docs/doc/source/security/kubernetes/operator-command-logging.rst

Operator Command Logging

logs all REST API operator commands and SNMP commands.

The logs include the timestamp, tenant name (if applicable), user name, command executed, and command status (success or failure).

The files are located under the /var/log directory, and are named using the convention *-api.log. Each component that generates its own API log files (for example, Keystone, Barbican, and so forth) and each / StarlingX -specific component, updating (patching) system, and SNMP agent follows, this convention.

You can examine the log files locally on the controllers, or using a remote log server if the remote logging feature is configured. The one exception is patching-api.log. For updating robustness, the updating system uses minimal system facilities and does not use syslog. Therefore its logs are not available on a remote log server.

Remarks

• For the system command, whenever a REST API call is made that is either a POST, PATCH, PUT, or DELETE, logs these events into a new log file called /var/log/sysinv-api.log

  • POST - means creating something
  • PATCH - means partially updating (modifying) something
  • PUT - means fully updating (modifying) something
  • DELETE - means deleting something

  system modify --description="A TEST" is logged to sysinv-api.log because it issues a REST POST call

  system snmp-comm-delete "TEST_COMMUNITY1" - is logged to sysinv-api.log because it issues a REST DELETE call

• If the sysinv command only issues a REST GET call, it is not logged.

  • fm event-list is not logged because this performs a sysinv REST GET call
  • fm event-show<xx> is not logged because this performs a sysinv REST GET call

• All SNMP Commands are logged, including GET, GETNEXT, GETBULK and SET commands. SNMP TRAPs are not logged.