Service Bus Auditing

Question

Hi there,
We are using Windows Server Service Bus 1.1 to distribute some sensitive information and would like to implement some sort of auditing around the bus. As far as we understand, Service bus does not provide any form of auditing out of the box and does not
generate any logs (would be happy if someone corrects me here)
One way of auditing the payload is using "ForwardTo" auditing subscription to write to an audit topic but this does not tell us "who" sent the message. We can harness custom message properties but then it means we rely on the client to
provide us this information. We can use a separate WCF logging service but then i would have to worry about distributed transactions.
Is this audit information available in any form am not aware of, any events that we could possibly intercept?
Any pointers will be appreciated. Thanks in advance.
http://btsbee.wordpress.com/

Answer 1

Hi
If you're using Windows Server 2012 or above, you can use the User Access Logging feature (Which SB has opted in) to get the Service Bus Server Access infos. Some cmdlet you could use are Get-UalDailyAccess, Get-UalUserAccess, etc. We're logging
client IPs and user names (if you're using windows auth) to UAL. You should be able to see "Service Bus 1.1" as a product in UAL logs.
For more information about UAL, please visit
http://technet.microsoft.com/en-us/library/hh849634.aspx.
If you're using any OS version below Windows Server 2012, then this feature is not available for you.
Thanks
Jacky