Skip to content

stream-audit-logs.adoc

Latest commit

 

History

History
101 lines (82 loc) · 4.24 KB

stream-audit-logs.adoc

File metadata and controls

101 lines (82 loc) · 4.24 KB
Raw

Stream {astra} audit logs

Stream your {astra} audit logs through {product} to an external system.

To enable audit log streaming, you must do one of the following:

  • Provide the Full Name of your {product} topic and the streaming tenant’s client.conf file to {support-url}[IBM Support] or your {company} account representative.

  • POST your configuration to the {devops-api-ref-url}#tag/Organization-Operations/operation/configureTelemetry[{astra} {devops-api} telemetry endpoint].

Create an {product} topic for audit logs

  1. In the {astra-ui-link} header, click [grip], and then select Streaming.

  2. Click the name of an existing tenant or create a tenant in AWS us-east-2, and then create a namespace and topic in the tenant.

    Important

    Audit log streaming requires a streaming tenant in the AWS us-east-2 region.

  3. On the Namespace and Topics page, click the new topic, and then copy the topic’s Full Name, such as persistent://aws-us-east-2-mk/NAMESPACE_NAME/TOPIC_NAME.

  4. If necessary, create additional audit log topics, and then record the Full Name for each topic. You can use topics to organize audit logs by event type or other criteria.

  5. In the {astra-ui-link} header, click [grip], select Streaming, and then click the name of your audit log streaming tenant.

  6. On the Connect tab, click Download client.conf.

  7. To finalize the configuration, do one of the following:

Configure audit log streaming with the {devops-api}

You can use the {devops-api-ref-url}#tag/Organization-Operations/operation/configureTelemetry[{astra} {devops-api} telemetry endpoint] to configure audit log streaming instead of providing the configuration details to IBM Support.

  1. In the {astra-ui-link} header, click [grip], and then select Admin.

  2. Click Tokens, and then create an {astra} application token with the {organization-administrator-role} role.

  3. Create the audit log streaming configuration using the values from the tenant’s client.conf file and your {pulsar-short} configuration:

    curl -sS --fail -L -X POST "https://api.astra.datastax.com/v2/organizations/ORG_ID/telemetry/auditLogs" \
--header "Authorization: Bearer APPLICATION_TOKEN" \
--header "Accept: application/json"
--data '{
  "pulsar": {
    "endpoint": "pulsar+BROKER_SERVICE_URL",
    "auth_strategy": "token",
    "topic": "TOPIC_FULL_NAME",
    "auth_name": "token",
    "token": "PULSAR_AUTHENTICATION_TOKEN"
  }
}'

    Replace the following:

    • ORG_ID: Your {astra} organization ID.

    • APPLICATION_TOKEN: Your {astra} application token.

    • BROKER_SERVICE_URL: The {product} broker service URL, such as ssl://pulsar-aws-useast2.streaming.datastax.com:6651.

    • TOPIC_FULL_NAME: The full name of the {product} topic where you want to stream audit logs.

    • The auth_strategy and other authentication details depend on your {pulsar-short} configuration.

      Result
      HTTP/1.1 202 Accepted

  4. Retrieve and verify the audit log streaming configuration:

    curl -sS --fail -L -X GET "https://api.astra.datastax.com/v2/organizations/ORG_ID/telemetry/auditLogs" \
--header "Authorization: Bearer APPLICATION_TOKEN" \
--header "Accept: application/json"
    Result
    {
  "pulsar": {
    "endpoint": "pulsar+ssl://pulsar-aws-useast2.streaming.datastax.com:6651",
    "topic": "persistent://aws-us-east-2-mk-2/default/audit-log",
    "auth_strategy": "token",
    "token": "********",
    "auth_name": "token"
  }
}

Delete an audit log streaming configuration

To delete an audit log streaming configuration, {devops-api-ref-url}#tag/Organization-Operations/operation/deleteTelemetryConfig[send a DELETE request].