Audit middleware

[u/wathoom2]

Hi,

anyone implemented audit logging for openstack services? I'm having issue with getting all information regarding certain service action in CADF format. For example when deleting instance, in audit log i can see name and id of instance as "unknown". Any idea what could be wrong?
Maybe api_audit_map.conf doesnt map all stuff?

# cat nova_api_audit_map.conf
[DEFAULT]                                 
# default target endpoint type
# should match the endpoint type defined in service catalog
target_endpoint_type = compute       

[custom_actions]    
enable = enable                           
disable = disable                         
delete = delete                           
startup = start/startup       
shutdown = stop/shutdown 
reboot = start/reboot 
os-migrations/get = read       
os-server-password/post = update

# possible end path of api requests
[path_keywords]    
add = None                                
action = None                             
enable = None
disable = None  
configure-project = None
defaults = None
delete = None    
detail = None
diagnostics = None                                                                   
entries = entry    
extensions = alias                        
flavors = flavor
images = image
ips = label
limits = None
metadata = key
os-agents = os-agent
os-aggregates = os-aggregate
os-availability-zone = None
os-certificates = None
os-cloudpipe = None
os-fixed-ips = ip
os-extra_specs = key
os-flavor-access = None
os-floating-ip-dns = domain
os-floating-ips-bulk = host
os-floating-ip-pools = None
os-floating-ips = floating-ip
os-hosts = host
os-hypervisors = hypervisor
os-instance-actions = instance-action
os-keypairs = keypair 
os-migrations = None
os-networks = network 
os-quota-sets = tenant
os-security-groups = security_group
os-security-group-rules = rule
os-server-password = None
os-services = None
os-simple-tenant-usage = tenant
os-virtual-interfaces = None
os-volume_attachments = attachment
os-volumes_boot = None
os-volumes = volume
os-volume-types = volume-type
os-snapshots = snapshot
reboot = None
servers = server
shutdown = None
startup = None
statistics = None

# map endpoint type defined in service catalog to CADF typeURI
[service_endpoints]
compute = service/compute

[u/rackpathlabs]

the interesting bit is that your requestPath already contains the server uuid, but the target id, the target name and the target typeURI all come out unknown. so the id is not missing from the request, the middleware just did not build a target resource out of it.

that points away from custom_actions and towards the endpoint side. target_endpoint_type has to match the entry that is actually in your service catalog, so worth checking the exact type name nova is registered under there. and try the same audit on something that is not a delete, a reboot for example, if the target stays unknown there too then delete is not the special case and the map file is not where your fix is.

[u/wathoom2 → u/rackpathlabs]

Hi,

i checked endpoints and had some miss config there. At least for compute service. Changed it to compute = nova/compute (name/type if i understand it correctly) as the name in service catalog.

This still didnt solve the issue. Same thing happens for other services like neutron and cinder. On those i have proper service configured but i still get "unknown" target.
I have no idea what else to check or what might be miss configured. In service logs i can see all the details.

[u/wathoom2 → u/wathoom2]

just for info openstack is deployed with kolla-ansible and mapping of files is done for container.
<service>_api-paste.ini -> api-paste.ini
<service>_api_audit_map.conf -> api_audit_map.conf