16b535314d
* MM-23222 add file target (with rotation) to audit
* MM-23222 mirror syslog audits to local filesystem
* provides config options for file name, max size, max age
* rotates files based on max size and max age; delete as needed based on max backups
* include cluster id in log records
* sort meta data fields
111 строки
3.7 KiB
Go
111 строки
3.7 KiB
Go
// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
|
|
// See LICENSE.txt for license information.
|
|
|
|
package app
|
|
|
|
import (
|
|
"fmt"
|
|
|
|
"github.com/mattermost/mattermost-server/v5/audit"
|
|
"github.com/mattermost/mattermost-server/v5/mlog"
|
|
"github.com/mattermost/mattermost-server/v5/model"
|
|
)
|
|
|
|
const (
|
|
RestLevelID = 240
|
|
RestContentLevelID = 241
|
|
RestPermsLevelID = 242
|
|
CLILevelID = 243
|
|
)
|
|
|
|
var (
|
|
RestLevel = audit.Level{ID: RestLevelID, Name: "audit-rest", Stacktrace: false}
|
|
RestContentLevel = audit.Level{ID: RestContentLevelID, Name: "audit-rest-content", Stacktrace: false}
|
|
RestPermsLevel = audit.Level{ID: RestPermsLevelID, Name: "audit-rest-perms", Stacktrace: false}
|
|
CLILevel = audit.Level{ID: CLILevelID, Name: "audit-cli", Stacktrace: false}
|
|
)
|
|
|
|
func (a *App) GetAudits(userId string, limit int) (model.Audits, *model.AppError) {
|
|
return a.Srv().Store.Audit().Get(userId, 0, limit)
|
|
}
|
|
|
|
func (a *App) GetAuditsPage(userId string, page int, perPage int) (model.Audits, *model.AppError) {
|
|
return a.Srv().Store.Audit().Get(userId, page*perPage, perPage)
|
|
}
|
|
|
|
func (s *Server) configureAudit(adt *audit.Audit) {
|
|
adt.OnQueueFull = s.onAuditTargetQueueFull
|
|
adt.OnError = s.onAuditError
|
|
|
|
// Configure target for SysLog via TLS.
|
|
// See https://www.rsyslog.com/doc/v8-stable/tutorials/tls_cert_summary.html
|
|
if *s.Config().ExperimentalAuditSettings.SysLogEnabled {
|
|
IP := *s.Config().ExperimentalAuditSettings.SysLogIP
|
|
if IP == "" {
|
|
IP = "localhost"
|
|
}
|
|
port := *s.Config().ExperimentalAuditSettings.SysLogPort
|
|
if port <= 0 {
|
|
port = 6514
|
|
}
|
|
raddr := fmt.Sprintf("%s:%d", IP, port)
|
|
maxQSize := *s.Config().ExperimentalAuditSettings.SysLogMaxQueueSize
|
|
if maxQSize <= 0 {
|
|
maxQSize = audit.DefMaxQueueSize
|
|
}
|
|
|
|
params := &audit.SyslogParams{
|
|
Raddr: raddr,
|
|
Cert: *s.Config().ExperimentalAuditSettings.SysLogCert,
|
|
Tag: *s.Config().ExperimentalAuditSettings.SysLogTag,
|
|
Insecure: *s.Config().ExperimentalAuditSettings.SysLogInsecure,
|
|
}
|
|
|
|
filter := adt.MakeFilter(RestLevel, RestContentLevel, RestPermsLevel, CLILevel)
|
|
formatter := adt.MakeJSONFormatter()
|
|
target, err := audit.NewSyslogTLSTarget(filter, formatter, params, maxQSize)
|
|
if err != nil {
|
|
mlog.Error("cannot configure SysLogTLS audit target", mlog.Err(err))
|
|
} else {
|
|
mlog.Debug("SysLogTLS audit target connected successfully", mlog.String("raddr", raddr))
|
|
adt.AddTarget(target)
|
|
}
|
|
}
|
|
|
|
// Configure target for rotating file output
|
|
if *s.Config().ExperimentalAuditSettings.FileEnabled {
|
|
opts := audit.FileOptions{
|
|
Filename: *s.Config().ExperimentalAuditSettings.FileName,
|
|
MaxSize: *s.Config().ExperimentalAuditSettings.FileMaxSizeMB,
|
|
MaxAge: *s.Config().ExperimentalAuditSettings.FileMaxAgeDays,
|
|
MaxBackups: *s.Config().ExperimentalAuditSettings.FileMaxBackups,
|
|
Compress: *s.Config().ExperimentalAuditSettings.FileCompress,
|
|
}
|
|
|
|
maxQueueSize := *s.Config().ExperimentalAuditSettings.FileMaxQueueSize
|
|
if maxQueueSize <= 0 {
|
|
maxQueueSize = audit.DefMaxQueueSize
|
|
}
|
|
|
|
filter := adt.MakeFilter(RestLevel, RestContentLevel, RestPermsLevel, CLILevel)
|
|
formatter := adt.MakeJSONFormatter()
|
|
formatter.DisableTimestamp = false
|
|
formatter.Indent = "\n"
|
|
target, err := audit.NewFileTarget(filter, formatter, opts, maxQueueSize)
|
|
if err != nil {
|
|
mlog.Error("cannot configure File audit target", mlog.Err(err))
|
|
} else {
|
|
mlog.Debug("File audit target created successfully", mlog.String("filename", opts.Filename))
|
|
adt.AddTarget(target)
|
|
}
|
|
}
|
|
}
|
|
|
|
func (s *Server) onAuditTargetQueueFull(qname string, maxQSize int) {
|
|
mlog.Warn("Audit Queue Full", mlog.String("qname", qname), mlog.Int("maxQSize", maxQSize))
|
|
}
|
|
|
|
func (s *Server) onAuditError(err error) {
|
|
mlog.Error("Audit Error", mlog.Err(err))
|
|
}
|