Audit log

Тarantool Cluster Manager provides the audit logging functionality for tracking user activity and security-related events, such as:

• Successful and failed login attempts.
• Access to clusters, their configurations, data models, and stored data.
• Changes in the access control system: users, roles, passwords, LDAP configurations.

The complete list of TCM audit events is provided in Event types.

Audit logging is disabled in TCM by default. To start recording events, you need to enable and configure it.

The audit log stores event details in the JSON format. Each log entry contains the event type, description, time, impacted objects, and other information that may be used for incident investigation. The complete list of fields is provided in Structure of audit log events.

TCM also provides a built-in interface for reading and searching the audit log. For details, see Viewing audit log.

You can enable and configure the audit log in two ways:

• in the TCM UI
• in the TCM configuration YAML file

To enable audit logging in TCM UI, go to Audit settings and click Enable. To additionally send audit log events to the standard output, click Send to stdout.

You can also pre-configure audit logging during the first TCM launch by setting options in the TCM configuration file (tcm.yaml) through the initial-settings.auditlog parameter.

TCM audit events can be logged to a local file or sent to a syslog server. To configure audit logging, go to Audit settings.

To write TCM audit logs to a file:

1. Go to Audit settings and select the file protocol.
2. Specify the name of the audit log file. The file will be saved in the directory specified by the user, which can be either absolute or relative. The file appears in the TCM working directory.
3. Configure the log files rotation: the maximum file size and age, and the number of files to store simultaneously.
4. (Optional) Enable compression of audit log files.

Configuration parameters:

• Output file name. The name of the audit log file. Default: audit.log
• Max size (in MB). The maximum size of the log file before it gets rotated, in megabytes. Default: 100.
• Max backups. The maximum number of stored audit log files. Default: 10.
• Max age (in days). The maximum age of audit log files in days. Default: 30.
• Compress. Compress audit log files into gzip archives when rotating.

If you use a centralized log management system based on syslog, you can configure TCM to send its audit log to your syslog server:

1. Go to Audit settings and select the syslog protocol.
2. Enter the syslog server URI and select the network protocol. Typically, syslogd listens on port 514 and uses the UDP protocol.
3. Specify the syslog logging parameters: timeout, priority, and facility.

Configuration parameters:

• Protocol. The network protocol used for connecting to the syslog server. Default: udp.
• Output. The syslog server URI. Default: 127.0.0.1:514 (localhost).
• Timeout. The syslog write timeout in the ISO 8601 duration format. Default: PT2S (two seconds).
• Priority. The syslog severity level. Default: info.
• Facility. The syslog facility. Default: local0.

When the audit log is enabled, TCM records all audit events listed in Event types. To decrease load and make the audit log comply with specific security requirements, you can record only selected events. For example, these can be events of user account management or events of cluster data access.

To select events to record into the audit log, go to Audit settings and enter their types into the Filters field one-by-one, pressing the Enter key after each type.

To remove an event type from a filters list, click the cross icon beside it.

If the audit log is written to a file, you can view it in TCM on the Audit log page. On this page, you can view or search for events.

To view the details of a logged audit event, click the corresponding line in the table.

To search for an event, use the search bar at the top of the page. Note that the search is case-sensitive. For example, to find events with the ALARM severity, enter ALARM, not alarm.

All entries of the TCM audit log include the mandatory fields listed in the table below.

This is an example of an audit log entry on a successful login attempt:

 
{    "time": "2023-11-23T12:01:27.247+07:00",    "severity": "INFO",    "description": "Login user",    "type": "current.login",    "uuid": "4b9c2dd1-d9a1-4b40-a448-6bef4a0e5c79",    "user": "",    "remote": "127.0.0.1:63370",    "user-agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36",    "host": "127.0.0.1:8080",    "permissions": ,    "result": "ok",    "fields": [        {            "Key": "username",            "Value": "admin"        },        {            "Key": "method",            "Value": "null"        },        {            "Key": "output",            "Value": "true"        }    ]}

The following table lists all possible values of the type field of TCM audit log events.