gary Lockyer Date: Mon, 17 Dec 2018 10:03:01 +1300 Subject: WHATSNEW: JSON logging changes Add details of the Windows Event Id's and Logon Types added to the Authorization qnd PasswordChange JSON messages. Signed-off-by: Gary Lockyer Reviewed-by: Andrew Bartlett --- WHATSNEW.txt | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+) (limited to 'WHATSNEW.txt') diff --git a/WHATSNEW.txt b/WHATSNEW.txt index ffbd48b040e..6698b09d8bc 100644 --- a/WHATSNEW.txt +++ b/WHATSNEW.txt @@ -105,6 +105,35 @@ Note: Support for python2 (with the exception of a build configured with 'PYTHON=python2 ./configure --disable-python' and built with 'PYTHON=python2 make' will be deprecated in the next release. +JSON logging +------------ + +Authentication messages now contain the Windows Event Id "eventId" and logon +type "logonType". The supported event codes and logon types are: + Event codes: + 4624 Successful logon + 4625 Unsuccessful logon + + Logon Types: + 2 Interactive + 3 Network + 8 NetworkCleartext +The version number for Authentication messages is now 1.1, changed from 1.0 + +Password change messages now contain the Windows Event Id "eventId", the +supported event Id's are: + 4723 Password changed + 4724 Password reset +The version number for PasswordChange messages is now 1.1, changed from 1.0 + +The leading "JSON :" and source file prefix of the JSON formatted +log entries has been removed to make the parsing of the JSON log messages +easier. JSON log entries now start with 2 spaces folowed by an opening brace +i.e. " {" + + + + REMOVED FEATURES ================ -- cgit v1.2.1