Bug 1316248

Summary:	[RFE] Log user and access key with each bucket and object operation for audit purposes
Product:	Red Hat Ceph Storage	Reporter:	Neil Levine <nlevine>
Component:	RGW	Assignee:	Yehuda Sadeh <yehuda>
Status:	CLOSED DEFERRED	QA Contact:	ceph-qe-bugs <ceph-qe-bugs>
Severity:	medium	Docs Contact:
Priority:	unspecified
Version:	2.0	CC:	anharris, assingh, cbodley, ceph-eng-bugs, flucifre, hnallurv, kbader, mbenjamin, nlevine, sweil, tcole, uboppana, vumrao
Target Milestone:	rc	Keywords:	FutureFeature
Target Release:	3.*
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-01-31 13:57:00 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Bug Depends On:
Bug Blocks:	1258382, 1319075

Description Neil Levine 2016-03-09 18:58:51 UTC

As an admin, I need to store logs for every operation performed by my users through RGW for audit purposes. 

As an admin, I need to see what operations a particular user performed on a bucket and/or object.

As an admin, I need to see what access key a user used when performing an operation.

As an admin, I need to have the log structure which allows me to write scripts which can easily extra the audit information I need.

Comment 6 Kyle Bader 2017-04-04 17:52:51 UTC

If someone uses HAproxy in front of RGW, you can configure it to do this. In the frontend section add (where 12345 is the length of a key/token):

capture request header AWSAccessKeyId len 12345

For Swift, I think it should be:

capture request header X-Auth-Token len 12345
capture request header X-Storage-Toke len 12345

Comment 9 Drew Harris 2017-07-06 14:22:16 UTC

*** Bug 1230413 has been marked as a duplicate of this bug. ***

Comment 12 Drew Harris 2019-01-31 13:57:00 UTC

I have closed this issue because it has been inactive for some time now. If you feel this still deserves attention feel free to reopen it.