{"id":1263,"date":"2010-01-24T19:31:57","date_gmt":"2010-01-24T18:31:57","guid":{"rendered":"http:\/\/www.devco.net\/?p=1263"},"modified":"2010-08-17T12:16:51","modified_gmt":"2010-08-17T11:16:51","slug":"mcollective_043_auditing","status":"publish","type":"post","link":"https:\/\/www.devco.net\/archives\/2010\/01\/24\/mcollective_043_auditing.php","title":{"rendered":"MCollective 0.4.3 Auditing"},"content":{"rendered":"<p>I just released <a href=\"http:\/\/marionette-collective.org\/releasenotes.html#0_4_3\">version 0.4.3 of mcollective<\/a> which brings a new <a href=\"http:\/\/code.google.com\/p\/mcollective\/wiki\/SimpleRPCAuditing\">auditing capability<\/a> to SimpleRPC.  Using the auditing system you can log to a file on each host every request or build a centralized auditing system for all requests on all nodes.<\/p>\n<p>We ship a simple plugin that logs to the local harddrive but there is also a community plugin that creates a <a href=\"http:\/\/code.google.com\/p\/mcollective-plugins\/wiki\/AuditCentralRPCLog\">centralized logging system<\/a> running over MCollective as a transport.<\/p>\n<p>This is the kind of log the centralized logger will produce:<\/p>\n<p><code><\/p>\n<pre lang=\"bash\">\r\n01\/24\/10 18:24:20 dev1.my.net> d53a8306f20e9b3a0f7946adccd6eb5e: 01\/24\/10 18:24:20 caller=uid=500@ids1.my.net agent=iptables action=block\r\n01\/24\/10 18:24:20 dev1.my.net> d53a8306f20e9b3a0f7946adccd6eb5e: {:ipaddr=>\"114.255.136.120\"}\r\n01\/24\/10 18:24:20 dev2.my.net> d53a8306f20e9b3a0f7946adccd6eb5e: 01\/24\/10 18:24:20 caller=uid=500@ids1.my.net agent=iptables action=block\r\n01\/24\/10 18:24:20 dev2.my.net> d53a8306f20e9b3a0f7946adccd6eb5e: {:ipaddr=>\"114.255.136.120\"}\r\n01\/24\/10 18:24:20 dev3.my.net> d53a8306f20e9b3a0f7946adccd6eb5e: 01\/24\/10 18:24:20 caller=uid=500@ids1.my.net agent=iptables action=block\r\n01\/24\/10 18:24:20 dev3.my.net> d53a8306f20e9b3a0f7946adccd6eb5e: {:ipaddr=>\"114.255.136.120\"}\r\n<\/pre>\n<p><\/code><\/p>\n<p>Here we see 3 nodes that got a request to add <em>114.255.136.120<\/em> to their local firewall.  The request was sent by UID 500 on the machine <em>ids1.my.net<\/em>.  The request is of course the same everywhere so the request id is the same on every node, the log shows agent and all parameters passed.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>I just released version 0.4.3 of mcollective which brings a new auditing capability to SimpleRPC. Using the auditing system you can log to a file on each host every request or build a centralized auditing system for all requests on all nodes. We ship a simple plugin that logs to the local harddrive but there [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"","_et_pb_old_content":"","footnotes":""},"categories":[7],"tags":[121,78,13],"_links":{"self":[{"href":"https:\/\/www.devco.net\/wp-json\/wp\/v2\/posts\/1263"}],"collection":[{"href":"https:\/\/www.devco.net\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.devco.net\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.devco.net\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.devco.net\/wp-json\/wp\/v2\/comments?post=1263"}],"version-history":[{"count":7,"href":"https:\/\/www.devco.net\/wp-json\/wp\/v2\/posts\/1263\/revisions"}],"predecessor-version":[{"id":1707,"href":"https:\/\/www.devco.net\/wp-json\/wp\/v2\/posts\/1263\/revisions\/1707"}],"wp:attachment":[{"href":"https:\/\/www.devco.net\/wp-json\/wp\/v2\/media?parent=1263"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.devco.net\/wp-json\/wp\/v2\/categories?post=1263"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.devco.net\/wp-json\/wp\/v2\/tags?post=1263"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}