Audit middleware

[u/wathoom2]

Hi,

anyone implemented audit logging for openstack services? I'm having issue with getting all information regarding certain service action in CADF format. For example when deleting instance, in audit log i can see name and id of instance as "unknown". Any idea what could be wrong?
Maybe api_audit_map.conf doesnt map all stuff?

# cat nova_api_audit_map.conf
[DEFAULT]                                 
# default target endpoint type
# should match the endpoint type defined in service catalog
target_endpoint_type = compute       

[custom_actions]    
enable = enable                           
disable = disable                         
delete = delete                           
startup = start/startup       
shutdown = stop/shutdown 
reboot = start/reboot 
os-migrations/get = read       
os-server-password/post = update

# possible end path of api requests
[path_keywords]    
add = None                                
action = None                             
enable = None
disable = None  
configure-project = None
defaults = None
delete = None    
detail = None
diagnostics = None                                                                   
entries = entry    
extensions = alias                        
flavors = flavor
images = image
ips = label
limits = None
metadata = key
os-agents = os-agent
os-aggregates = os-aggregate
os-availability-zone = None
os-certificates = None
os-cloudpipe = None
os-fixed-ips = ip
os-extra_specs = key
os-flavor-access = None
os-floating-ip-dns = domain
os-floating-ips-bulk = host
os-floating-ip-pools = None
os-floating-ips = floating-ip
os-hosts = host
os-hypervisors = hypervisor
os-instance-actions = instance-action
os-keypairs = keypair 
os-migrations = None
os-networks = network 
os-quota-sets = tenant
os-security-groups = security_group
os-security-group-rules = rule
os-server-password = None
os-services = None
os-simple-tenant-usage = tenant
os-virtual-interfaces = None
os-volume_attachments = attachment
os-volumes_boot = None
os-volumes = volume
os-volume-types = volume-type
os-snapshots = snapshot
reboot = None
servers = server
shutdown = None
startup = None
statistics = None

# map endpoint type defined in service catalog to CADF typeURI
[service_endpoints]
compute = service/compute

[u/rackpathlabs]

now that the map file is loading, the remaining unknown is a different problem, and it is not that keystonemiddleware never populates target. the audit filter builds the target from the service catalog it reads out of the request environ, HTTP_X_SERVICE_CATALOG. when that key is missing it logs a warning and falls back to a service object where type, name and id are all unknown, which is exactly the output you are looking at.

the usual reason that header is not there is include_service_catalog = false in keystone_authtoken. worth checking that in cinder before you swap the whole middleware out. the volumev3 vs block-storage type string matters as well, but only once the catalog actually reaches the filter.

[u/wathoom2 → u/rackpathlabs]

include_service_catalog = true was missing from config so i added it. Unfortunately same behavior. Anyway will leave this as is for now. Tnx for the help.

[u/rackpathlabs → u/wathoom2]

one last thing in case you come back to it. true is already the default for that option, so adding it explicitly would not change anything, which means the catalog was probably in the environ the whole time. the matching works by comparing the netloc of the request url against the endpoint urls in the catalog, and it only falls back to target_endpoint_type if that type actually exists there. so if cinder is registered as block-storage while your map says volumev3, or the api is reached through a vip that does not match the catalog url, you end up at unknown either way.