java 将审计添加到现有应用程序的良好模式或框架？

Good pattern or framework for adding auditing to an existing app?

提问by Andrew Swan

I have an existing J2EE enterprise application to which I need to add auditing, i.e. be able to record CRUD operations on several important domain types (Employee, AdministratorRights, etc.).

我有一个现有的 J2EE 企业应用程序，我需要向其中添加审计，即能够在几个重要的域类型（员工、管理员权限等）上记录 CRUD 操作。

The application has a standard n-tier architecture:

该应用程序具有标准的 n 层架构：

• Web interface
• Business operations encapsulated within a mixture of stateless session beans and transactional POJOs (using Spring)
• persistence is a mixture of direct JDBC (from within the business layer) and EJB 2.x BMP entity beans (I know, I know)

• 网页界面
• 业务操作封装在无状态会话 bean 和事务性 POJO 的混合中（使用 Spring）
• 持久性是直接 JDBC（来自业务层）和 EJB 2.x BMP 实体 bean（我知道，我知道）的混合

My question is: are there any standard patterns or (better still) frameworks/libraries specifically for adding auditing as a cross-cutting concern? I know AOP can be used to implement cross-cutting concerns in general; I want to know if there's something specifically aimed at auditing.

我的问题是：是否有任何标准模式或（更好）框架/库专门用于将审计作为跨领域关注点添加？我知道 AOP 通常可用于实现横切关注点；我想知道是否有专门针对审计的内容。

回答by Gerald Mücke

Maybe you should have a look at Audit4jthat provides auditing of business functionality and has several options for configuration. Another framework is JaVersthat focues more on auditing low-level modification on persistence layer, which might match your case a bit better.

也许您应该看看Audit4j，它提供对业务功能的审计并有多个配置选项。另一个框架是JaVers，它更侧重于审计持久层上的低级修改，这可能更适合您的情况。

Both framework provide audit-specific functionalities that goes beyond plain AOP/Interceptors.

这两个框架都提供了超越普通 AOP/拦截器的特定于审计的功能。

回答by Chris R

I'm going to go a bit against the grain here and suggest that you look at a lower-tier solution. We have a similar architecture in our application, and for our auditing we've gone with database-level audit triggers that track operations within the RDBMS. This can be done as fine- or coarse-grained as you like, you just have to identify the entities you'd like to track.

我将在这里有点反对，并建议您查看较低层的解决方案。我们的应用程序中有一个类似的架构，对于我们的审计，我们使用了跟踪 RDBMS 内操作的数据库级审计触发器。这可以按照您的喜好进行细粒度或粗粒度的完成，您只需确定要跟踪的实体。

Now, this isn't an ideologically pure solution; it involves putting logic in the database that is arguably supposed to remain in the business tier, and I can't deny that this view has value, but in our case we have many independent application interacting with the data model, some written in C, some scripted, and others J2EE apps, and all of them have to be audited consistently.

现在，这不是一个意识形态上纯粹的解决方案；它涉及将可以说应该保留在业务层中的逻辑放入数据库中，我不能否认这个视图具有价值，但在我们的例子中，我们有许多独立的应用程序与数据模型交互，有些是用 C 编写的，一些脚本化应用程序和其他 J2EE 应用程序，所有这些应用程序都必须经过一致的审核。

There's possibly still some AOP work to be done here on the J2EE side, mind you; any method that updates the database at all may have to have some additional work done to tell the database which user is doing the work. We use database session variables to do this, but there are other solutions, of course.

请注意，在 J2EE 方面可能还有一些 AOP 工作要做；任何更新数据库的方法都可能需要做一些额外的工作来告诉数据库哪个用户正在做这项工作。我们使用数据库会话变量来做到这一点，当然还有其他解决方案。

回答by Andrew Swan

Right now I'm leaning towards using Spring AOP (using the "@AspectJ" style) to advise the business operations that are exposed to the web layer.

现在我倾向于使用 Spring AOP（使用“@AspectJ”风格）来为暴露在 web 层的业务操作提供建议。

回答by Ash

Try an Aspect Orientedprogramming framework.

尝试面向方面的编程框架。

From Wikipedia "Aspect-oriented programming (AOP) is a programming paradigm that increases modularity by allowing the separation of cross-cutting concerns".

来自维基百科“面向方面的编程（AOP）是一种编程范式，它通过允许横切关注点的分离来增加模块化”。

回答by Rejeev Divakaran

For all EJBs you can use EJB 3.0 Interceptors (This is something similar to Servlet filter) and another similar interceptor for Spring (not familiar with spring) As you are using EJBs as well as Spring that may not cover the whole transactions. Another approach could be using a Front Controller however that requires some modification in the client side. Yet another approach could be using a Servlet Filter however that means implementing the domain logic in the presentation layer.

对于所有 EJB，您可以使用 EJB 3.0 拦截器（这类似于 Servlet 过滤器）和另一个用于 Spring 的类似拦截器（不熟悉 spring）因为您使用 EJB 以及可能无法覆盖整个事务的 Spring。另一种方法可能是使用前端控制器，但这需要在客户端进行一些修改。另一种方法可能是使用 Servlet 过滤器，但这意味着在表示层中实现域逻辑。

I would recommend the Front Controller in this case.

在这种情况下，我会推荐前端控制器。

回答by Andrew Swan

I've just learned about a new Spring project called Spring Data JPA that offers an AOP-based auditing feature. It's not GA yet, but it bears keeping an eye on.

我刚刚了解到一个名为 Spring Data JPA 的新 Spring 项目，它提供了基于 AOP 的审计功能。它还不是 GA，但值得关注。