日志记录和审核日志记录（LOG 和 AL）

审核日志源

接受审核的操作

使用监控实例的界面运行 LogQL 查询或导出日志

审核日志源

代理服务器
日志类型

数据平面
包含审核信息的日志条目中的字段
审核元数据 审核字段名称 值
用户或服务身份 user

例如，

"user": {
  "issuer": "https://ais-core.org-1.zone1.google.gdch.test",
  "identity": "fop-infrastructure-operator@example.com"
  }

目标

（调用 API 的字段和值）

 resource

例如，

"resource": "/infra-obs/grafana/api/ds/query"

操作

（包含所执行操作的字段）

 action

可能的值：

  • "action": "QUERY"
  • "action": "CREATE"
  • "action": "READ"
  • "action": "UPDATE"
  • "action": "DELETE"
  • "action": "CREATE/UPDATE"
活动时间戳 time

例如，

"time": "2022-12-02T21:37:03.657277582Z"

操作来源
  • sourceIPs
  • _gdch_service_name

例如，

"sourceIPs": [
  [
  "10.253.165.26",
  "127.0.0.6"
],
"_gdch_service_name": "grafana"

结果 response

例如，

"response": "Successful: 200 OK"
其他字段 description description 值包含完整的查询。如需了解详情，请参阅示例日志。

日志示例

{
  "sourceIPs": [
    "10.253.165.26",
    "127.0.0.6"
  ],
  "description": "{
    \"queries\":
      [{
        \"refId\":\"A\",
        \"datasource\":
          {
            \"uid\":\"P762A5DD6F13C8B7A\",
            \"type\":\"loki\"
          },
        \"editorMode\":\"builder\",
        \"expr\":\"{service_name=\\\"grafana\\\"} |= ``\",
        \"queryType\":\"range\",
        \"key\":\"Q-fd978c0c-86fd-4c70-bb38-07737a3be3ad-0\",
        \"maxLines\":1000,
        \"legendFormat\":\"\",
        \"datasourceId\":3,
        \"intervalMs\":500,
        \"maxDataPoints\":1688
      }],
    \"range\":
      {
        \"from\":\"2022-12-02T21:22:03.496Z\",
        \"to\":\"2022-12-02T21:37:03.496Z\",
        \"raw\":{\"from\":\"now-15m\",\"to\":\"now\"}
      },
    \"from\":\"1670016123496\",
    \"to\":\"1670017023496\"
  }",
  "response": "Successful: 200 OK",
  "_gdch_namespace": "infra-obs-obs-system",
  "numBytesSent": 190079,
  "time": "2022-12-02T21:37:03.657277582Z",
  "user": {
    "issuer": "https://ais-core.org-1.zone1.google.gdch.test",
    "identity": "fop-infrastructure-operator@example.com"
  },
  "_gdch_service_name": "grafana",
  "_gdch_service_tenant": "infra-obs",
  "numBytesReceived": 3172,
  "resource": "/infra-obs/grafana/api/ds/query",
  "auditID": "b519ec65-d906-4a79-bcfe-a4e1984045fe",
  "action": "QUERY",
  "_gdch_cluster": "org-1-admin",
  "_gdch_fluentbit_pod": "anthos-audit-logs-forwarder-9x9pd"
}

对 LoggingTarget 自定义资源执行操作

审核日志源

Kubernetes 审核日志
日志类型

控制平面
包含审核信息的日志条目中的字段
审核元数据 审核字段名称 值
用户或服务身份 user

例如，

"user": {
    "extra": {
        "authentication.kubernetes.io/pod-name": [
            "fleet-admin-controller-875778d98-99l6n"
        ],
        "authentication.kubernetes.io/pod-uid": [
            "4800e06c-c96d-4e17-ae1a-b5a74eedf6ee"
        ]
    },
    "uid": "b18e586e-db0e-417e-9dff-1a722ab36bf4",
    "username": "system:serviceaccount:gpc-system:fleet-admin-controller",
    "groups": [
        "system:serviceaccounts",
        "system:serviceaccounts:gpc-system",
        "system:authenticated"
    ]
}

目标

（调用 API 的字段和值）
  • requestURI
  • objectRef

例如，

"requestURI": "/apis/logging.gdc.goog/v1/namespaces/obs-system/loggingtargets/lt-cfg1",
"objectRef": {
    "uid": "2e540720-ed23-4665-8c40-c399cb6be624",
    "namespace": "obs-system",
    "name": "lt-cfg1",
    "resource": "loggingtargets",
    "apiVersion": "v1",
    "apiGroup": "logging.gdc.goog",
    "resourceVersion": "5326570"
}

操作

（包含所执行操作的字段）

 verb

可能的值：

  • "verb": "create"
  • "verb": "delete"
  • "verb": "get"
  • "verb": "list"
  • "verb": "patch"
  • "verb": "update"
  • "verb": "watch"
活动时间戳 requestReceivedTimestamp

例如，

"requestReceivedTimestamp": "2022-12-06T14:37:41.035715Z"

操作来源
  • sourceIPs
  • _gdch_service_name

例如，

"sourceIPs": [
    "10.253.164.209"
],
"_gdch_service_name": "apiserver"

结果 responseStatus

例如，

"responseStatus": {
    "metadata": {},
    "code": 200
}

其他字段 不适用 不适用

日志示例

{
  "level": "Metadata",
  "auditID": "94c2106f-1fd1-428b-adbc-80ac48ef479e",
  "_gdch_cluster": "org-1-admin",
  "requestURI": "/apis/logging.gdc.goog/v1/namespaces/obs-system/loggingtargets/lt-cfg1",
  "_gdch_fluentbit_pod": "anthos-audit-logs-forwarder-4gwpn",
  "verb": "update",
  "userAgent": "fleet-admin-cm/v0.0.0 (linux/amd64) kubernetes/$Format",
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "user": {
    "extra": {
      "authentication.kubernetes.io/pod-name": [
        "fleet-admin-controller-875778d98-99l6n"
      ],
      "authentication.kubernetes.io/pod-uid": [
        "4800e06c-c96d-4e17-ae1a-b5a74eedf6ee"
      ]
    },
    "uid": "b18e586e-db0e-417e-9dff-1a722ab36bf4",
    "username": "system:serviceaccount:gpc-system:fleet-admin-controller",
    "groups": [
      "system:serviceaccounts",
      "system:serviceaccounts:gpc-system",
      "system:authenticated"
    ]
  },
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"fleet-admin-common-controller\" of ClusterRole \"fleet-admin-common-controllers-role\" to ServiceAccount \"fleet-admin-controller/gpc-system\""
  },
  "sourceIPs": [
    "10.253.164.209"
  ],
  "stage": "ResponseComplete",
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "stageTimestamp": "2022-12-06T14:37:41.035715Z",
  "objectRef": {
    "uid": "2e540720-ed23-4665-8c40-c399cb6be624",
    "namespace": "obs-system",
    "name": "lt-cfg1",
    "resource": "loggingtargets",
    "apiVersion": "v1",
    "apiGroup": "logging.gdc.goog",
    "resourceVersion": "5326570"
  },
  "requestReceivedTimestamp": "2022-12-06T14:37:40.942762Z",
  "_gdch_service_name": "apiserver"
}

对 AuditLoggingTarget 自定义资源执行操作

审核日志源

Kubernetes 审核日志
日志类型

控制平面
包含审核信息的日志条目中的字段
审核元数据 审核字段名称 值
用户或服务身份 user

例如，

"user": {
    "groups": [
        "system:masters",
        "system:authenticated"
    ],
    "username": "kubernetes-admin"
}

目标

（调用 API 的字段和值）
  • requestURI
  • objectRef

例如，

"requestURI": "/apis/logging.private.gdc.goog/v1/namespaces/obs-system/auditloggingtargets/audit-logging-config-qwerty",
"objectRef": {
    "name": "audit-logging-config-qwerty",
    "namespace": "obs-system",
    "resource": "auditloggingtargets",
    "apiGroup": "logging.private.gdc.goog",
    "apiVersion": "v1"
}

操作

（包含所执行操作的字段）

 verb

可能的值：

  • "verb": "create"
  • "verb": "delete"
  • "verb": "get"
  • "verb": "list"
  • "verb": "patch"
  • "verb": "update"
  • "verb": "watch"
活动时间戳 requestReceivedTimestamp

例如，

"requestReceivedTimestamp": "2022-12-05T19:09:56.861278Z"

操作来源
  • sourceIPs
  • _gdch_service_name

例如，

"sourceIPs": [
    "10.200.0.7"
],
"_gdch_service_name": "apiserver"

结果 responseStatus

例如，

"responseStatus": {
    "metadata": {},
    "code": 200
}

其他字段 不适用 不适用

日志示例

{
    "level": "Metadata",
    "auditID": "1fd8d531-c488-4478-8341-47346b1b6eda",
    "stageTimestamp": "2022-12-05T19:09:56.861278Z",
    "stage": "RequestReceived",
    "_gdch_cluster": "org-1-admin",
    "verb": "delete",
    "_gdch_fluentbit_pod": "anthos-audit-logs-forwarder-56tbb",
    "requestReceivedTimestamp": "2022-12-05T19:09:56.861278Z",
    "objectRef": {
        "name": "audit-logging-config-qwerty",
        "namespace": "obs-system",
        "resource": "auditloggingtargets",
        "apiGroup": "logging.private.gdc.goog",
        "apiVersion": "v1"
    },
    "user": {
        "groups": [
            "system:masters",
            "system:authenticated"
        ],
        "username": "kubernetes-admin"
    },
    "sourceIPs": [
        "10.200.0.7"
    ],
    "kind": "Event",
    "userAgent": "k9s/v0.0.0 (linux/amd64) kubernetes/$Format",
    "apiVersion": "audit.k8s.io/v1",
    "requestURI": "/apis/logging.private.gdc.goog/v1/namespaces/obs-system/auditloggingtargets/audit-logging-config-qwerty",
    "_gdch_service_name": "apiserver"
}

对 LoggingRule 自定义资源执行操作

审核日志源

Kubernetes 审核日志
日志类型

控制平面
包含审核信息的日志条目中的字段
审核元数据 审核字段名称 值
用户或服务身份 user

例如，

"user": {
    "extra": {
        "authentication.kubernetes.io/pod-name": [
            "fleet-admin-controller-875778d98-99l6n"
        ],
        "authentication.kubernetes.io/pod-uid": [
            "4800e06c-c96d-4e17-ae1a-b5a74eedf6ee"
        ]
    },
    "uid": "b18e586e-db0e-417e-9dff-1a722ab36bf4",
    "username": "system:serviceaccount:gpc-system:fleet-admin-controller",
    "groups": [
        "system:serviceaccounts",
        "system:serviceaccounts:gpc-system",
        "system:authenticated"
    ]
}

目标

（调用 API 的字段和值）
  • requestURI
  • objectRef

例如，

"requestURI": "/apis/logging.gdc.goog/v1/namespaces/obs-system/loggingrules/lr-cfg1",
"objectRef": {
    "uid": "2e540720-ed23-4665-8c40-c399cb6be624",
    "namespace": "obs-system",
    "name": "lr-cfg1",
    "resource": "loggingrules",
    "apiVersion": "v1",
    "apiGroup": "logging.gdc.goog",
    "resourceVersion": "5326570"
}

操作

（包含所执行操作的字段）

 verb

可能的值：

  • "verb": "create"
  • "verb": "delete"
  • "verb": "get"
  • "verb": "list"
  • "verb": "patch"
  • "verb": "update"
  • "verb": "watch"
活动时间戳 requestReceivedTimestamp

例如，

"requestReceivedTimestamp": "2022-12-06T14:37:41.035715Z"

操作来源
  • sourceIPs
  • _gdch_service_name

例如，

"sourceIPs": [
    "10.253.164.209"
],
"_gdch_service_name": "apiserver"

结果 responseStatus

例如，

"responseStatus": {
    "metadata": {},
    "code": 200
}

其他字段 不适用 不适用

日志示例

{
  "level": "Metadata",
  "auditID": "94c2106f-1fd1-428b-adbc-80ac48ef479e",
  "_gdch_cluster": "org-1-admin",
  "requestURI": "/apis/logging.gdc.goog/v1/namespaces/obs-system/loggingrules/lr-cfg1",
  "_gdch_fluentbit_pod": "anthos-audit-logs-forwarder-4gwpn",
  "verb": "update",
  "userAgent": "fleet-admin-cm/v0.0.0 (linux/amd64) kubernetes/$Format",
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "user": {
    "extra": {
      "authentication.kubernetes.io/pod-name": [
        "fleet-admin-controller-875778d98-99l6n"
      ],
      "authentication.kubernetes.io/pod-uid": [
        "4800e06c-c96d-4e17-ae1a-b5a74eedf6ee"
      ]
    },
    "uid": "b18e586e-db0e-417e-9dff-1a722ab36bf4",
    "username": "system:serviceaccount:gpc-system:fleet-admin-controller",
    "groups": [
      "system:serviceaccounts",
      "system:serviceaccounts:gpc-system",
      "system:authenticated"
    ]
  },
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"fleet-admin-common-controller\" of ClusterRole \"fleet-admin-common-controllers-role\" to ServiceAccount \"fleet-admin-controller/gpc-system\""
  },
  "sourceIPs": [
    "10.253.164.209"
  ],
  "stage": "ResponseComplete",
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "stageTimestamp": "2022-12-06T14:37:41.035715Z",
  "objectRef": {
    "uid": "2e540720-ed23-4665-8c40-c399cb6be624",
    "namespace": "obs-system",
    "name": "lr-cfg1",
    "resource": "loggingrules",
    "apiVersion": "v1",
    "apiGroup": "logging.gdc.goog",
    "resourceVersion": "5326570"
  },
  "requestReceivedTimestamp": "2022-12-06T14:37:40.942762Z",
  "_gdch_service_name": "apiserver"
}

对 ObservabilityPipeline 自定义资源执行操作

审核日志源

Kubernetes 审核日志
日志类型

控制平面
包含审核信息的日志条目中的字段
审核元数据 审核字段名称 值
用户或服务身份 user

例如，

"user": {
    "username": "kubernetes-admin",
    "groups": [
        "system:masters",
        "system:authenticated"
    ]
}

目标

（调用 API 的字段和值）
  • requestURI
  • objectRef

例如，

"requestURI": "/apis/observability.gdc.goog/v1/namespaces/obs-system/observabilitypipelines/default",
"objectRef": {
    "apiGroup": "observability.gdc.goog",
    "apiVersion": "v1",
    "name": "default",
    "resource": "observabilitypipelines",
    "namespace": "obs-system"
}

操作

（包含所执行操作的字段）

 verb

可能的值：

  • "verb": "create"
  • "verb": "delete"
  • "verb": "get"
  • "verb": "list"
  • "verb": "patch"
  • "verb": "update"
  • "verb": "watch"
活动时间戳 requestReceivedTimestamp

例如，

"requestReceivedTimestamp": "2022-12-06T14:58:03.742024Z"

操作来源
  • sourceIPs
  • _gdch_service_name

例如，

"sourceIPs": [
    "10.200.0.7"
],
"_gdch_service_name": "apiserver"

结果 responseStatus

例如，

"responseStatus": {
    "metadata": {},
    "code": 200
}

其他字段 不适用 不适用

日志示例

{
    "_gdch_fluentbit_pod": "anthos-audit-logs-forwarder-sff9t",
    "requestURI": "/apis/observability.gdc.goog/v1/namespaces/obs-system/observabilitypipelines/default",
    "stage": "RequestReceived",
    "verb": "get",
    "user": {
        "username": "kubernetes-admin",
        "groups": [
            "system:masters",
            "system:authenticated"
        ]
    },
    "objectRef": {
        "apiGroup": "observability.gdc.goog",
        "apiVersion": "v1",
        "name": "default",
        "resource": "observabilitypipelines",
        "namespace": "obs-system"
    },
    "requestReceivedTimestamp": "2022-12-06T14:58:03.742024Z",
    "stageTimestamp": "2022-12-06T14:58:03.742024Z",
    "level": "Metadata",
    "auditID": "f5a473cf-65c9-4706-aa0e-e657c9f308f7",
    "_gdch_cluster": "org-1-admin",
    "userAgent": "kubectl/v1.25.4 (linux/amd64) kubernetes/872a965",
    "sourceIPs": [
        "10.200.0.7"
    ],
    "kind": "Event",
    "apiVersion": "audit.k8s.io/v1",
    "_gdch_service_name": "apiserver"
}