Audit log for etcd key/value changes

[martezr]

There was a request for audit logging in #5019 and a possible solution was to leverage the --debug flag. The problem with this is that it degrades the performance of the cluster as noted in the documentation (https://coreos.com/etcd/docs/3.3.1/op-guide/monitoring.html).

This request is to allow audit data to be written to a log file or shipped to a syslog server. I don't see a need for the data to be stored in etcd as this would just be for security purposes. The following information should be included in the log entry.

• The IP address of the originating request
• Who made the change
• What was the operation (get, put, update, etc.)
• What keys were part of the request
• When the change was made

[jingyih]

Are you proposing to use a separate flag to enable the audit logging? Or to separate the output of audit logging from the other logs generated when --debug flag is enabled?

Currently the log output is set using --log-outputs flag, so the audit logging messages can be written to a log file (with other log messages together).

When audit logging is enabled, system performance is likely to be degraded due to generating and outputting the necessary information. We probably should do better job benchmarking the result.

[martezr]

I would propose at least a separate flag to provide better clarity. Ideally the audit logs could be separated from the other debug messages to allow them to be decoupled. This would allow auditing to be turned on without debugging. The notion of running a cluster continuously with debug logging just seems a bit strange.

[pjhdld]

--log-outputs

Are you proposing to use a separate flag to enable the audit logging? Or to separate the output of audit logging from the other logs generated when --debug flag is enabled?

Currently the log output is set using --log-outputs flag, so the audit logging messages can be written to a log file (with other log messages together).

When audit logging is enabled, system performance is likely to be degraded due to generating and outputting the necessary information. We probably should do better job benchmarking the result.

@jingyih @martezr If I only want to record in the log which ip will connect to the etcd and disconnected logs, can this be done with the --log-outputs flag?

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed after 21 days if no further activity occurs. Thank you for your contributions.

[Romashovm]

up!
It's actual issue for me.