Mutamad Logging

Security event logging for a Mutamad site, and scheduled tasks that run on time:

• every log entry sent to syslog as one JSON object (message, level, channel, time, user, IP address, URL), for a SIEM
• a larger database log, 100,000 entries instead of 1,000, read and cleared only by the site administrator
• revisions compared field by field
• each cron task a job of its own with Ultimate Cron, every 15 minutes at its own minute, with 30 days of runs logged
• Automated Cron off, so tasks do not wait for a visitor: the server runs cron, and the status report warns after an hour without it

Cron is where a site checks for security updates, expires passwords, trims the log, sends newsletters and updates the search index: when it stops, those controls stop. Aligned to NCA ECC-2:2024 12-2 (event logs).

Part of Mutamad

Part of Mutamad, the Drupal distribution for Saudi government websites. Mutamad Standard Site applies it on every Mutamad site.

Requirements

• Drupal 11.4
• diff
• monolog
• ultimate_cron
• a server that runs drush cron

Installation

composer require drupal/mutamad_logging 'drupal/ultimate_cron:^2.0@beta'
drush recipe ../recipes/mutamad_logging

Then run cron from the server every minute, for example with this crontab line:

* * * * * cd /var/www/example.gov.sa && vendor/bin/drush cron --quiet

Documentation

The README explains every setting and why, and the changelog what changed in each release.