Hi, is there any guide to configure the audit log ...
# help
f
Hi, is there any guide to configure the audit log for LakeFS running on Kubernetes/EKS (all the pod logs are in s3, but I see no audit info there) using the Helm Chart (https://artifacthub.io/packages/helm/lakefs/lakefs)? A user is claiming that a branch just disappeared (we can restore anyways) but I can't see if he deleted by mistake or not.
e
Hi @Florentino Sainz, Don't remember off the top of my head I'll need a few minutes to check
gratitude thank you 1
f
afaik I only see the audit_log in the configuration
but no location or anything to be configured
e
👍🏻
We've recently made changes to the audit logs I'll need to check with my colleagues and get back to you with an up-to-date answer
f
thanks!
e
sure, np
f
no hurry, current issue is not big (we had a backup-branch from a few minutes before), but i want to be prepared for the future
e
Completely understandable
Auditing logs are interleaved in lakeFS logs Audit log messages have a property
log_audit
set to
true
f
hmm, ima verify, i don't see the logs in my server but maybe we have something wrong, thanks
e
Sure, np
If you don’t see them, let me know, and I can look into it
f
I have the following config logging.audit_log_level=DEBUG logging.file_max_size_mb=102400 logging.files_keep=100 logging.format=text logging.level=INFO logging.output=\"[-]\" but when searching the logs, when searching for "audit" keyword, I see no lines at all (only the first one which prints lakefs config), its a self-hosted lakefs enterprise on EKS though • Note: In case you configure this field to be lower than the main logger level, you won’t be able to get the audit logs I see this note but given my ones are the default it doesnt apply? xP
e
Can you try changing
logging.format
to
json
?
I see this note but given my ones are the default it doesnt apply?
I believe the defaults are the same
But you can try setting them both to
info
or
debug
f
defaults are audit=DEBUG logging=INFO
ima try with logging format
e
Ok, let me know if that helps
f
ok, will take a little, takes a while to deploy here, will ping when i finalize 🙂 thanks
e
Great, thanks!