Enhancing Security Logging with JsonTemplateLayout

Within the realm of server security, capturing detailed logs is paramount. By enabling the JsonTemplateLayout for the security.log file in your /conf/server-logs.xml, you gain the ability to record essential client and server address information. This empowers administrators and security personnel to trace activities and potential threats with greater precision.

Transitioning from PatternLayout to JsonTemplateLayout

To harness the power of JSON-formatted logs for security events, you'll need to modify the existing layout configuration. The SecurityLogger, which traditionally uses the PatternLayout, must be transitioned to utilize the JsonTemplateLayout. This adjustment ensures that log entries are structured in a JSON format, facilitating easier parsing and analysis by log management tools and security information and event management (SIEM) systems.

Change required in /conf/server-logs.xml is highlighted below 

<RollingRandomAccessFile name="SecurityLog" fileName="${config:server.directories.logs}/security.log"
                                 filePattern="$${config:server.directories.logs}/security.log.%02i">
            <PatternLayout pattern="%d{yyyy-MM-dd HH:mm:ss.SSSZ}{GMT+0} %-5p %m%n"/>

<RollingRandomAccessFile name="SecurityLog" fileName="${config:server.directories.logs}/security.log"
                                 filePattern="$${config:server.directories.logs}/security.log.%02i">
            <JsonTemplateLayout eventTemplateUri="classpath:org/neo4j/logging/StructuredJsonLayout.json"/>

 Sample security.log -

{"time":"2025-04-16 07:16:11.213+0000","level":"DEBUG","message":"Looking up user 'aayush'","source":"","type":"security"}
{"time":"2025-04-16 07:16:11.300+0000","level":"DEBUG","message":"Found user: User[name=aayush, id=cbf894b0-bf1a-49ad-bf39-21366f21eb0b, credential=*****, passwordChangeRequired=true, suspended=false, auth=[Auth[provider=native, id=cbf894b0-bf1a-49ad-bf39-21366f21eb0b]]]","source":"","type":"security"}
{"time":"2025-04-16 07:16:11.344+0000","level":"ERROR","authenticatedUser":"aayush","executingUser":"aayush","message":"failed to log in: invalid principal or credentials","source":"bolt-session\tbolt\tneo4j-browser/v2025.2.0\t\tclient/127.0.0.1:43608\tserver/127.0.0.1:7687>","type":"security"}

Comprehensive Data Capture with JSON Layout

By adopting the JSON layout for security logs, you can capture a wealth of crucial information for each logged event. This includes:

Name	Description
time	The timestamp of the log message.
level	The log level.
type	It is always security.
source	Connection details.
database	The database name on which the command is executed. This field is optional and thus will not be populated for all security events.
username	The user connected to the security event. This field is deprecated by executingUser.
executingUser	The name of the user triggering the security event. Either the same as authenticatedUser or an impersonated user.
authenticatedUser	The name of the user who authenticated and is connected to the security event.
message	The log message.
stacktrace	Included if there is a stacktrace associated with the log message.

Reference - https://neo4j.com/docs/operations-manual/5/monitoring/logging/#security-events-logging