Permission Set for Log Views
The Log View permission set decides which Log Views the members of a Role can open, and what they may do with the Log Events inside: read context, read or download the message body, see it transformed, resend it, or repair it. Set it well and business users solve their own problems without ever seeing data they shouldn't.
- ✅ Granular, role-based access control for Log Views
- ✅ Self-service options for business users, within limits you set
- ✅ View, download, transform, resend, and repair messages
- ✅ Global defaults with per-Log View overrides
This page is for administrators. How end-users search and work with a Log View is covered in Getting Started with Log.
Understanding the Log View Permission Set
The Access permission is the gate: without it, a Role sees no Log Views at all. Each other right has a global value and a value per Log View; Inherited on a Log View takes the global value.
Blue = global permissions, orange = access to the Log View, teal = read rights, purple = rights that send data out again (also switched by System Parameters).
| Permission | What it unlocks | Also depends on |
|---|---|---|
| Access | The Log View is listed and can be searched | Global Access set to Allow |
| View Context | The Context Values tab | ProtectedContextValues masks named values |
| View Body | View message body and Download | - |
| View Transformed | The message rendered with a Stylesheet | A Stylesheet on the Message Type |
| Resend | Resend of the original body | AllowResubmit = true |
| Repair | Repair and resubmit of an edited body | Resend = Allow, AllowResubmit and AllowRepair = true |
The Log Permissions (10) tab of the Finance example Role: Global permissions on top (Access on the Log Views row, default rights on the Permissions row), one row per assigned Log View below, each set to Allow, Deny, or Inherited.
Global Permissions
The global Access permission, on the Log Views row under Global permissions, controls whether a user can use the Log functionality at all. It must be set to Allow for users to see any Log Views. The Permissions row sets the global value of every other right; a Log View that says Inherited uses it.
The Log Permissions tab: global Access and default rights on top, the assigned Log Views below with a filter box, Include deleted, and Edit to add or remove views.
Access Log
To use Nodinite Log Views, a User must belong to a Role with Allow in the Access column of the Log Views row under Global permissions.
1: the global Access right on the Log Views row. 2: the Access right on one Log View, picked from the Set permit list.
- The Role is set to Allow access to the Log Views under Global permissions.
- The Role can have different Access rights to individual Log Views.
Note
If a User is a member of any Role where access to the Log is denied (Deny), the user is blocked from accessing ALL Log Views.
You can also add a Role to a Log View from the Log View itself, in the Roles section of Add or manage Log View. The DefaultRolesInViews System Parameter pre-selects Roles on every new Log View.
Log View Permissions
The following permissions can be set individually for each Log View. You can also set them from the Log View side, on its Roles section:
View Context
View Context lets members of the Role open the Context Values tab of a Log Event.
Context values hold the message's metadata, such as file names, queue names, and correlation IDs.
- Inherited – Context data is visible if the global setting is Allow; otherwise, it is not.
- Allow – Context data is visible and accessible.
- Deny – Context data is NOT visible or accessible.
To protect sensitive context data further, Nodinite can mask values for everyone; see ProtectedContextValues. Built-in detail fields on the Additional Field Values tab are shown, hidden, or masked with HideAdditionalFieldValuesInLogViews, and HideSearchFieldValuesInLogViews hides Search Field values that aren't part of the Log View.
View Body
View Body lets members of the Role open the message Body in Log Views.
The View message body item in a Log Event's Action menu.
The permission also allows Download of the body: single or multiple Log Events, the original bytes, or, from Nodinite 7.11, Download converted to another character encoding. New 7.11 See Download.
Single download from the Action menu.
- Inherited – The Body (raw data) is visible and downloadable if the global setting is Allow; otherwise, it is not.
- Allow – The Body is visible and downloadable.
- Deny – The Body is NOT visible or downloadable.
View Transformed
Nodinite can render the Body in another format using a Stylesheet, so business users can read the message, and sensitive parts can be filtered or masked.
- Inherited – Transformation is available if the global setting is Allow; otherwise, it is not.
- Allow – Transformation is available to the end-user.
- Deny – Transformation is NOT available.
Resend
Resend lets members of the Role send the original message Body again from Log Views.
The Resend item in a Log Event's Action menu.
- Inherited – Resend is available if the global setting is Allow; otherwise, it is not.
- Allow – Resend is available to the end-user.
- Deny – Resend is NOT available.
Note
The AllowResubmit System Parameter must be set to
true; otherwise, Resend is disabled for everyone.
Repair
Granting both Resend and Repair lets members of the Role edit the message Body and resubmit it.
To Repair a Log Event, first click View Details.
View details opens the Log Event in a new browser tab.
A new tab opens in the Client Browser. On this page, click Repair and resubmit.
The Repair and resubmit button on the details page.
Step 1 edits the message (with its encoding); step 2 picks the transport: File, MSMQ, ActiveMQ, or Webhook.
- Inherited – Repair and resubmit is available if the global setting is Allow; otherwise, it is not.
- Allow – Repair and resubmit is visible and accessible.
- Deny – Repair and resubmit is NOT visible or accessible.
Note
The AllowResubmit and AllowRepair System Parameters must be set to
true; otherwise, Repair and resubmit is disabled. The Resend permission must also be set to Allow.
The Webhooks to choose from are defined in the ResendWebhookSettings System Parameter, and ResubmitContextValuesForActiveMQ selects which context properties are attached when the message is resubmitted to an ActiveMQ queue. The full repair flow, including the 7.11 encoding options, is described in Repair.
Note
The Nodinite Administrators Role can be set to Deny access to the Log and all related permissions. This limits even the built-in administrators when log data is sensitive.
- Use this with caution. Always make sure at least one user has access to the Log and related permissions, so you aren't locked out of critical log data.
The Administrators Role with Deny on the Log and all related permissions.
Permission Inheritance and Summary
The net rights of a User are the combination of all their Roles. If any Role has Deny on the Log, the user is denied all Log Views regardless of other permissions. Open a User in Add or manage User to see the result.
The User editor shows the net (effective) Log permissions for that user, across all of their Roles.
Next Steps
Add or manage Role
Add or manage Log View
Permission Set for Monitor Views
Related Topics
Monitor Views permission set
Repository Model permission set
C4 Diagram Set permission set
What is a Role?
Access Management
Log Views
Log Views - Overview
Getting Started with Log
Users
DefaultRolesInViews – Roles pre-selected for new Log Views
AllowResubmit and AllowRepair – Global switches for Resend and Repair
ProtectedContextValues – Mask context values
Administration