此页面由 Cloud Translation API 翻译。

日志记录和审核日志记录（LOG 和 AL）

审核日志源	可观测性审核日志记录器 Kubernetes 审核日志
接受审核的操作	使用监控实例的界面运行 LogQL 查询或导出日志对 `LoggingTarget` 自定义资源执行操作对 `LoggingRule` 自定义资源执行操作对 `SIEMOrgForwarder` 自定义资源执行操作

使用监控实例的界面运行 LogQL 查询或导出日志

审核日志源	代理服务器
日志类型	数据平面

包含审核信息的日志条目中的字段
审核元数据	审核字段名称	值
用户或服务身份	`user`	例如， "user": { "issuer": "https://ais-core.org-1.zone1.google.gdch.test", "identity": "fop-infrastructure-operator@example.com" }
目标（调用 API 的字段和值）	`resource`	例如， `"resource": "/infra-obs/grafana/api/ds/query"`
操作（包含所执行操作的字段）	`action`	可能的值： `"action": "QUERY"` `"action": "CREATE"` `"action": "READ"` `"action": "UPDATE"` `"action": "DELETE"` `"action": "CREATE/UPDATE"`
活动时间戳	`time`	例如， `"time": "2022-12-02T21:37:03.657277582Z"`
操作来源	`sourceIPs` `_gdch_service_name`	例如， "sourceIPs": [ [ "10.253.165.26", "127.0.0.6" ], "_gdch_service_name": "grafana"
结果	`response`	例如， `"response": "Successful: 200 OK"`
其他字段	`description`	`description` 值包含完整的查询。如需了解详情，请参阅示例日志。

日志示例

{
  "sourceIPs": [
    "10.253.165.26",
    "127.0.0.6"
  ],
  "description": "{
    \"queries\":
      [{
        \"refId\":\"A\",
        \"datasource\":
          {
            \"uid\":\"P762A5DD6F13C8B7A\",
            \"type\":\"loki\"
          },
        \"editorMode\":\"builder\",
        \"expr\":\"{service_name=\\\"grafana\\\"} |= ``\",
        \"queryType\":\"range\",
        \"key\":\"Q-fd978c0c-86fd-4c70-bb38-07737a3be3ad-0\",
        \"maxLines\":1000,
        \"legendFormat\":\"\",
        \"datasourceId\":3,
        \"intervalMs\":500,
        \"maxDataPoints\":1688
      }],
    \"range\":
      {
        \"from\":\"2022-12-02T21:22:03.496Z\",
        \"to\":\"2022-12-02T21:37:03.496Z\",
        \"raw\":{\"from\":\"now-15m\",\"to\":\"now\"}
      },
    \"from\":\"1670016123496\",
    \"to\":\"1670017023496\"
  }",
  "response": "Successful: 200 OK",
  "_gdch_namespace": "infra-obs-obs-system",
  "numBytesSent": 190079,
  "time": "2022-12-02T21:37:03.657277582Z",
  "user": {
    "issuer": "https://ais-core.org-1.zone1.google.gdch.test",
    "identity": "fop-infrastructure-operator@example.com"
  },
  "_gdch_service_name": "grafana",
  "_gdch_service_tenant": "infra-obs",
  "numBytesReceived": 3172,
  "resource": "/infra-obs/grafana/api/ds/query",
  "auditID": "b519ec65-d906-4a79-bcfe-a4e1984045fe",
  "action": "QUERY",
  "_gdch_cluster": "org-1-admin",
  "_gdch_fluentbit_pod": "anthos-audit-logs-forwarder-9x9pd"
}

对 `LoggingTarget` 自定义资源执行操作

审核日志源	Kubernetes 审核日志
日志类型	控制平面

包含审核信息的日志条目中的字段
审核元数据	审核字段名称	值
用户或服务身份	`user`	例如， "user": { "extra": { "authentication.kubernetes.io/pod-name": [ "fleet-admin-controller-875778d98-99l6n" ], "authentication.kubernetes.io/pod-uid": [ "4800e06c-c96d-4e17-ae1a-b5a74eedf6ee" ] }, "uid": "b18e586e-db0e-417e-9dff-1a722ab36bf4", "username": "system:serviceaccount:gpc-system:fleet-admin-controller", "groups": [ "system:serviceaccounts", "system:serviceaccounts:gpc-system", "system:authenticated" ] }
目标（调用 API 的字段和值）	`requestURI` `objectRef`	例如， "requestURI": "/apis/logging.gdc.goog/v1/namespaces/obs-system/loggingtargets/lt-cfg1", "objectRef": { "uid": "2e540720-ed23-4665-8c40-c399cb6be624", "namespace": "obs-system", "name": "lt-cfg1", "resource": "loggingtargets", "apiVersion": "v1", "apiGroup": "logging.gdc.goog", "resourceVersion": "5326570" }
操作（包含所执行操作的字段）	`verb`	可能的值： `"verb": "create"` `"verb": "delete"` `"verb": "get"` `"verb": "list"` `"verb": "patch"` `"verb": "update"` `"verb": "watch"`
活动时间戳	`requestReceivedTimestamp`	例如， `"requestReceivedTimestamp": "2022-12-06T14:37:41.035715Z"`
操作来源	`sourceIPs` `_gdch_service_name`	例如， "sourceIPs": [ "10.253.164.209" ], "_gdch_service_name": "apiserver"
结果	`responseStatus`	例如， "responseStatus": { "metadata": {}, "code": 200 }
其他字段	不适用	不适用

日志示例

{
  "level": "Metadata",
  "auditID": "94c2106f-1fd1-428b-adbc-80ac48ef479e",
  "_gdch_cluster": "org-1-admin",
  "requestURI": "/apis/logging.gdc.goog/v1/namespaces/obs-system/loggingtargets/lt-cfg1",
  "_gdch_fluentbit_pod": "anthos-audit-logs-forwarder-4gwpn",
  "verb": "update",
  "userAgent": "fleet-admin-cm/v0.0.0 (linux/amd64) kubernetes/$Format",
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "user": {
    "extra": {
      "authentication.kubernetes.io/pod-name": [
        "fleet-admin-controller-875778d98-99l6n"
      ],
      "authentication.kubernetes.io/pod-uid": [
        "4800e06c-c96d-4e17-ae1a-b5a74eedf6ee"
      ]
    },
    "uid": "b18e586e-db0e-417e-9dff-1a722ab36bf4",
    "username": "system:serviceaccount:gpc-system:fleet-admin-controller",
    "groups": [
      "system:serviceaccounts",
      "system:serviceaccounts:gpc-system",
      "system:authenticated"
    ]
  },
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"fleet-admin-common-controller\" of ClusterRole \"fleet-admin-common-controllers-role\" to ServiceAccount \"fleet-admin-controller/gpc-system\""
  },
  "sourceIPs": [
    "10.253.164.209"
  ],
  "stage": "ResponseComplete",
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "stageTimestamp": "2022-12-06T14:37:41.035715Z",
  "objectRef": {
    "uid": "2e540720-ed23-4665-8c40-c399cb6be624",
    "namespace": "obs-system",
    "name": "lt-cfg1",
    "resource": "loggingtargets",
    "apiVersion": "v1",
    "apiGroup": "logging.gdc.goog",
    "resourceVersion": "5326570"
  },
  "requestReceivedTimestamp": "2022-12-06T14:37:40.942762Z",
  "_gdch_service_name": "apiserver"
}

对 `LoggingRule` 自定义资源执行操作

审核日志源	Kubernetes 审核日志
日志类型	控制平面

包含审核信息的日志条目中的字段
审核元数据	审核字段名称	值
用户或服务身份	`user`	例如， "user": { "extra": { "authentication.kubernetes.io/pod-name": [ "fleet-admin-controller-875778d98-99l6n" ], "authentication.kubernetes.io/pod-uid": [ "4800e06c-c96d-4e17-ae1a-b5a74eedf6ee" ] }, "uid": "b18e586e-db0e-417e-9dff-1a722ab36bf4", "username": "system:serviceaccount:gpc-system:fleet-admin-controller", "groups": [ "system:serviceaccounts", "system:serviceaccounts:gpc-system", "system:authenticated" ] }
目标（调用 API 的字段和值）	`requestURI` `objectRef`	例如， "requestURI": "/apis/logging.gdc.goog/v1/namespaces/obs-system/loggingrules/lr-cfg1", "objectRef": { "uid": "2e540720-ed23-4665-8c40-c399cb6be624", "namespace": "obs-system", "name": "lr-cfg1", "resource": "loggingrules", "apiVersion": "v1", "apiGroup": "logging.gdc.goog", "resourceVersion": "5326570" }
操作（包含所执行操作的字段）	`verb`	可能的值： `"verb": "create"` `"verb": "delete"` `"verb": "get"` `"verb": "list"` `"verb": "patch"` `"verb": "update"` `"verb": "watch"`
活动时间戳	`requestReceivedTimestamp`	例如， `"requestReceivedTimestamp": "2022-12-06T14:37:41.035715Z"`
操作来源	`sourceIPs` `_gdch_service_name`	例如， "sourceIPs": [ "10.253.164.209" ], "_gdch_service_name": "apiserver"
结果	`responseStatus`	例如， "responseStatus": { "metadata": {}, "code": 200 }
其他字段	不适用	不适用

日志示例

{
  "level": "Metadata",
  "auditID": "94c2106f-1fd1-428b-adbc-80ac48ef479e",
  "_gdch_cluster": "org-1-admin",
  "requestURI": "/apis/logging.gdc.goog/v1/namespaces/obs-system/loggingrules/lr-cfg1",
  "_gdch_fluentbit_pod": "anthos-audit-logs-forwarder-4gwpn",
  "verb": "update",
  "userAgent": "fleet-admin-cm/v0.0.0 (linux/amd64) kubernetes/$Format",
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "user": {
    "extra": {
      "authentication.kubernetes.io/pod-name": [
        "fleet-admin-controller-875778d98-99l6n"
      ],
      "authentication.kubernetes.io/pod-uid": [
        "4800e06c-c96d-4e17-ae1a-b5a74eedf6ee"
      ]
    },
    "uid": "b18e586e-db0e-417e-9dff-1a722ab36bf4",
    "username": "system:serviceaccount:gpc-system:fleet-admin-controller",
    "groups": [
      "system:serviceaccounts",
      "system:serviceaccounts:gpc-system",
      "system:authenticated"
    ]
  },
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"fleet-admin-common-controller\" of ClusterRole \"fleet-admin-common-controllers-role\" to ServiceAccount \"fleet-admin-controller/gpc-system\""
  },
  "sourceIPs": [
    "10.253.164.209"
  ],
  "stage": "ResponseComplete",
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "stageTimestamp": "2022-12-06T14:37:41.035715Z",
  "objectRef": {
    "uid": "2e540720-ed23-4665-8c40-c399cb6be624",
    "namespace": "obs-system",
    "name": "lr-cfg1",
    "resource": "loggingrules",
    "apiVersion": "v1",
    "apiGroup": "logging.gdc.goog",
    "resourceVersion": "5326570"
  },
  "requestReceivedTimestamp": "2022-12-06T14:37:40.942762Z",
  "_gdch_service_name": "apiserver"
}

对 `SIEMOrgForwarder` 自定义资源执行操作

审核日志源	Kubernetes 审核日志
日志类型	控制平面

包含审核信息的日志条目中的字段
审核元数据	审核字段名称	值
用户或服务身份	`user`	例如， "user": { "username": "kubernetes-admin", "groups": [ "system:masters", "system:authenticated" ] }
目标（调用 API 的字段和值）	`requestURI` `objectRef`	例如， "requestURI": "/apis/logging.gdc.goog/v1/namespaces/alice/siemorgforwarders/audits", "objectRef": { "apiGroup": "logging.gdc.goog", "apiVersion": "v1", "name": "audits", "resource": "siemorgforwarders", "namespace": "alice" }
操作（包含所执行操作的字段）	`verb`	可能的值： `"verb": "create"` `"verb": "delete"` `"verb": "get"` `"verb": "list"` `"verb": "patch"` `"verb": "update"` `"verb": "watch"`
活动时间戳	`requestReceivedTimestamp`	例如， `"requestReceivedTimestamp": "2025-02-05T03:06:13.738683Z"`
操作来源	`sourceIPs`	例如， "sourceIPs": [ "10.200.0.7" ]
结果	`responseStatus`	例如， "responseStatus": { "metadata": {}, "code": 200 }
其他字段	不适用	不适用

日志示例

{
  "_gdch_cluster": "root-admin",
  "_gdch_fluentbit_pod": "anthos-audit-logs-forwarder-vrfkc",
  "_gdch_org_id": "root.zone1.google.gdch.test",
  "_gdch_org_name": "root",
  "_gdch_zone_id": "zone1",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": ""
  },
  "apiVersion": "audit.k8s.io/v1",
  "auditID": "ade605c0-8043-4231-8471-dc02b14ff327",
  "kind": "Event",
  "level": "Metadata",
  "objectRef": {
    "apiGroup": "logging.gdc.goog",
    "apiVersion": "v1",
    "name": "audit",
    "namespace": "alice",
    "resource": "siemorgforwarders"
  },
  "requestReceivedTimestamp": "2025-02-05T03:16:06.564964Z",
  "requestURI": "/apis/logging.gdc.goog/v1/namespaces/alice/siemorgforwarders/audit",
  "responseStatus": {
    "code": 200,
    "metadata": {}
  },
  "sourceIPs": [
    "10.200.0.4"
  ],
  "stage": "ResponseComplete",
  "stageTimestamp": "2025-02-05T03:16:06.567624Z",
  "user": {
    "groups": [
      "system:masters",
      "system:authenticated"
    ],
    "username": "kubernetes-admin"
  },
  "userAgent": "k9s/v0.0.0 (linux/amd64) kubernetes/$Format",
  "verb": "get"
}

日志记录和审核日志记录（LOG 和 AL） 使用集合让一切井井有条 根据您的偏好保存内容并对其进行分类。

使用监控实例的界面运行 LogQL 查询或导出日志

对 LoggingTarget 自定义资源执行操作

对 LoggingRule 自定义资源执行操作

对 SIEMOrgForwarder 自定义资源执行操作

日志记录和审核日志记录（LOG 和 AL）

对 `LoggingTarget` 自定义资源执行操作

对 `LoggingRule` 自定义资源执行操作

对 `SIEMOrgForwarder` 自定义资源执行操作