MM-22273 New auditing system (phase 1) (#13967)

* New auditing API outputting to syslog via TLS

* New config section for specifying remote syslog server IP, port, and cert.

* Legacy audit API retained for access history feature

api4/system.go

@@ -11,6 +11,7 @@ import (
 	"strconv"
 	"time"
 
+	"github.com/mattermost/mattermost-server/v5/audit"
 	"github.com/mattermost/mattermost-server/v5/mlog"
 	"github.com/mattermost/mattermost-server/v5/model"
 	"github.com/mattermost/mattermost-server/v5/services/cache/lru"
@@ -203,6 +204,9 @@ func databaseRecycle(c *Context, w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	auditRec := c.MakeAuditRecord("databaseRecycle", audit.Fail)
+	defer c.LogAuditRec(auditRec)
+
 	if *c.App.Config().ExperimentalSettings.RestrictSystemAdmin {
 		c.Err = model.NewAppError("databaseRecycle", "api.restricted_system_admin", nil, "", http.StatusForbidden)
 		return
@@ -210,6 +214,7 @@ func databaseRecycle(c *Context, w http.ResponseWriter, r *http.Request) {
 
 	c.App.RecycleDatabaseConnection()
 
+	auditRec.Success()
 	ReturnStatusOK(w)
 }
 
@@ -219,6 +224,9 @@ func invalidateCaches(c *Context, w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	auditRec := c.MakeAuditRecord("invalidateCaches", audit.Fail)
+	defer c.LogAuditRec(auditRec)
+
 	if *c.App.Config().ExperimentalSettings.RestrictSystemAdmin {
 		c.Err = model.NewAppError("invalidateCaches", "api.restricted_system_admin", nil, "", http.StatusForbidden)
 		return
@@ -230,6 +238,8 @@ func invalidateCaches(c *Context, w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	auditRec.Success()
+
 	w.Header().Set("Cache-Control", "no-cache, no-store, must-revalidate")
 	ReturnStatusOK(w)
 }
@@ -481,8 +491,14 @@ func setServerBusy(c *Context, w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	auditRec := c.MakeAuditRecord("setServerBusy", audit.Fail)
+	defer c.LogAuditRec(auditRec)
+	auditRec.AddMeta("seconds", i)
+
 	c.App.Srv().Busy.Set(time.Second * time.Duration(i))
 	mlog.Warn("server busy state activated - non-critical services disabled", mlog.Int64("seconds", i))
+
+	auditRec.Success()
 	ReturnStatusOK(w)
 }
 
@@ -491,8 +507,14 @@ func clearServerBusy(c *Context, w http.ResponseWriter, r *http.Request) {
 		c.SetPermissionError(model.PERMISSION_MANAGE_SYSTEM)
 		return
 	}
+
+	auditRec := c.MakeAuditRecord("clearServerBusy", audit.Fail)
+	defer c.LogAuditRec(auditRec)
+
 	c.App.Srv().Busy.Clear()
 	mlog.Info("server busy state cleared - non-critical services enabled")
+
+	auditRec.Success()
 	ReturnStatusOK(w)
 }