From df479a6f4ad20db59914cf3543b0c81b805533b2 Mon Sep 17 00:00:00 2001 From: ddeyo Date: Sat, 8 Sep 2018 09:45:12 -0700 Subject: [PATCH] Review changes --- ee/ucp/admin/configure/create-audit-logs.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/ee/ucp/admin/configure/create-audit-logs.md b/ee/ucp/admin/configure/create-audit-logs.md index feec1694bf..ded5a6ee1c 100644 --- a/ee/ucp/admin/configure/create-audit-logs.md +++ b/ee/ucp/admin/configure/create-audit-logs.md @@ -10,7 +10,7 @@ keywords: logs, ucp, swarm, kubernetes Audit logs are focused on external user/agent actions and security than understanding state or events of the system itself. They are a security-relevant chronological set of records documenting the sequence of activities that have affected system by individual users, administrators or other components of the system. -Audit Logs capture all HTTP actions (GET, PUT, POST, PATCH, DELETE) to all UCP API, Swarm API and Kubernetes API endpoints that are invoked (except for the ignored list) and sent to Docker Engine via stdout. zCreating audit logs is mainly CLI driven and is an UCP component that integrates with Swarm, K8s, and UCP APIs. +Audit Logs capture all HTTP actions (GET, PUT, POST, PATCH, DELETE) to all UCP API, Swarm API and Kubernetes API endpoints that are invoked (except for the ignored list) and sent to Docker Engine via stdout. Creating audit logs is CLI driven and is an UCP component that integrates with Swarm, K8s, and UCP APIs. ## Logging levels @@ -49,14 +49,14 @@ curl --cert ${DOCKER_CERT_PATH}/cert.pem --key ${DOCKER_CERT_PATH}/key.pem --cac ``` vi auditlog.json - {"logLevel":"INFO","auditLevel":"metadata","supportDumpIncludeAuditLogs":false} - ``` -4. Send the JSON request for the auditlog config with the same API path but with the `PUT` method +{"logLevel":"INFO","auditLevel":"metadata","supportDumpIncludeAuditLogs":false} +``` +4. Send the JSON request for the auditlog config with the same API path but with the `PUT` method. ``` curl --cert ${DOCKER_CERT_PATH}/cert.pem --key ${DOCKER_CERT_PATH}/key.pem --cacert ${DOCKER_CERT_PATH}/ca.pem -k -H "Content-Type: application/json" -X PUT --data $(cat auditlog.json) https://ucp-domain/api/ucp/config/logging ``` -5. Create any workload or RBAC grants in Kube and generate a support dump to check the contents of ucp-controller.log file for audit log entries. +5. Create any workload or RBAC grants in Kubernetes and generate a support dump to check the contents of ucp-controller.log file for audit log entries. 6. Optionally, configure the Docker Engine driver to logstash and collect and query audit logs within ELK stack after deploying ELK. https://success.docker.com/article/elasticsearch-logstash-kibana-logging