Support audit logs with additional fields (#6738)
This PR adds support - Request query params - Request headers - Response headers AuditLogEntry is exported and versioned as well starting with this PR.master
Harshavardhana
6 years ago
committed by
Dee Koder
parent
3f19ea98bb
commit
bef0318c36
@ -0,0 +1,97 @@ |
||||
/* |
||||
* Minio Cloud Storage, (C) 2018 Minio, Inc. |
||||
* |
||||
* Licensed under the Apache License, Version 2.0 (the "License"); |
||||
* you may not use this file except in compliance with the License. |
||||
* You may obtain a copy of the License at |
||||
* |
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
* |
||||
* Unless required by applicable law or agreed to in writing, software |
||||
* distributed under the License is distributed on an "AS IS" BASIS, |
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
* See the License for the specific language governing permissions and |
||||
* limitations under the License. |
||||
*/ |
||||
|
||||
package logger |
||||
|
||||
import ( |
||||
"context" |
||||
"net/http" |
||||
"strings" |
||||
"time" |
||||
) |
||||
|
||||
// Represents the current version of audit log structure.
|
||||
const auditLogVersion = "1" |
||||
|
||||
// AuditEntry - audit entry logs.
|
||||
type AuditEntry struct { |
||||
Version string `json:"version"` |
||||
DeploymentID string `json:"deploymentid,omitempty"` |
||||
Time string `json:"time"` |
||||
API *api `json:"api,omitempty"` |
||||
RemoteHost string `json:"remotehost,omitempty"` |
||||
RequestID string `json:"requestID,omitempty"` |
||||
UserAgent string `json:"userAgent,omitempty"` |
||||
ReqQuery map[string]string `json:"requestQuery,omitempty"` |
||||
ReqHeader map[string]string `json:"requestHeader,omitempty"` |
||||
RespHeader map[string]string `json:"responseHeader,omitempty"` |
||||
} |
||||
|
||||
// AuditTargets is the list of enabled audit loggers
|
||||
var AuditTargets = []LoggingTarget{} |
||||
|
||||
// AddAuditTarget adds a new audit logger target to the
|
||||
// list of enabled loggers
|
||||
func AddAuditTarget(t LoggingTarget) { |
||||
AuditTargets = append(AuditTargets, t) |
||||
} |
||||
|
||||
// AuditLog - logs audit logs to all targets.
|
||||
func AuditLog(ctx context.Context, w http.ResponseWriter, r *http.Request) { |
||||
if Disable { |
||||
return |
||||
} |
||||
|
||||
req := GetReqInfo(ctx) |
||||
if req == nil { |
||||
req = &ReqInfo{API: "SYSTEM"} |
||||
} |
||||
|
||||
reqQuery := make(map[string]string) |
||||
for k, v := range r.URL.Query() { |
||||
reqQuery[k] = strings.Join(v, ",") |
||||
} |
||||
reqHeader := make(map[string]string) |
||||
for k, v := range r.Header { |
||||
reqHeader[k] = strings.Join(v, ",") |
||||
} |
||||
respHeader := make(map[string]string) |
||||
for k, v := range w.Header() { |
||||
respHeader[k] = strings.Join(v, ",") |
||||
} |
||||
|
||||
// Send audit logs only to http targets.
|
||||
for _, t := range AuditTargets { |
||||
t.send(AuditEntry{ |
||||
Version: auditLogVersion, |
||||
DeploymentID: deploymentID, |
||||
RemoteHost: req.RemoteHost, |
||||
RequestID: req.RequestID, |
||||
UserAgent: req.UserAgent, |
||||
Time: time.Now().UTC().Format(time.RFC3339Nano), |
||||
API: &api{ |
||||
Name: req.API, |
||||
Args: &args{ |
||||
Bucket: req.BucketName, |
||||
Object: req.ObjectName, |
||||
}, |
||||
}, |
||||
ReqQuery: reqQuery, |
||||
ReqHeader: reqHeader, |
||||
RespHeader: respHeader, |
||||
}) |
||||
} |
||||
} |
||||
@ -0,0 +1,108 @@ |
||||
# Minio Logging Quickstart Guide [](https://slack.minio.io) |
||||
This document explains how to configure Minio server to log to different logging targets. |
||||
|
||||
## Log Targets |
||||
Minio supports currently two target types |
||||
|
||||
- console |
||||
- http |
||||
|
||||
### Console Target |
||||
Console target logs to `/dev/stderr` and is enabled by default. To turn-off console logging you would have to update your Minio server configuration using `mc admin config set` command. |
||||
|
||||
Assuming `mc` is already [configured](https://docs.minio.io/docs/minio-client-quickstart-guide.html) |
||||
``` |
||||
mc admin config get myminio/ > /tmp/config |
||||
``` |
||||
|
||||
Edit the `/tmp/config` and toggle `console` field `enabled` from `true` to `false`. |
||||
|
||||
```json |
||||
"logger": { |
||||
"console": { |
||||
"enabled": false |
||||
} |
||||
}, |
||||
``` |
||||
|
||||
Once changed, now you may set the changed config to server through following commands. |
||||
``` |
||||
mc admin config set myminio/ < /tmp/config |
||||
mc admin restart myminio/ |
||||
``` |
||||
|
||||
### HTTP Target |
||||
HTTP target logs to a generic HTTP endpoint in JSON format and is not enabled by default. To enable HTTP target logging you would have to update your Minio server configuration using `mc admin config set` command. |
||||
|
||||
Assuming `mc` is already [configured](https://docs.minio.io/docs/minio-client-quickstart-guide.html) |
||||
``` |
||||
mc admin config get myminio/ > /tmp/config |
||||
``` |
||||
|
||||
Edit the `/tmp/config` and toggle `http` field `enabled` from `false` to `true`. |
||||
```json |
||||
"logger": { |
||||
"console": { |
||||
"enabled": false |
||||
}, |
||||
"http": { |
||||
"1": { |
||||
"enabled": true, |
||||
"endpoint": "http://endpoint:port/path" |
||||
} |
||||
} |
||||
}, |
||||
``` |
||||
NOTE: `http://endpoint:port/path` is a placeholder value to indicate the URL format, please change this accordingly as per your configuration. |
||||
|
||||
Once changed, now you may set the changed config to server through following commands. |
||||
``` |
||||
mc admin config set myminio/ < /tmp/config |
||||
mc admin restart myminio/ |
||||
``` |
||||
|
||||
Minio also honors environment variable for HTTP target logging as shown below, this setting will override the endpoint settings in the Minio server config. |
||||
``` |
||||
MINIO_LOGGER_HTTP_ENDPOINT=http://localhost:8080/minio/logs minio server /mnt/data |
||||
``` |
||||
|
||||
## Audit Targets |
||||
For audit logging Minio supports only HTTP target type for now. Audit logging is currently only available through environment variable. |
||||
``` |
||||
MINIO_AUDIT_LOGGER_HTTP_ENDPOINT=http://localhost:8080/minio/logs/audit minio server /mnt/data |
||||
``` |
||||
|
||||
Setting this environment variable automatically enables audit logging to the HTTP target. The audit logging is in JSON format as described below. |
||||
```json |
||||
{ |
||||
"version": "1", |
||||
"deploymentid": "1b3002bf-5005-4d9b-853e-64a05008ebb2", |
||||
"time": "2018-11-02T21:57:58.231480177Z", |
||||
"api": { |
||||
"name": "ListBuckets", |
||||
"args": {} |
||||
}, |
||||
"remotehost": "127.0.0.1", |
||||
"requestID": "15636D7C53428FD4", |
||||
"userAgent": "Minio (linux; amd64) minio-go/v6.0.8 mc/2018-11-02T21:13:30Z", |
||||
"requestHeader": { |
||||
"Authorization": "AWS4-HMAC-SHA256 Credential=minio/20181102/us-east-1/s3/aws4_request, SignedHeaders=host;x-amz-content-sha256;x-amz-date, Signature=6db486b42a85b23bffba66d654ce60242a7e92fb27cd4a1756e68082c02cc204", |
||||
"User-Agent": "Minio (linux; amd64) minio-go/v6.0.8 mc/2018-11-02T21:13:30Z", |
||||
"X-Amz-Content-Sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", |
||||
"X-Amz-Date": "20181102T215758Z" |
||||
}, |
||||
"responseHeader": { |
||||
"Accept-Ranges": "bytes", |
||||
"Content-Security-Policy": "block-all-mixed-content", |
||||
"Content-Type": "application/xml", |
||||
"Server": "Minio/DEVELOPMENT.2018-11-02T21-57-15Z (linux; amd64)", |
||||
"Vary": "Origin", |
||||
"X-Amz-Request-Id": "15636D7C53428FD4", |
||||
"X-Xss-Protection": "1; mode=block" |
||||
} |
||||
} |
||||
``` |
||||
|
||||
## Explore Further |
||||
* [Minio Quickstart Guide](https://docs.minio.io/docs/minio-quickstart-guide) |
||||
* [Configure Minio Server with TLS](https://docs.minio.io/docs/how-to-secure-access-to-minio-server-with-tls) |
||||
Loading…
Reference in new issue