Support audit logs with additional fields (#6738)
This PR adds support - Request query params - Request headers - Response headers AuditLogEntry is exported and versioned as well starting with this PR.master
Harshavardhana
6 years ago
committed by
Dee Koder
parent
3f19ea98bb
commit
bef0318c36
@ -0,0 +1,97 @@ |
|||||||
|
/* |
||||||
|
* Minio Cloud Storage, (C) 2018 Minio, Inc. |
||||||
|
* |
||||||
|
* Licensed under the Apache License, Version 2.0 (the "License"); |
||||||
|
* you may not use this file except in compliance with the License. |
||||||
|
* You may obtain a copy of the License at |
||||||
|
* |
||||||
|
* http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
* |
||||||
|
* Unless required by applicable law or agreed to in writing, software |
||||||
|
* distributed under the License is distributed on an "AS IS" BASIS, |
||||||
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||||
|
* See the License for the specific language governing permissions and |
||||||
|
* limitations under the License. |
||||||
|
*/ |
||||||
|
|
||||||
|
package logger |
||||||
|
|
||||||
|
import ( |
||||||
|
"context" |
||||||
|
"net/http" |
||||||
|
"strings" |
||||||
|
"time" |
||||||
|
) |
||||||
|
|
||||||
|
// Represents the current version of audit log structure.
|
||||||
|
const auditLogVersion = "1" |
||||||
|
|
||||||
|
// AuditEntry - audit entry logs.
|
||||||
|
type AuditEntry struct { |
||||||
|
Version string `json:"version"` |
||||||
|
DeploymentID string `json:"deploymentid,omitempty"` |
||||||
|
Time string `json:"time"` |
||||||
|
API *api `json:"api,omitempty"` |
||||||
|
RemoteHost string `json:"remotehost,omitempty"` |
||||||
|
RequestID string `json:"requestID,omitempty"` |
||||||
|
UserAgent string `json:"userAgent,omitempty"` |
||||||
|
ReqQuery map[string]string `json:"requestQuery,omitempty"` |
||||||
|
ReqHeader map[string]string `json:"requestHeader,omitempty"` |
||||||
|
RespHeader map[string]string `json:"responseHeader,omitempty"` |
||||||
|
} |
||||||
|
|
||||||
|
// AuditTargets is the list of enabled audit loggers
|
||||||
|
var AuditTargets = []LoggingTarget{} |
||||||
|
|
||||||
|
// AddAuditTarget adds a new audit logger target to the
|
||||||
|
// list of enabled loggers
|
||||||
|
func AddAuditTarget(t LoggingTarget) { |
||||||
|
AuditTargets = append(AuditTargets, t) |
||||||
|
} |
||||||
|
|
||||||
|
// AuditLog - logs audit logs to all targets.
|
||||||
|
func AuditLog(ctx context.Context, w http.ResponseWriter, r *http.Request) { |
||||||
|
if Disable { |
||||||
|
return |
||||||
|
} |
||||||
|
|
||||||
|
req := GetReqInfo(ctx) |
||||||
|
if req == nil { |
||||||
|
req = &ReqInfo{API: "SYSTEM"} |
||||||
|
} |
||||||
|
|
||||||
|
reqQuery := make(map[string]string) |
||||||
|
for k, v := range r.URL.Query() { |
||||||
|
reqQuery[k] = strings.Join(v, ",") |
||||||
|
} |
||||||
|
reqHeader := make(map[string]string) |
||||||
|
for k, v := range r.Header { |
||||||
|
reqHeader[k] = strings.Join(v, ",") |
||||||
|
} |
||||||
|
respHeader := make(map[string]string) |
||||||
|
for k, v := range w.Header() { |
||||||
|
respHeader[k] = strings.Join(v, ",") |
||||||
|
} |
||||||
|
|
||||||
|
// Send audit logs only to http targets.
|
||||||
|
for _, t := range AuditTargets { |
||||||
|
t.send(AuditEntry{ |
||||||
|
Version: auditLogVersion, |
||||||
|
DeploymentID: deploymentID, |
||||||
|
RemoteHost: req.RemoteHost, |
||||||
|
RequestID: req.RequestID, |
||||||
|
UserAgent: req.UserAgent, |
||||||
|
Time: time.Now().UTC().Format(time.RFC3339Nano), |
||||||
|
API: &api{ |
||||||
|
Name: req.API, |
||||||
|
Args: &args{ |
||||||
|
Bucket: req.BucketName, |
||||||
|
Object: req.ObjectName, |
||||||
|
}, |
||||||
|
}, |
||||||
|
ReqQuery: reqQuery, |
||||||
|
ReqHeader: reqHeader, |
||||||
|
RespHeader: respHeader, |
||||||
|
}) |
||||||
|
} |
||||||
|
} |
||||||
@ -0,0 +1,108 @@ |
|||||||
|
# Minio Logging Quickstart Guide [](https://slack.minio.io) |
||||||
|
This document explains how to configure Minio server to log to different logging targets. |
||||||
|
|
||||||
|
## Log Targets |
||||||
|
Minio supports currently two target types |
||||||
|
|
||||||
|
- console |
||||||
|
- http |
||||||
|
|
||||||
|
### Console Target |
||||||
|
Console target logs to `/dev/stderr` and is enabled by default. To turn-off console logging you would have to update your Minio server configuration using `mc admin config set` command. |
||||||
|
|
||||||
|
Assuming `mc` is already [configured](https://docs.minio.io/docs/minio-client-quickstart-guide.html) |
||||||
|
``` |
||||||
|
mc admin config get myminio/ > /tmp/config |
||||||
|
``` |
||||||
|
|
||||||
|
Edit the `/tmp/config` and toggle `console` field `enabled` from `true` to `false`. |
||||||
|
|
||||||
|
```json |
||||||
|
"logger": { |
||||||
|
"console": { |
||||||
|
"enabled": false |
||||||
|
} |
||||||
|
}, |
||||||
|
``` |
||||||
|
|
||||||
|
Once changed, now you may set the changed config to server through following commands. |
||||||
|
``` |
||||||
|
mc admin config set myminio/ < /tmp/config |
||||||
|
mc admin restart myminio/ |
||||||
|
``` |
||||||
|
|
||||||
|
### HTTP Target |
||||||
|
HTTP target logs to a generic HTTP endpoint in JSON format and is not enabled by default. To enable HTTP target logging you would have to update your Minio server configuration using `mc admin config set` command. |
||||||
|
|
||||||
|
Assuming `mc` is already [configured](https://docs.minio.io/docs/minio-client-quickstart-guide.html) |
||||||
|
``` |
||||||
|
mc admin config get myminio/ > /tmp/config |
||||||
|
``` |
||||||
|
|
||||||
|
Edit the `/tmp/config` and toggle `http` field `enabled` from `false` to `true`. |
||||||
|
```json |
||||||
|
"logger": { |
||||||
|
"console": { |
||||||
|
"enabled": false |
||||||
|
}, |
||||||
|
"http": { |
||||||
|
"1": { |
||||||
|
"enabled": true, |
||||||
|
"endpoint": "http://endpoint:port/path" |
||||||
|
} |
||||||
|
} |
||||||
|
}, |
||||||
|
``` |
||||||
|
NOTE: `http://endpoint:port/path` is a placeholder value to indicate the URL format, please change this accordingly as per your configuration. |
||||||
|
|
||||||
|
Once changed, now you may set the changed config to server through following commands. |
||||||
|
``` |
||||||
|
mc admin config set myminio/ < /tmp/config |
||||||
|
mc admin restart myminio/ |
||||||
|
``` |
||||||
|
|
||||||
|
Minio also honors environment variable for HTTP target logging as shown below, this setting will override the endpoint settings in the Minio server config. |
||||||
|
``` |
||||||
|
MINIO_LOGGER_HTTP_ENDPOINT=http://localhost:8080/minio/logs minio server /mnt/data |
||||||
|
``` |
||||||
|
|
||||||
|
## Audit Targets |
||||||
|
For audit logging Minio supports only HTTP target type for now. Audit logging is currently only available through environment variable. |
||||||
|
``` |
||||||
|
MINIO_AUDIT_LOGGER_HTTP_ENDPOINT=http://localhost:8080/minio/logs/audit minio server /mnt/data |
||||||
|
``` |
||||||
|
|
||||||
|
Setting this environment variable automatically enables audit logging to the HTTP target. The audit logging is in JSON format as described below. |
||||||
|
```json |
||||||
|
{ |
||||||
|
"version": "1", |
||||||
|
"deploymentid": "1b3002bf-5005-4d9b-853e-64a05008ebb2", |
||||||
|
"time": "2018-11-02T21:57:58.231480177Z", |
||||||
|
"api": { |
||||||
|
"name": "ListBuckets", |
||||||
|
"args": {} |
||||||
|
}, |
||||||
|
"remotehost": "127.0.0.1", |
||||||
|
"requestID": "15636D7C53428FD4", |
||||||
|
"userAgent": "Minio (linux; amd64) minio-go/v6.0.8 mc/2018-11-02T21:13:30Z", |
||||||
|
"requestHeader": { |
||||||
|
"Authorization": "AWS4-HMAC-SHA256 Credential=minio/20181102/us-east-1/s3/aws4_request, SignedHeaders=host;x-amz-content-sha256;x-amz-date, Signature=6db486b42a85b23bffba66d654ce60242a7e92fb27cd4a1756e68082c02cc204", |
||||||
|
"User-Agent": "Minio (linux; amd64) minio-go/v6.0.8 mc/2018-11-02T21:13:30Z", |
||||||
|
"X-Amz-Content-Sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", |
||||||
|
"X-Amz-Date": "20181102T215758Z" |
||||||
|
}, |
||||||
|
"responseHeader": { |
||||||
|
"Accept-Ranges": "bytes", |
||||||
|
"Content-Security-Policy": "block-all-mixed-content", |
||||||
|
"Content-Type": "application/xml", |
||||||
|
"Server": "Minio/DEVELOPMENT.2018-11-02T21-57-15Z (linux; amd64)", |
||||||
|
"Vary": "Origin", |
||||||
|
"X-Amz-Request-Id": "15636D7C53428FD4", |
||||||
|
"X-Xss-Protection": "1; mode=block" |
||||||
|
} |
||||||
|
} |
||||||
|
``` |
||||||
|
|
||||||
|
## Explore Further |
||||||
|
* [Minio Quickstart Guide](https://docs.minio.io/docs/minio-quickstart-guide) |
||||||
|
* [Configure Minio Server with TLS](https://docs.minio.io/docs/how-to-secure-access-to-minio-server-with-tls) |
||||||
Loading…
Reference in new issue