From f01ac0ca1160ce851aa2bec1bdc61b27c102d41e Mon Sep 17 00:00:00 2001
From: Kristen Tian <105667444+kristenTian@users.noreply.github.com>
Date: Fri, 4 Nov 2022 00:47:01 -0700
Subject: [PATCH] [MD] Update default audit log path (#2793)

- Fix the /tmp path issue seen on windows platform.
- Change audit log to disable by default.

Signed-off-by: Kristen Tian <tyarong@amazon.com>

Signed-off-by: Kristen Tian <tyarong@amazon.com>
Signed-off-by: David Sinclair <david@sinclair.tech>
---
 CHANGELOG.md                            | 1 +
 src/plugins/data_source/README.md       | 8 ++++----
 src/plugins/data_source/audit_config.ts | 4 +++-
 src/plugins/data_source/config.ts       | 2 +-
 4 files changed, 9 insertions(+), 6 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index b2ad560973bd..47d1e92c4e39 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -59,6 +59,7 @@ Inspired from [Keep a Changelog](https://keepachangelog.com/en/1.0.0/)
 - Removed Leftover X Pack references ([#2638](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/2638))
 - Removes Add Integration button ([#2723](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/2723))
 - Change geckodriver version to make consistency ([#2772](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/2772))
+- [Multi DataSource] Update default audit log path ([#2793](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/2793))
 
 ### 🚞 Infrastructure
 
diff --git a/src/plugins/data_source/README.md b/src/plugins/data_source/README.md
index a76e9a1fb5a0..ca212f4ded7f 100755
--- a/src/plugins/data_source/README.md
+++ b/src/plugins/data_source/README.md
@@ -11,15 +11,15 @@ Update the following configuration in the `opensearch_dashboards.yml` file to ap
 1. The dataSource plugin is disabled by default; to enable it:
    `data_source.enabled: true`
 
-2. The audit trail is enabled by default for logging the access to data source; to disable it:
-   `data_source.audit.enabled: false`
+2. The audit trail is disabled by default for logging the access to data source; to disable it:
+   `data_source.audit.enabled: true`
 
-- Current auditor configuration:
+- Default auditor configuration:
 
 ```yml
 data_source.audit.appender.kind: 'file'
 data_source.audit.appender.layout.kind: 'pattern'
-data_source.audit.appender.path: '/tmp/opensearch-dashboards-data-source-audit.log'
+data_source.audit.appender.path: '<Operating System's Temp Folder>/opensearch-dashboards-data-source-audit.log'
 ```
 
 3. The default encryption-related configuration parameters are:
diff --git a/src/plugins/data_source/audit_config.ts b/src/plugins/data_source/audit_config.ts
index d8c99fbfa846..ec898ff5441e 100644
--- a/src/plugins/data_source/audit_config.ts
+++ b/src/plugins/data_source/audit_config.ts
@@ -4,6 +4,8 @@
  */
 
 import { schema } from '@osd/config-schema';
+import os from 'os';
+import path from 'path';
 // eslint-disable-next-line @osd/eslint/no-restricted-paths
 import { DateConversion } from '../../../src/core/server/logging/layouts/conversions';
 
@@ -36,7 +38,7 @@ export const fileAppenderSchema = schema.object(
         kind: 'pattern',
         highlight: true,
       },
-      path: '/tmp/opensearch-dashboards-data-source-audit.log',
+      path: path.join(os.tmpdir(), 'opensearch-dashboards-data-source-audit.log'),
     },
   }
 );
diff --git a/src/plugins/data_source/config.ts b/src/plugins/data_source/config.ts
index f2fd79fade9a..1fc4e00c3e23 100644
--- a/src/plugins/data_source/config.ts
+++ b/src/plugins/data_source/config.ts
@@ -34,7 +34,7 @@ export const configSchema = schema.object({
     size: schema.number({ defaultValue: 5 }),
   }),
   audit: schema.object({
-    enabled: schema.boolean({ defaultValue: true }),
+    enabled: schema.boolean({ defaultValue: false }),
     appender: fileAppenderSchema,
   }),
 });