启用 API 审计日志以记录系统事件

你可以启用 API 审计日志来记录各个用户发起的系统事件的顺序。通过查看日志，你可以了解发生了什么事件、事件发生的时间，事件发起人，以及事件影响的集群。启用此功能后，所有 Rancher API 的请求和响应都会写入日志中。

API 审计可以在 Rancher 安装或升级期间启用。

启用 API 审计日志

你可以将环境变量传递给 Rancher Server 容器，从而启用和配置审计日志。请参见以下文档，在安装时启用该功能：

API 审计日志选项

以下参数定义了审计日志的记录规则，其中包括应该记录什么内容以及包括什么数据：

参数描述
AUDIT_LEVEL0 - 禁用审计日志（默认）
1 - 日志事件元数据
2 - 日志事件元数据和请求体
3 - 日志事件元数据，请求体和响应体。请求/响应对的每个日志事务都使用同一个的 auditID。
如需了解每个设置记录的日志内容，请参见审计日志级别。
AUDIT_LOG_PATHRancher Server API 的日志路径。默认路径：/var/log/auditlog/rancher-api-audit.log。你可以将日志目录挂载到主机。

示例：AUDIT_LOG_PATH=/my/custom/path/
AUDIT_LOG_MAXAGE旧审计日志文件可保留的最大天数。默认为 10 天。
AUDIT_LOG_MAXBACKUP保留的审计日志最大文件个数。默认值为 10。
AUDIT_LOG_MAXSIZE在审计日志文件被轮换前的最大容量，单位是 MB。默认大小为 100MB。

审核日志级别

下表介绍了每个 AUDIT_LEVEL 记录的 API 事务：

AUDIT_LEVEL 设置请求元数据请求体响应元数据响应体
0
1✓
2✓✓
3✓✓✓✓

查看 API 审计日志

Docker 安装

与主机系统共享 AUDIT_LOG_PATH 目录（默认目录：/var/log/auditlog）。日志可以通过标准 CLI 工具进行解析，也可以转发到 Fluentd、Filebeat、Logstash 等日志收集工具。

Kubernetes 安装

使用 Helm Chart 安装 Rancher 时启动 API 审计日志，会在 Rancher Pod 中创建一个 rancher-audit-log Sidecar 容器。该容器会将日志发送到标准输出 (stdout)。你可以像查看其他容器的日志一样查看 API 审计日志。

rancher-audit-log 容器位于 cattle-system 命名空间中的 rancher Pod 中。

CLI

  1. kubectl -n cattle-system logs -f rancher-84d886bdbb-s4s69 rancher-audit-log

发送审计日志

你可以为集群启用 Rancher 的内置日志收集和传送功能，将审计日志和其他服务日志发送到支持的 endpoint。详情请参见 Rancher 工具 - Logging。

审计日志示例

启用审计日志后，Rancher 会以 JSON 格式记录每个 API 的请求和响应。下文的代码示例展示了如何查看 API 事务。

元数据日志级别

如果你将 AUDIT_LEVEL 设置为 1，Rancher 只会记录每个 API 请求的元数据标头，而不会记录请求体。标头记录了 API 事务的基本信息，包括 ID、发起人、发起时间等。代码示例如下：

  1. {
  2.   "auditID": "30022177-9e2e-43d1-b0d0-06ef9d3db183",
  3.   "requestURI": "/v3/schemas",
  4.   "sourceIPs": ["::1"],
  5.   "user": {
  6.     "name": "user-f4tt2",
  7.     "group": ["system:authenticated"]
  8.   },
  9.   "verb": "GET",
  10.   "stage": "RequestReceived",
  11.   "stageTimestamp": "2018-07-20 10:22:43 +0800"
  12. }

元数据和请求体日志级别

如果你将 AUDIT_LEVEL 设置为 2，Rancher 会记录每个 API 请求的元数据标头和请求体。

下面的代码示例描述了一个 API 请求，包括它的元数据标头和正文：

  1. {
  2.   "auditID": "ef1d249e-bfac-4fd0-a61f-cbdcad53b9bb",
  3.   "requestURI": "/v3/project/c-bcz5t:p-fdr4s/workloads/deployment:default:nginx",
  4.   "sourceIPs": ["::1"],
  5.   "user": {
  6.     "name": "user-f4tt2",
  7.     "group": ["system:authenticated"]
  8.   },
  9.   "verb": "PUT",
  10.   "stage": "RequestReceived",
  11.   "stageTimestamp": "2018-07-20 10:28:08 +0800",
  12.   "requestBody": {
  13.     "hostIPC": false,
  14.     "hostNetwork": false,
  15.     "hostPID": false,
  16.     "paused": false,
  17.     "annotations": {},
  18.     "baseType": "workload",
  19.     "containers": [
  20.       {
  21.         "allowPrivilegeEscalation": false,
  22.         "image": "nginx",
  23.         "imagePullPolicy": "Always",
  24.         "initContainer": false,
  25.         "name": "nginx",
  26.         "ports": [
  27.           {
  28.             "containerPort": 80,
  29.             "dnsName": "nginx-nodeport",
  30.             "kind": "NodePort",
  31.             "name": "80tcp01",
  32.             "protocol": "TCP",
  33.             "sourcePort": 0,
  34.             "type": "/v3/project/schemas/containerPort"
  35.           }
  36.         ],
  37.         "privileged": false,
  38.         "readOnly": false,
  39.         "resources": {
  40.           "type": "/v3/project/schemas/resourceRequirements",
  41.           "requests": {},
  42.           "limits": {}
  43.         },
  44.         "restartCount": 0,
  45.         "runAsNonRoot": false,
  46.         "stdin": true,
  47.         "stdinOnce": false,
  48.         "terminationMessagePath": "/dev/termination-log",
  49.         "terminationMessagePolicy": "File",
  50.         "tty": true,
  51.         "type": "/v3/project/schemas/container",
  52.         "environmentFrom": [],
  53.         "capAdd": [],
  54.         "capDrop": [],
  55.         "livenessProbe": null,
  56.         "volumeMounts": []
  57.       }
  58.     ],
  59.     "created": "2018-07-18T07:34:16Z",
  60.     "createdTS": 1531899256000,
  61.     "creatorId": null,
  62.     "deploymentConfig": {
  63.       "maxSurge": 1,
  64.       "maxUnavailable": 0,
  65.       "minReadySeconds": 0,
  66.       "progressDeadlineSeconds": 600,
  67.       "revisionHistoryLimit": 10,
  68.       "strategy": "RollingUpdate"
  69.     },
  70.     "deploymentStatus": {
  71.       "availableReplicas": 1,
  72.       "conditions": [
  73.         {
  74.           "lastTransitionTime": "2018-07-18T07:34:38Z",
  75.           "lastTransitionTimeTS": 1531899278000,
  76.           "lastUpdateTime": "2018-07-18T07:34:38Z",
  77.           "lastUpdateTimeTS": 1531899278000,
  78.           "message": "Deployment has minimum availability.",
  79.           "reason": "MinimumReplicasAvailable",
  80.           "status": "True",
  81.           "type": "Available"
  82.         },
  83.         {
  84.           "lastTransitionTime": "2018-07-18T07:34:16Z",
  85.           "lastTransitionTimeTS": 1531899256000,
  86.           "lastUpdateTime": "2018-07-18T07:34:38Z",
  87.           "lastUpdateTimeTS": 1531899278000,
  88.           "message": "ReplicaSet \"nginx-64d85666f9\" has successfully progressed.",
  89.           "reason": "NewReplicaSetAvailable",
  90.           "status": "True",
  91.           "type": "Progressing"
  92.         }
  93.       ],
  94.       "observedGeneration": 2,
  95.       "readyReplicas": 1,
  96.       "replicas": 1,
  97.       "type": "/v3/project/schemas/deploymentStatus",
  98.       "unavailableReplicas": 0,
  99.       "updatedReplicas": 1
  100.     },
  101.     "dnsPolicy": "ClusterFirst",
  102.     "id": "deployment:default:nginx",
  103.     "labels": {
  104.       "workload.user.cattle.io/workloadselector": "deployment-default-nginx"
  105.     },
  106.     "name": "nginx",
  107.     "namespaceId": "default",
  108.     "projectId": "c-bcz5t:p-fdr4s",
  109.     "publicEndpoints": [
  110.       {
  111.         "addresses": ["10.64.3.58"],
  112.         "allNodes": true,
  113.         "ingressId": null,
  114.         "nodeId": null,
  115.         "podId": null,
  116.         "port": 30917,
  117.         "protocol": "TCP",
  118.         "serviceId": "default:nginx-nodeport",
  119.         "type": "publicEndpoint"
  120.       }
  121.     ],
  122.     "restartPolicy": "Always",
  123.     "scale": 1,
  124.     "schedulerName": "default-scheduler",
  125.     "selector": {
  126.       "matchLabels": {
  127.         "workload.user.cattle.io/workloadselector": "deployment-default-nginx"
  128.       },
  129.       "type": "/v3/project/schemas/labelSelector"
  130.     },
  131.     "state": "active",
  132.     "terminationGracePeriodSeconds": 30,
  133.     "transitioning": "no",
  134.     "transitioningMessage": "",
  135.     "type": "deployment",
  136.     "uuid": "f998037d-8a5c-11e8-a4cf-0245a7ebb0fd",
  137.     "workloadAnnotations": {
  138.       "deployment.kubernetes.io/revision": "1",
  139.       "field.cattle.io/creatorId": "user-f4tt2"
  140.     },
  141.     "workloadLabels": {
  142.       "workload.user.cattle.io/workloadselector": "deployment-default-nginx"
  143.     },
  144.     "scheduling": {
  145.       "node": {}
  146.     },
  147.     "description": "my description",
  148.     "volumes": []
  149.   }
  150. }

元数据、请求体和响应体日志级别

如果你将 AUDIT_LEVEL 设置为 3，Rancher 会记录：

  • 每个 API 请求的元数据标头和请求体。
  • 每个 API 响应的元数据标头和响应体。

请求

下面的代码示例描述了一个 API 请求，包括它的元数据标头和正文：

  1. {
  2.   "auditID": "a886fd9f-5d6b-4ae3-9a10-5bff8f3d68af",
  3.   "requestURI": "/v3/project/c-bcz5t:p-fdr4s/workloads/deployment:default:nginx",
  4.   "sourceIPs": ["::1"],
  5.   "user": {
  6.     "name": "user-f4tt2",
  7.     "group": ["system:authenticated"]
  8.   },
  9.   "verb": "PUT",
  10.   "stage": "RequestReceived",
  11.   "stageTimestamp": "2018-07-20 10:33:06 +0800",
  12.   "requestBody": {
  13.     "hostIPC": false,
  14.     "hostNetwork": false,
  15.     "hostPID": false,
  16.     "paused": false,
  17.     "annotations": {},
  18.     "baseType": "workload",
  19.     "containers": [
  20.       {
  21.         "allowPrivilegeEscalation": false,
  22.         "image": "nginx",
  23.         "imagePullPolicy": "Always",
  24.         "initContainer": false,
  25.         "name": "nginx",
  26.         "ports": [
  27.           {
  28.             "containerPort": 80,
  29.             "dnsName": "nginx-nodeport",
  30.             "kind": "NodePort",
  31.             "name": "80tcp01",
  32.             "protocol": "TCP",
  33.             "sourcePort": 0,
  34.             "type": "/v3/project/schemas/containerPort"
  35.           }
  36.         ],
  37.         "privileged": false,
  38.         "readOnly": false,
  39.         "resources": {
  40.           "type": "/v3/project/schemas/resourceRequirements",
  41.           "requests": {},
  42.           "limits": {}
  43.         },
  44.         "restartCount": 0,
  45.         "runAsNonRoot": false,
  46.         "stdin": true,
  47.         "stdinOnce": false,
  48.         "terminationMessagePath": "/dev/termination-log",
  49.         "terminationMessagePolicy": "File",
  50.         "tty": true,
  51.         "type": "/v3/project/schemas/container",
  52.         "environmentFrom": [],
  53.         "capAdd": [],
  54.         "capDrop": [],
  55.         "livenessProbe": null,
  56.         "volumeMounts": []
  57.       }
  58.     ],
  59.     "created": "2018-07-18T07:34:16Z",
  60.     "createdTS": 1531899256000,
  61.     "creatorId": null,
  62.     "deploymentConfig": {
  63.       "maxSurge": 1,
  64.       "maxUnavailable": 0,
  65.       "minReadySeconds": 0,
  66.       "progressDeadlineSeconds": 600,
  67.       "revisionHistoryLimit": 10,
  68.       "strategy": "RollingUpdate"
  69.     },
  70.     "deploymentStatus": {
  71.       "availableReplicas": 1,
  72.       "conditions": [
  73.         {
  74.           "lastTransitionTime": "2018-07-18T07:34:38Z",
  75.           "lastTransitionTimeTS": 1531899278000,
  76.           "lastUpdateTime": "2018-07-18T07:34:38Z",
  77.           "lastUpdateTimeTS": 1531899278000,
  78.           "message": "Deployment has minimum availability.",
  79.           "reason": "MinimumReplicasAvailable",
  80.           "status": "True",
  81.           "type": "Available"
  82.         },
  83.         {
  84.           "lastTransitionTime": "2018-07-18T07:34:16Z",
  85.           "lastTransitionTimeTS": 1531899256000,
  86.           "lastUpdateTime": "2018-07-18T07:34:38Z",
  87.           "lastUpdateTimeTS": 1531899278000,
  88.           "message": "ReplicaSet \"nginx-64d85666f9\" has successfully progressed.",
  89.           "reason": "NewReplicaSetAvailable",
  90.           "status": "True",
  91.           "type": "Progressing"
  92.         }
  93.       ],
  94.       "observedGeneration": 2,
  95.       "readyReplicas": 1,
  96.       "replicas": 1,
  97.       "type": "/v3/project/schemas/deploymentStatus",
  98.       "unavailableReplicas": 0,
  99.       "updatedReplicas": 1
  100.     },
  101.     "dnsPolicy": "ClusterFirst",
  102.     "id": "deployment:default:nginx",
  103.     "labels": {
  104.       "workload.user.cattle.io/workloadselector": "deployment-default-nginx"
  105.     },
  106.     "name": "nginx",
  107.     "namespaceId": "default",
  108.     "projectId": "c-bcz5t:p-fdr4s",
  109.     "publicEndpoints": [
  110.       {
  111.         "addresses": ["10.64.3.58"],
  112.         "allNodes": true,
  113.         "ingressId": null,
  114.         "nodeId": null,
  115.         "podId": null,
  116.         "port": 30917,
  117.         "protocol": "TCP",
  118.         "serviceId": "default:nginx-nodeport",
  119.         "type": "publicEndpoint"
  120.       }
  121.     ],
  122.     "restartPolicy": "Always",
  123.     "scale": 1,
  124.     "schedulerName": "default-scheduler",
  125.     "selector": {
  126.       "matchLabels": {
  127.         "workload.user.cattle.io/workloadselector": "deployment-default-nginx"
  128.       },
  129.       "type": "/v3/project/schemas/labelSelector"
  130.     },
  131.     "state": "active",
  132.     "terminationGracePeriodSeconds": 30,
  133.     "transitioning": "no",
  134.     "transitioningMessage": "",
  135.     "type": "deployment",
  136.     "uuid": "f998037d-8a5c-11e8-a4cf-0245a7ebb0fd",
  137.     "workloadAnnotations": {
  138.       "deployment.kubernetes.io/revision": "1",
  139.       "field.cattle.io/creatorId": "user-f4tt2"
  140.     },
  141.     "workloadLabels": {
  142.       "workload.user.cattle.io/workloadselector": "deployment-default-nginx"
  143.     },
  144.     "scheduling": {
  145.       "node": {}
  146.     },
  147.     "description": "my decript",
  148.     "volumes": []
  149.   }
  150. }

响应

下面的代码示例描述了一个 API 响应，包括它的元数据标头和正文：

  1. {
  2.   "auditID": "a886fd9f-5d6b-4ae3-9a10-5bff8f3d68af",
  3.   "responseStatus": "200",
  4.   "stage": "ResponseComplete",
  5.   "stageTimestamp": "2018-07-20 10:33:06 +0800",
  6.   "responseBody": {
  7.     "actionLinks": {
  8.       "pause": "https://localhost:8443/v3/project/c-bcz5t:p-fdr4s/workloads/deployment:default:nginx?action=pause",
  9.       "resume": "https://localhost:8443/v3/project/c-bcz5t:p-fdr4s/workloads/deployment:default:nginx?action=resume",
  10.       "rollback": "https://localhost:8443/v3/project/c-bcz5t:p-fdr4s/workloads/deployment:default:nginx?action=rollback"
  11.     },
  12.     "annotations": {},
  13.     "baseType": "workload",
  14.     "containers": [
  15.       {
  16.         "allowPrivilegeEscalation": false,
  17.         "image": "nginx",
  18.         "imagePullPolicy": "Always",
  19.         "initContainer": false,
  20.         "name": "nginx",
  21.         "ports": [
  22.           {
  23.             "containerPort": 80,
  24.             "dnsName": "nginx-nodeport",
  25.             "kind": "NodePort",
  26.             "name": "80tcp01",
  27.             "protocol": "TCP",
  28.             "sourcePort": 0,
  29.             "type": "/v3/project/schemas/containerPort"
  30.           }
  31.         ],
  32.         "privileged": false,
  33.         "readOnly": false,
  34.         "resources": {
  35.           "type": "/v3/project/schemas/resourceRequirements"
  36.         },
  37.         "restartCount": 0,
  38.         "runAsNonRoot": false,
  39.         "stdin": true,
  40.         "stdinOnce": false,
  41.         "terminationMessagePath": "/dev/termination-log",
  42.         "terminationMessagePolicy": "File",
  43.         "tty": true,
  44.         "type": "/v3/project/schemas/container"
  45.       }
  46.     ],
  47.     "created": "2018-07-18T07:34:16Z",
  48.     "createdTS": 1531899256000,
  49.     "creatorId": null,
  50.     "deploymentConfig": {
  51.       "maxSurge": 1,
  52.       "maxUnavailable": 0,
  53.       "minReadySeconds": 0,
  54.       "progressDeadlineSeconds": 600,
  55.       "revisionHistoryLimit": 10,
  56.       "strategy": "RollingUpdate"
  57.     },
  58.     "deploymentStatus": {
  59.       "availableReplicas": 1,
  60.       "conditions": [
  61.         {
  62.           "lastTransitionTime": "2018-07-18T07:34:38Z",
  63.           "lastTransitionTimeTS": 1531899278000,
  64.           "lastUpdateTime": "2018-07-18T07:34:38Z",
  65.           "lastUpdateTimeTS": 1531899278000,
  66.           "message": "Deployment has minimum availability.",
  67.           "reason": "MinimumReplicasAvailable",
  68.           "status": "True",
  69.           "type": "Available"
  70.         },
  71.         {
  72.           "lastTransitionTime": "2018-07-18T07:34:16Z",
  73.           "lastTransitionTimeTS": 1531899256000,
  74.           "lastUpdateTime": "2018-07-18T07:34:38Z",
  75.           "lastUpdateTimeTS": 1531899278000,
  76.           "message": "ReplicaSet \"nginx-64d85666f9\" has successfully progressed.",
  77.           "reason": "NewReplicaSetAvailable",
  78.           "status": "True",
  79.           "type": "Progressing"
  80.         }
  81.       ],
  82.       "observedGeneration": 2,
  83.       "readyReplicas": 1,
  84.       "replicas": 1,
  85.       "type": "/v3/project/schemas/deploymentStatus",
  86.       "unavailableReplicas": 0,
  87.       "updatedReplicas": 1
  88.     },
  89.     "dnsPolicy": "ClusterFirst",
  90.     "hostIPC": false,
  91.     "hostNetwork": false,
  92.     "hostPID": false,
  93.     "id": "deployment:default:nginx",
  94.     "labels": {
  95.       "workload.user.cattle.io/workloadselector": "deployment-default-nginx"
  96.     },
  97.     "links": {
  98.       "remove": "https://localhost:8443/v3/project/c-bcz5t:p-fdr4s/workloads/deployment:default:nginx",
  99.       "revisions": "https://localhost:8443/v3/project/c-bcz5t:p-fdr4s/workloads/deployment:default:nginx/revisions",
  100.       "self": "https://localhost:8443/v3/project/c-bcz5t:p-fdr4s/workloads/deployment:default:nginx",
  101.       "update": "https://localhost:8443/v3/project/c-bcz5t:p-fdr4s/workloads/deployment:default:nginx",
  102.       "yaml": "https://localhost:8443/v3/project/c-bcz5t:p-fdr4s/workloads/deployment:default:nginx/yaml"
  103.     },
  104.     "name": "nginx",
  105.     "namespaceId": "default",
  106.     "paused": false,
  107.     "projectId": "c-bcz5t:p-fdr4s",
  108.     "publicEndpoints": [
  109.       {
  110.         "addresses": ["10.64.3.58"],
  111.         "allNodes": true,
  112.         "ingressId": null,
  113.         "nodeId": null,
  114.         "podId": null,
  115.         "port": 30917,
  116.         "protocol": "TCP",
  117.         "serviceId": "default:nginx-nodeport"
  118.       }
  119.     ],
  120.     "restartPolicy": "Always",
  121.     "scale": 1,
  122.     "schedulerName": "default-scheduler",
  123.     "selector": {
  124.       "matchLabels": {
  125.         "workload.user.cattle.io/workloadselector": "deployment-default-nginx"
  126.       },
  127.       "type": "/v3/project/schemas/labelSelector"
  128.     },
  129.     "state": "active",
  130.     "terminationGracePeriodSeconds": 30,
  131.     "transitioning": "no",
  132.     "transitioningMessage": "",
  133.     "type": "deployment",
  134.     "uuid": "f998037d-8a5c-11e8-a4cf-0245a7ebb0fd",
  135.     "workloadAnnotations": {
  136.       "deployment.kubernetes.io/revision": "1",
  137.       "field.cattle.io/creatorId": "user-f4tt2"
  138.     },
  139.     "workloadLabels": {
  140.       "workload.user.cattle.io/workloadselector": "deployment-default-nginx"
  141.     }
  142.   }
  143. }