(+matt) On Fri, Dec 15, 2017 at 7:21 PM, David Turner <drakonstein@xxxxxxxxx> wrote: > We're trying to build an auditing system for when a user key pair performs > an operation on a bucket (put, delete, creating a bucket, etc) and so far > were only able to find this information in the level 10 debug logging in the > rgw systems logs. Yeah, there's no readily available single log line for that currently. Log level 2 has the operation type and the resource, so you're missing the cross reference to the user. This might not be too complicated to add, so maybe someone would like to try implementing that. This will need to fit with the whole identity work that Matt's team is currently working on. > > We noticed that our rgw log pool has been growing somewhat indefinitely and > we had to move it off of the nvme's and put it to HDD's due to it's growing > size. What is in that pool and how can it be accessed? I haven't found the > right terms to search for to find anything about what's in this pool on the > ML or on Google. The log pool contains data for multiple different rgw functionalities: garbage collector, lifecycle, multisite sync, usage logging. Some of it is being stored in separate rados namespaces, so you need to run 'rados ls -p <pool> --all' to see all the objects there. > > What I would like to do is export the log to ElasticSearch, cleanup the log > on occasion, and hopefully find the information we're looking for to fulfill > our user auditing without having our RGW daemons running on debug level 10 > (which is a lot of logging!). Have you looked at the usage logging? Yehuda _______________________________________________ ceph-users mailing list ceph-users@xxxxxxxxxxxxxx http://lists.ceph.com/listinfo.cgi/ceph-users-ceph.com
 |