From 3af363e4739752d2d3cccfa56f40cabf48fc6ff3 Mon Sep 17 00:00:00 2001 From: Mark Bishop Date: Wed, 15 Aug 2018 17:31:00 -0700 Subject: [PATCH] moving to install section --- .../api-auditing/_index.md | 32 +++++++++---------- 1 file changed, 16 insertions(+), 16 deletions(-) rename content/rancher/v2.x/en/{faq => installation}/api-auditing/_index.md (100%) diff --git a/content/rancher/v2.x/en/faq/api-auditing/_index.md b/content/rancher/v2.x/en/installation/api-auditing/_index.md similarity index 100% rename from content/rancher/v2.x/en/faq/api-auditing/_index.md rename to content/rancher/v2.x/en/installation/api-auditing/_index.md index 8877fa0ddba..69f54ff47d3 100644 --- a/content/rancher/v2.x/en/faq/api-auditing/_index.md +++ b/content/rancher/v2.x/en/installation/api-auditing/_index.md @@ -5,6 +5,22 @@ weight: 10000 Rancher ships with API Auditing to record the sequence of system events initiated by individual users. You can know what happened, when it happened, who initiated it, and what cluster it affected. API auditing records all requests and responses to and from the Rancher API, which includes use of the Rancher UI and any other use of the Rancher API through programmatic use. +## API Auditing Usage + +Each API transaction creates two entries for it in the audit log, one for requests and one for response: `RequestReceived` and `ResponseComplete`. Each log transaction for a request/response pair uses the same `auditID` value. + +The usage below defines rules about what the audit log should record and what data it should include: + + +Parameter | Description | +---------|----------| + `AUDIT_LEVEL` | `0` - Disable audit log.
`1` - Log event metadata.
`2` - Log event metadata and request body.
`3` - Log event metadata, request body, and response body. | + `AUDIT_LOG_PATH` | Log path for Rancher Server API. Default path is `/var/log/auditlog/rancher-api-audit.log`. You can mount the log directory to host. | + `AUDIT_LOG_MAXAGE` | Defined the maximum number of days to retain old audit log files. Default is 10 days. | + `AUDIT_LOG_MAXBACKUP` | Defines the maximum number of audit log files to retain. Default is 10. + `AUDIT_LOG_MAXSIZE` | Defines the maximum size in megabytes of the audit log file before it gets rotated. Default size is 100M. + + ## Enabling API Auditing To enable API auditing, stop the Docker container that's running Rancher, and then restart it using the following command. This command includes parameters that turns on API auditing. For more information about usage for each switch related to API auditing, see [API Auditing Usage](#api-auditing-usage). @@ -22,22 +38,6 @@ To enable API auditing, stop the Docker container that's running Rancher, and th rancher/rancher:latest ``` -## API Auditing Usage - -Each API transaction creates two entries for it in the audit log, one for requests and one for response: `RequestReceived` and `ResponseComplete`. Each log transaction for a request/response pair uses the same `auditID` value. - -The usage below defines rules about what the audit log should record and what data it should include: - - -Parameter | Description | ----------|----------| - `AUDIT_LEVEL` | `0` - Disable audit log.
`1` - Log event metadata.
`2` - Log event metadata and request body.
`3` - Log event metadata, request body, and response body. | - `AUDIT_LOG_PATH` | Log path for Rancher Server API. Default path is `/var/log/auditlog/rancher-api-audit.log`. You can mount the log directory to host. | - `AUDIT_LOG_MAXAGE` | Defined the maximum number of days to retain old audit log files. Default is 10 days. | - `AUDIT_LOG_MAXBACKUP` | Defines the maximum number of audit log files to retain. Default is 10. - `AUDIT_LOG_MAXSIZE` | Defines the maximum size in megabytes of the audit log file before it gets rotated. Default size is 100M. - - ## Viewing API Audit Logs By default, you can view your audit logs on any of your cluster nodes at `root/var/log/auditlog/rancher-api-audit.log` using your favorite text editor. For example: