Administrator's Guide - Audit Log Management

Audit logs are detailed records of activities in the Lyve Cloud console and S3 API operations. Audit logs are used to access audit functions and track any suspicious activity.

When you enable audit logging, all audit logs are written to the selected target bucket. The target bucket must be immutable, which keeps audit logs immutable. For more information, see Using object immutability. You cannot switch off object immutability for the target bucket. You can maintain three types of audit logs:

• S3 API audit logs: This log records all supported S3 API calls. For more information, see Supported S3 API calls.
  
  S3 API audit logs are recorded in the S3-<BUCKET-NAME>-<TIMESTAMP>.gz format, where the BUCKET-NAME is the name of a bucket being logged. For more information, see Example S3 API audit log.
• IAM audit logs: This log includes all events corresponding to identity and access management actions.
  
  IAM audit logs are recorded in the IAM-<TIMESTAMP>.gz format. For more information, see Example of IAM audit log.
• Console audit logs: This log includes all the events that originated from the Lyve Cloud console's actions.
  
  The console audit log is recorded in the console-<TIMESTAMP>.gz format. For more information, see Example of the console audit log.

The audit log files have TIMESTAMP format: yyyy-MM-dd-HH-mm-ss' and are set to the UTC zone.

Audit log files keep sufficient information to establish which events occurred, when they occurred, and who caused them. Administrators can manually delete these audit log files after the specified retention duration ends. This helps you to manage the buckets cost-effectively. For more information, see Using object immutability.

Lyve Cloud periodically saves audit logs for specified buckets. The maximum size of a log file is 500 MB. If the file size reaches 500 MB, that log file is saved, and the logs continue to be written in a new file. Log files are saved to the target bucket as console audit log files, IAM audit logs, or S3 API logs.

Role-based access to permission

The following table describes access to enable and disable audit logs based on your role.

Video: Lvye Cloud - How to manage audit log settings in the Lyve Cloud console

Seagate on Vimeo: Lyve Cloud - How to manage audit log settings in the Lyve Cloud console

S3 API audit logs

S3 API audit logs keep detailed records of activity in the Lyve Cloud console as well as S3 API operations. To enable S3 API audit logs, you must select buckets to be logged from the target buckets available in the account.

Example S3 API audit log

The following is an example of an S3 API audit log file.

{   
"serviceAccountCreatorId": 
"john.doe@email.com", 
"auditEntry": 
 { 
    "api": 
{  
"name": "PutObject", 
"bucket": "bucket-1", 
"object": "values-v2.yaml", 
"status": "OK",    
"statusCode": 200,         
"timeToResponse": "2246401314ns" },     
"time": "2021-01-22T10:49:30.699378337Z",     
"version": "1",     
"requestID": "165C883E70C2A5D0",     
"userAgent": "aws-sdk-java/1.12.25 Linux/4.15.0-135-generic OpenJDK_64-Bit_Server_VM/11.0.12+7 java/11.0.12 vendor/Oracle_Corporation cfg/retry-  mode/legacy",     
"remotehost": "127.0.0.1",     
"deploymentid": "ef46b1cb-6be1-4aa2-9c14-e7ffbc11986b",    
 "requestHeader":{         
    "User-Agent": "aws-sdk-java/1.12.25 Linux/4.15.0-135-generic OpenJDK_64-Bit_Server_VM/11.0.12+7 java/11.0.12 vendor/Oracle_Corporation cfg/retry-mode/legacy",         
    "X-Amz-Date": "20210122T104928Z",         
    "Content-Type": "text/yaml",         
    "Authorization": "AWS4-HMAC-SHA256 Credential=AHPEVYIPHVQ3XNOY/20210122/us-east-1/s3/aws4_request, SignedHeaders=content-type;host;x-amz-content-sha256;x-amz-date, Signature=<redacted>",         
    "Content-Length": "5637",        
     "X-Amz-Content-Sha256": "UNSIGNED-PAYLOAD", 
    "X-Amz-Server-Side-Encryption": "AES256" },    
    "responseHeader":{  
        "ETag": "219857b61eb0c3dc9a3916a0992fc803",        
        "Vary": "Origin",        
        "Server": "LyveCloud/DEVELOPMENT.2020-06-22T03-43-44Z",        
        "Accept-Ranges": "bytes",        
        "Content-Length": "0",        
        "X-Amz-Request-Id": "165C883E70C2A5D0",        
        "X-Xss-Protection": "1; mode=block",        
        "Content-Security-Policy": "block-all-mixed-content",        
        "X-Amz-Server-Side-Encryption": "AES256" 
    } 
  },   
"serviceAccountName": "serv-acc-01" 
}

The following table describes the parameters specified in the S3 API audit log file.

Enabling S3 API audit logs

To enable S3 API audit logs:

1. On the left-hand menu, select Settings.
2. On the Audit Logs Settings page, set S3 API Audit Logs to ON to begin saving audit logs.
3. In the Audit Log Target Bucket dialog, select the target bucket from the list to store the logs.
   
   Set the target bucket only if you are setting the target bucket to write audit logs for the first time. However, if you have already set the target bucket while enabling console audit logs, you are not forced to select the target bucket.

4. Select Save.

After you enable the S3 API audit log:

To change the target bucket:

• On the Audit Log Settings page, a new 'Audit Log Target Bucket' section is displayed. This section displays the target bucket name and bucket region. To change the target bucket, see Editing audit log target bucket.

To set the S3 API audit logs:

• Select which buckets will have audit log.
  
  
  • All buckets must be logged: Selecting this option allows you to set and enforce logging for all available buckets in the account. By default, this option is selected.
  • Individually set per bucket: Selecting this option allows you to edit each bucket to enable logging manually.

After selecting the Individually set per bucket option, you must choose each bucket individually and then enable the S3 API audit logs. To enable S3 API audit logs for an individual bucket, see Editing bucket properties. Once S3 audit logs are enabled, the selected bucket in the account is labeled as Logged.

Disabling S3 API audit logs

While enabling S3 API Audit Logs, if you select the Individually set per bucket option and later disable audit logs, the S3 API Audit Logs option will be unavailable in that individual bucket.

To disable S3 API audit logs:

1. On the left-hand menu, select Settings.
2. On the Audit Log Settings page, set S3 API Audit Logs to Off.

After you switch off S3 API audit logs, the Logged label is removed from all buckets.

Console audit log

Enabling account audit logs enables Console Audit Logs, IAM Audit logs, and Account API Audit logs.

Before you enable them, become familiar with the account audit logs by reviewing the examples below.

Example of Account API audit log structure

{
"ApiEvent":
{
           EventName: “<eventname>”,
           Version: “2”,
Request: {
            AccountName: “service account name”,
            AccessKey: “<accesskey>”,
            RequestTime: “<hh:mm:ss>”,
            RequestParams: {          
                                …. Parameters.. or Body
                            },
SourceIP: “XXYYXX”

},

Response: {

               ResponseTime: “<response time>”,
               ResponseCode: “<response code>”,
               ResponseError: “<error>”,
               ResponseBody: {                                          …
                                body…. (with secret redacted) …
}
}

Example of an account audit log

The following is an example of the console audit log file.

{    
"ConsoleVersion": "DEVELOPMENT",    
"DeploymentID": "dell2",    
"LoginTime": "2021-01-25T09:19:11.622206Z",    
"UserIdentity": {       
    "EventSource": "https://dell2.console.localhost:32428",       
    "UserName": "john.doe@email.com",       
    "Role": "admin",       
    "IPAddress": "10.244.142.100:34310"   
     },    
    "ConsoleEvent": 
    {      
     "Eventname": "add-new-notification-recipient",      
     "Status": "Error while inserting data to table: ",       
    "StatusCode": 13,       
    "EventResponse": "{\"Action\":\"Add NotificationRecipient\",\"FirstName\":\"Fname\",\"LastName\":\"Lname\",\"Email\":\"john.doe@email.com\",\"Partner\":\"dell2\",\"AddedBy\":\"john.doe@email.com\"}",       
    "EventTime": "2021-01-25 09:37:01.505980988 +0000 UTC m=+1421.228517562"  
    } 
}  

The following table includes console operations recorded in the console audit log. The Event name column displays the names inside the console audit log as an eventname parameter value.

The following table describes the parameters specified in the console audit log file.

Status code

The following tables provide descriptions for the StatusCode parameter.

Example of an IAM audit log

The following is an example of an IAM audit log file.

{  
"created_date":"2021-01-20T02:04:12.000Z",  
"organization":"random-org",  
"org_type":"TENANT",  
"source":"console",  
"created_by"::"IAM",  
"content":{    
    "date": "2016-02-23T19:57:29.532Z",    
    "type": "sapi",    
    "description": "",    
    "connection": "",    
    "connection_id": "",    
    "client_id": "AaiyAPdpYdesoKnqjj8HJqRn4T5titww",    
    "client_name": "My application Name",    
    "ip": "190.257.209.19",    
    "hostname": "190.257.209.19",    
    "user_id": "auth0|56c75c4e42b6359e98374bc2",    
    "user_name": "",    
    "audience": "",    
    "scope": "",    
    "strategy": "",    
    "strategy_type": "",    
    "log_id": "",    
    "isMobile": false,    
    "details": {},    
    "user_agent": "",    
    "location_info": {      
    "country_code": "",      
    "country_code3": "",      
    "country_name": "",      
    "city_name": "",      
    "latitude": "",      
    "longitude": "",      
    "time_zone": "",      
    "continent_code": ""     
    }  
  }  
"bucket_name":""
}

The following is an example of an IAM audit log file.

The following table describes the data field for contents in the IAM audit log file.

The following table describes the data field for location_info.

The following table describes the event code associated with each log event.

Enable account audit logs

To enable the account audit log:

1. On the left-hand menu, select Settings.
2. On the Settings page, set Account Audit Logs to ON.
3. in the Audit Log Target Bucket dialog, select the target bucket from the list to store the logs.
   
   You must set the target bucket only if you are setting the target bucket to write audit logs for the first time. However, if you have set the target bucket while enabling S3 API audit logs, you are not forced to select the target bucket again.
   
   Only the buckets that are in immutable are displayed in the list.
4. Select Save.

Disable account audit logs

To disable account audit logs:

1. On the left-hand menu, select Settings.
2. On the Settings page, set Account Audit Logs to OFF.

After you disable audit logs:

• Logs are no longer saved to the target bucket.
• The target bucket is still visible in the Audit Logs Target Bucket section.

Edit audit log target bucket

While editing the target bucket to save audit logs, only immutable buckets are displayed for selection.

To edit console audit logs:

1. On the left-hand menu, select Settings.
2. In the Audit Log Target Bucket section, select Edit.

3. On the Edit Audit Log Target Bucket dialog, select the target bucket from the Select bucket list and then select Save.