Audit
Who changed what on this engine, and how it went, newest first. Every change reaches the engine through its API, whether it comes from the web UI, the command-line client or a stack inside its VM, and each one is recorded there:
- When, and who: the account that signed in, and the account it acted as when it had switched to another.
- From: the web UI, the CLI, a VM, the engine itself or a node, with the address the request came from.
- What: the resource, the action and the thing acted on, such as a VM, a network or an account.
- Result: whether it went through, and what the engine answered.
Opening a row shows the request as it was sent, with passwords, passphrases, two-factor codes and keys taken out. Sign-in attempts are recorded too, by the name tried, so failed attempts show up as well.
What is not recorded: reads, which change nothing; what the compute nodes report; and what passes through to a stack's own management pages, which is that stack's business.
Consoles and terminals are recorded as sessions: a VM's console, and a node's terminal or serial console. A row is written when one opens, saying who opened it on which VM or node, and is filled in when it closes: how long it lasted, how much went each way, and how it ended. Attempts that are refused are recorded too. What is typed in a session, and what it shows, is not.
What the engine and the nodes do out of sight is recorded too, as the engine or the node: a VM paused for a backup and resumed after it - or one that would not pause - and how each image's backup went.
The engine records what it does by itself as well: its daily backup, accounts it took from the registry, and DNS names it removed.
Who sees what
An administrator sees every change on the engine. Anyone else sees the changes they made, and those made as their account.
How long it is kept
400 days unless Engine settings say otherwise; older rows are dropped once a day. The log can also go to a syslog server as it is written, set there too.
Clearing it
An administrator can clear the audit log - all of it, or from the command line just the rows older than a given age - where Engine settings allow it, which they do not until switched on. The Audit tab then has Clear. That the log was cleared, and by whom, is the first row of what follows. What already went to syslog is not cleared there.
From the command line
keal audit # the latest 50
keal audit --since 7d --what servers
keal audit --failed --from cli
keal audit --on <uuid> # what was done to one VM, network or image
keal audit clear --older-than 90d # administrators, where it is allowed