Log synchronous message correlations to operations log

[mboskamp]

User Story (Required on creation)

As a developer, I want to be able to correlate a message for a limited number of process instances with a synchronous operation in an audit-save manner. This allows me to correlate messages triggering important process operations like restarting or canceling a business process in an audit save manner.

Functional Requirements (Required before implementation)

• There is a ProcessEngineConfiguration property called logEntriesPerSyncOperationLimit of type Long with a default of 1.
• Based on the value of logEntriesPerSyncOperationLimit, operation log entries are produced when multiple messages are correlated synchronously.
  • logEntriesPerSyncOperationLimit=1 (default): Regardless of the amount of correlated messages, there will always be one single operation log entry that summarizes the API call (similar to what the batch operation does). It will include the messageName, nrOfInstances (impacted process instances), nrOfVariables (number of variables set by the operation), and async (always false since this is a synchronous API).
  • logEntriesPerSyncOperationLimit=-1: disable this feature and always write one operation log entry per message correlated with this API call.
  • logEntriesPerSyncOperationLimit=x>1<Long.MAX_VALUE: Instruct the process engine to complete only API calls that involve no more messages than the configured limit. The API call fails if the limit is exceeded, and a ProcessEngineException is thrown. The engine produces one operation log entry per correlated message for successful API calls, meaning the number of new operation log entries from one API call can never exceed logEntriesPerSyncOperationLimit.
• Operation log entries written through synchronous message correlation are visible in Cockpit.
• There is documentation about the logEntriesPerSyncOperationLimit in docs-manual.
• Information about the security and performance risks associated with unlimited operation logs exists.

Technical Requirements (Required before implementation)

• Create a ProcessEngineConfiguration property called logEntriesPerSyncOperationLimit of type Long with a default of 1.
• Produce operation logs based on the value of logEntriesPerSyncOperationLimit.

Limitations of Scope

• Synchronous APIs with single message correlations are out of scope for now. Those are handled with Synchronous APIs that potentially affect multiple entities write operation log on single entity operations #3932

Hints

Links

• https://github.com/camunda/product-hub/issues/1574
• https://github.com/camunda/product-hub/issues/1742
• https://jira.camunda.com/browse/SUPPORT-15382

Breakdown

• Add a ProcessEngineConfiguration property called logEntriesPerSyncOperationLimit of type Long.
• Synchronous multi-message correlation produces operation log entries.
• Add a section to the security guide informing users about the risks associated with unlimited operation logs.
• Add documentation about the logEntriesPerSyncOperationLimit property, its possible values, and risks associated with unlimited operation logs.

Tasks

Beta Give feedback

1. feat(engine): Introduce operation log for sync message correlations #4014
   ci:h2 +1
   
2. feat(engine): Introduce operation log for sync message correlations camunda-docs-manual#1574
   +0
   

Dev2QA handover

• Does this ticket need a QA test and the testing goals are not clear from the description? Add a Dev2QA handover comment