Overview of security logs in the GUI

A combination of Audit Logs, logging modules and the “Logs” tab.

Where to look at the logs #

All log viewing in the GUI goes through the Logs tab on the cluster dashboard.

• Open the desired cluster.
• Select Dashboard from the side menu.
• Go to the Logs tab.

The tab is available on the dashboard of the deployed cluster. The data on the dashboard tabs is updated automatically.

Log availability conditions #

To display logs on the Logs tab, the following conditions must be met:

1. The Local Log Collection Module (Vector, shturval-log-collector) is enabled in the cluster.
2. The management cluster is running shturval-metrics-collector.

Additionally, for Audit Logs (logs of calls to API Kubernetes) the following is required:

• either enable advanced security settings when creating a cluster (the audit policy will be configured automatically);
• or manually configure Audit Policy and log collection /var/log/kube-api-audit/audit.log, as described on the page
  Setting Audit Logs.

What log projects are available #

In VLogs, corresponding projects (ProjectID) are created for logs. On the Logs tab, filtering by ProjectID is available:

Logs in projects are grouped by streams (stream). A stream is a set of logs with a unique set of parameters, where the parameter consists of a pair of "field": "value" logs. The stream name corresponds to the value of the _stream field.

The interface displays counters for the number of logs and streams in the selected project.

Time range #

On the Logs tab you can get information:

• in the last 15 minutes;
• for nlast 30 minutes;
• for the last hour - selected by default;
• for the whole day;
• for the selected time range.

Downloading logs #

On the Logs tab you can download:

• full log file;
• log file taking into account configured filters.

The file is downloaded with the extension .log. The name is generated automatically: prefix Logs, upload date and number of records.

Search for logs #

Search by text #

To search, use the pattern parameter:parameter_value separated by a colon and without spaces.

Examples:

kubernetes.pod_name:shturval-local-csi-node-6g6nh
kubernetes.pod_name:shturval-local-csi-node
message.level:warning | message.id:1

Search by multiple keys is supported. To do this, use the delimiter |.

The search is performed within the selected ProjectID in the selection corresponding to the selected time range.

Search by parameters #

To filter by parameters, click + next to the Search Options heading. In the window that opens, select the field, operator and specify the value.

Available operators:

When searching by parameters, consider the following features:

• The specified filtering parameters are combined according to the logical principle AND. For example, if the parameters message.level=warning and message.id=1 are specified, logs that match both conditions will be displayed.
• The list for setting parameters includes log fields, pre-filtered by project, time range and text search. If the required field is not in the list, change the pre-configured filters.
• Search by parameters can be performed based on partial matches in field values, with the exception of special parameters. For example, with the kubernetes.pod_name=kub parameter, the sample will include logs thatwhose field kubernetes.pod_name contains the combination kub.

Special parameters #

When searching using special parameters, the selected operator is not taken into account. The search is performed on an exact complete match and only on one value - the first one specified.

Simultaneous search by parameters and text works using the logical operator AND.

Features of security logs #

Authentication, authorization and access rights logs #

Authentication, authorization, access rights assignment logs, as well as infrastructure-related logs are located in the management cluster.

To analyze such events:

1. Open the management cluster.
2. Go to Dashboard → Logs tab.
3. Select the appropriate ProjectID (typically kube system namespaces, journald or kube audit depending on the event type).
4. Search by text or parameters.

API Audit Logs Kubernetes (Audit Logs) #

If advanced security settings are enabled in the cluster, security events are written to the cluster, and a project with ProjectID kube audit is created in VLogs. The event information follows the rules of the configured event audit policy in Kubernetes.

Advanced security settings are available when adding a cluster. You can check whether they are enabled in an existing cluster on the Cluster tab of the dashboard.

See also #

• How to view logs in the platform.
• Setting Audit Logs.
• Export security logs to SIEM.