[
https://issues.apache.org/jira/browse/KNOX-272?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Kevin Minder updated KNOX-272:
------------------------------
Description:
User Columns
It still isn't clear to me exactly how we expect these to be used consistently.
# Authentication Failure
14/02/20 16:14:45 ||...|audit|WEBHBASE||||access|uri|...|unavailable|
14/02/20 16:14:45 ||...|audit|WEBHBASE||||access|uri|...|success|Response
status: 401
* We need really see if we can figure out a way to log an authentication|failre
# Redeployment
14/02/20 16:06:39 |||audit|||||redeploy|topology|sandbox|unavailable|
* I think there should be something in one of the user columns.
# Access (two records)
14/02/20 16:13:43 ||...|audit|WEBHBASE||||access|uri|...|unavailable|
14/02/20 16:15:11
||...|audit|WEBHBASE|guest|hdfs||access|uri|...|success|Response status: 405
* I'm questioning the value of the first record but I understand that it might
be important to have this to "bracket" the request processing.
# Access (status/outcome)
14/02/20 16:15:11
||...|audit|WEBHBASE|guest|hdfs||access|uri|...|success|Response status: 405
* I think that >=400 should use a failure outcome.
# Identity Mapping (Three Records)
14/02/20 16:15:11
||...|audit|WEBHBASE|guest|hdfs||identity-mapping|principal|guest|success|
14/02/20 16:15:11
||...|audit|WEBHBASE|guest|hdfs||identity-mapping|principal|hdfs|success|Groups:
[admin]
14/02/20 16:15:11
||...|audit|WEBHBASE|guest|hdfs||identity-mapping|principal|*|success|Groups:
[users]
* Three records seems excessive. Can these be meaningfully combined?
# Knox Service
* What in these lines would identify this as a Knox audit record if/when it is
centrally combined?
was:
User Columns
It still isn't clear to me exactly how we expect these to be used consistently.
h1. Authentication Failure
14/02/20 16:14:45 ||...|audit|WEBHBASE||||access|uri|...|unavailable|
14/02/20 16:14:45 ||...|audit|WEBHBASE||||access|uri|...|success|Response
status: 401
* We need really see if we can figure out a way to log an authentication|failre
Redeployment
```
14/02/20 16:06:39 |||audit|||||redeploy|topology|sandbox|unavailable|
```
I think there should be something in one of the user columns.
Access (two records)
```
14/02/20 16:13:43 ||...|audit|WEBHBASE||||access|uri|...|unavailable|
14/02/20 16:15:11
||...|audit|WEBHBASE|guest|hdfs||access|uri|...|success|Response status: 405
```
I'm questioning the value of the first record but I understand that it might be
important to have this to "bracket" the request processing.
Access (status/outcome)
```
14/02/20 16:15:11
||...|audit|WEBHBASE|guest|hdfs||access|uri|...|success|Response status: 405
```
I think that >=400 should use a failure outcome.
Identity Mapping (Three Records)
```
14/02/20 16:15:11
||...|audit|WEBHBASE|guest|hdfs||identity-mapping|principal|guest|success|
14/02/20 16:15:11
||...|audit|WEBHBASE|guest|hdfs||identity-mapping|principal|hdfs|success|Groups:
[admin]
14/02/20 16:15:11
||...|audit|WEBHBASE|guest|hdfs||identity-mapping|principal|*|success|Groups:
[users]
```
Three records seems excessive. Can these be meaningfully combined?
Knox Service
What in these lines would identify this as a Knox audit record if/when it is
centrally combined?
> Auditing content refinement
> ----------------------------
>
> Key: KNOX-272
> URL: https://issues.apache.org/jira/browse/KNOX-272
> Project: Apache Knox
> Issue Type: Improvement
> Components: Server
> Affects Versions: 0.4.0
> Reporter: Kevin Minder
> Fix For: 0.4.0
>
>
> User Columns
> It still isn't clear to me exactly how we expect these to be used
> consistently.
> # Authentication Failure
> 14/02/20 16:14:45 ||...|audit|WEBHBASE||||access|uri|...|unavailable|
> 14/02/20 16:14:45 ||...|audit|WEBHBASE||||access|uri|...|success|Response
> status: 401
> * We need really see if we can figure out a way to log an
> authentication|failre
> # Redeployment
> 14/02/20 16:06:39 |||audit|||||redeploy|topology|sandbox|unavailable|
> * I think there should be something in one of the user columns.
> # Access (two records)
> 14/02/20 16:13:43 ||...|audit|WEBHBASE||||access|uri|...|unavailable|
> 14/02/20 16:15:11
> ||...|audit|WEBHBASE|guest|hdfs||access|uri|...|success|Response status: 405
> * I'm questioning the value of the first record but I understand that it
> might be important to have this to "bracket" the request processing.
> # Access (status/outcome)
> 14/02/20 16:15:11
> ||...|audit|WEBHBASE|guest|hdfs||access|uri|...|success|Response status: 405
> * I think that >=400 should use a failure outcome.
> # Identity Mapping (Three Records)
> 14/02/20 16:15:11
> ||...|audit|WEBHBASE|guest|hdfs||identity-mapping|principal|guest|success|
> 14/02/20 16:15:11
> ||...|audit|WEBHBASE|guest|hdfs||identity-mapping|principal|hdfs|success|Groups:
> [admin]
> 14/02/20 16:15:11
> ||...|audit|WEBHBASE|guest|hdfs||identity-mapping|principal|*|success|Groups:
> [users]
> * Three records seems excessive. Can these be meaningfully combined?
> # Knox Service
> * What in these lines would identify this as a Knox audit record if/when it
> is centrally combined?
--
This message was sent by Atlassian JIRA
(v6.1.5#6160)
