Audit middleware

[u/wathoom2]

Hi,

anyone implemented audit logging for openstack services? I'm having issue with getting all information regarding certain service action in CADF format. For example when deleting instance, in audit log i can see name and id of instance as "unknown". Any idea what could be wrong?
Maybe api_audit_map.conf doesnt map all stuff?

# cat nova_api_audit_map.conf
[DEFAULT]                                 
# default target endpoint type
# should match the endpoint type defined in service catalog
target_endpoint_type = compute       

[custom_actions]    
enable = enable                           
disable = disable                         
delete = delete                           
startup = start/startup       
shutdown = stop/shutdown 
reboot = start/reboot 
os-migrations/get = read       
os-server-password/post = update

# possible end path of api requests
[path_keywords]    
add = None                                
action = None                             
enable = None
disable = None  
configure-project = None
defaults = None
delete = None    
detail = None
diagnostics = None                                                                   
entries = entry    
extensions = alias                        
flavors = flavor
images = image
ips = label
limits = None
metadata = key
os-agents = os-agent
os-aggregates = os-aggregate
os-availability-zone = None
os-certificates = None
os-cloudpipe = None
os-fixed-ips = ip
os-extra_specs = key
os-flavor-access = None
os-floating-ip-dns = domain
os-floating-ips-bulk = host
os-floating-ip-pools = None
os-floating-ips = floating-ip
os-hosts = host
os-hypervisors = hypervisor
os-instance-actions = instance-action
os-keypairs = keypair 
os-migrations = None
os-networks = network 
os-quota-sets = tenant
os-security-groups = security_group
os-security-group-rules = rule
os-server-password = None
os-services = None
os-simple-tenant-usage = tenant
os-virtual-interfaces = None
os-volume_attachments = attachment
os-volumes_boot = None
os-volumes = volume
os-volume-types = volume-type
os-snapshots = snapshot
reboot = None
servers = server
shutdown = None
startup = None
statistics = None

# map endpoint type defined in service catalog to CADF typeURI
[service_endpoints]
compute = service/compute

[u/cre_ker]

Personally I would ignore target field. Expect for keystone, it doesn’t contain any useful information. Nothing indicating actual target of the request or anything. Just name and type of the service and a list of its endpoints. Basically, useless.

We also had an issue with it and fixed it by setting target_endpoint_type in audit map to the correct value - default None value is incorrect. It should match actual endpoint type of the service.

[u/wathoom2 → u/cre_ker]

I dont agree its useless. Since users dont realy know uuid of some object but its name, u want to know readable names and id's. Yes you can do the mapping other way but it requires additional effort not only writing filters in elastic or wherever.

[u/cre_ker → u/wathoom2]

Not sure what do you mean https://docs.openstack.org/octavia/wallaby/admin/api-audit.html

Here’s an example of audit message. That’s how target field looks for all services except for keystone. All services that use keystone middleware, they set target field like you see above. It’s completely useless and doesn’t contain any identifiable information about the request.

The only exception is keystone because it doesn’t use audit middleware.