8000 audit: how can I programmatically consume the audit logs? · Issue #5535 · coder/coder · GitHub
[go: up one dir, main page]

Skip to content
audit: how can I programmatically consume the audit logs? #5535
Closed as not planned
@bpmct

Description

@bpmct

We need to document this :)

  • REST API: @mtojek is working on autogenerated docs for all the routes, including /api/v2/audit

    Tracked in Autogenerated docs for REST API #3522. For example:

    https://coder.bpmct.net/api/v2/audit?offset=0&limit=25&q=resource_type%3Auser+action%3Acreate
    

    Documented here: https://coder.com/docs/coder-oss/latest/api/audit#get-audit-logs

  • Server logs: coder server will export audited events to /dev/stderr by default

    For example:

    2023-01-02 14:07:48.634 [INFO]	(coderd)	<./enterprise/audit/backends/slog.go:32>	slogBackend.Export	audit_log	{"ID": "4fa877ad-92e5-425d-8aba-7b66bb7c01d2", "Action": "create", "Diff": {"id": {"Old": "", "New": "fb1c1df2-4d9a-44df-b606-abc4ec6d5ee5", "Secret": false}, "name": {"Old": "", "New": "new-workspace", "Secret": false}, "owner_id": {"Old": "", "New": "eaef1d37-125b-4b73-b05d-33401230baca", "Secret": false}, "template_id": {"Old": "", "New": "f5ceaa98-fe3a-4103-b0fb-15d7d340f2ad", "Secret": false}, "ttl": {"Old": 0, "New": 86400000000000, "Secret": false}}, "RequestID": "c210f24c-3a1c-4770-ad0c-8d13ceae9cf2", "UserAgent": {"String": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36", "Valid": true}, "ResourceID": "fb1c1df2-4d9a-44df-b606-abc4ec6d5ee5", "OrganizationID": "00000000-0000-0000-0000-000000000000", "ResourceTarget": "new-workspace", "ResourceIcon": "", "Time": "2023-01-02T14:07:48.632729Z", "UserID": "eaef1d37-125b-4b73-b05d-33401230baca", "Ip": {"IPNet": {"IP": "::1", "Mask": "/////////////////////w=="}, "Valid": true}, "ResourceType": "workspace", "StatusCode": 201, "AdditionalFields": {"workspaceOwner": "bpmct"}}

    In Coder v1, we have detailed documentation on exporting logs so we can use that as a reference.

Metadata

Metadata

Assignees

Labels

staleThis issue is like stale bread.

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions

    0