<p>I have an existing J2EE enterprise application to which I need to add auditing, i.e. be able to record CRUD operations on several important domain types (Employee, AdministratorRights, etc.).</p>

<p>The application has a standard n-tier architecture:</p>

<ul>
<li>Web interface</li>
<li>Business operations encapsulated within a mixture of stateless session beans and transactional POJOs (using Spring)</li>
<li>persistence is a mixture of direct JDBC (from within the business layer) and EJB 2.x BMP entity beans (I know, I know)</li>
</ul>

<p>My question is: are there any standard patterns or (better still) frameworks/libraries specifically for adding auditing as a cross-cutting concern? I know AOP can be used to implement cross-cutting concerns in general; I want to know if there's something specifically aimed at auditing.</p>

[{'answer_id': 68751, 'author': 'Andrew Swan', 'author_id': 10433, 'author_profile': 'https://Stackoverflow.com/users/10433', 'pm_score': 2, 'selected': False, 'text': '<p>Right now I\'m leaning towards using Spring AOP (using the "@AspectJ" style) to advise the business operations that are exposed to the web layer.</p>\n'}, {'answer_id': 68755, 'author': 'Ash', 'author_id': 5023, 'author_profile': 'https://Stackoverflow.com/users/5023', 'pm_score': 0, 'selected': False, 'text': '<p>Try an <a href="http://en.wikipedia.org/wiki/Aspect-oriented_programming" rel="nofollow noreferrer">Aspect Oriented</a> programming framework.</p>\n\n<p>From Wikipedia "Aspect-oriented programming (AOP) is a programming paradigm that increases modularity by allowing the separation of cross-cutting concerns".</p>\n'}, {'answer_id': 71032, 'author': 'Rejeev Divakaran', 'author_id': 10980, 'author_profile': 'https://Stackoverflow.com/users/10980', 'pm_score': 0, 'selected': False, 'text': '<p>For all EJBs you can use EJB 3.0 Interceptors (This is something similar to Servlet filter) and another similar interceptor for Spring (not familiar with spring)\nAs you are using EJBs as well as Spring that may not cover the whole transactions. Another approach could be using a Front Controller however that requires some modification in the client side. Yet another approach could be using a Servlet Filter however that means implementing the domain logic in the presentation layer.</p>\n\n<p>I would recommend the Front Controller in this case.</p>\n'}, {'answer_id': 153539, 'author': 'Chris R', 'author_id': 23309, 'author_profile': 'https://Stackoverflow.com/users/23309', 'pm_score': 2, 'selected': False, 'text': "<p>I'm going to go a bit against the grain here and suggest that you look at a lower-tier solution.  We have a similar architecture in our application, and for our auditing we've gone with database-level audit triggers that track operations within the RDBMS.  This can be done as fine- or coarse-grained as you like, you just have to identify the entities you'd like to track.</p>\n\n<p>Now, this isn't an ideologically pure solution; it involves putting logic in the database that is arguably supposed to remain in the business tier, and I can't deny that this view has value, but in our case we have many independent application interacting with the data model, some written in C, some scripted, and others J2EE apps, and all of them have to be audited consistently.</p>\n\n<p>There's possibly still some AOP work to be done here on the J2EE side, mind you; any method that updates the database at all may have to have some additional work done to tell the database which user is doing the work.  We use database session variables to do this, but there are other solutions, of course.</p>\n"}, {'answer_id': 4963374, 'author': 'Andrew Swan', 'author_id': 10433, 'author_profile': 'https://Stackoverflow.com/users/10433', 'pm_score': 0, 'selected': False, 'text': '<p>I\'ve just learned about a new Spring project called Spring Data JPA that offers an <a href="http://static.springsource.org/spring-data/data-jpa/docs/1.0.0.M1/reference/html/#jpa.auditing" rel="nofollow">AOP-based auditing feature</a>. It\'s not GA yet, but it bears keeping an eye on.</p>\n'}, {'answer_id': 31286528, 'author': 'Gerald Mücke', 'author_id': 3985482, 'author_profile': 'https://Stackoverflow.com/users/3985482', 'pm_score': 3, 'selected': False, 'text': '<p>Maybe you should have a look at <a href="http://audit4j.org/" rel="noreferrer">Audit4j</a> that provides auditing of business functionality and has several options for configuration.\nAnother framework is <a href="http://javers.org/" rel="noreferrer">JaVers</a> that focues more on auditing low-level modification on persistence layer, which might match your case a bit better.</p>\n\n<p>Both framework provide audit-specific functionalities that goes beyond plain AOP/Interceptors.</p>\n'}]
['https://Stackoverflow.com/questions/68746', 'https://Stackoverflow.com', 'https://Stackoverflow.com/users/10433/']