Skip to content

Commit 42bc7de

Browse files
authored
Merge pull request #44229 from bburt-rh/RHDEVDOCS-3386-how-to-configure-prometheus-adapter-audit-logs
RHDEVDOCS-3386 - How to configure Prometheus Adapter audit log levels
2 parents 9a24a6a + f77928e commit 42bc7de

File tree

2 files changed

+133
-5
lines changed

2 files changed

+133
-5
lines changed
Lines changed: 117 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,117 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * monitoring/configuring-the-monitoring-stack.adoc
4+
5+
:_content-type: PROCEDURE
6+
[id="setting-audit-log-levels-for-the-prometheus-adapter_{context}"]
7+
= Setting audit log levels for the Prometheus Adapter
8+
9+
[role=_abstract]
10+
In default platform monitoring, you can configure the audit log level for the Prometheus Adapter.
11+
12+
.Prerequisites
13+
14+
* You have installed the OpenShift CLI (`oc`).
15+
* You have access to the cluster as a user with the `cluster-admin` role.
16+
* You have created the `cluster-monitoring-config` `ConfigMap` object.
17+
18+
.Procedure
19+
20+
You can set an audit log level for the Prometheus Adapter in the default `openshift-monitoring` project:
21+
22+
. Edit the `cluster-monitoring-config` `ConfigMap` object in the `openshift-monitoring` project:
23+
+
24+
[source,terminal]
25+
----
26+
$ oc -n openshift-monitoring edit configmap cluster-monitoring-config
27+
----
28+
29+
. Add `profile:` in the `k8sPrometheusAdapter/audit` section under `data/config.yaml`:
30+
+
31+
[source,yaml]
32+
----
33+
apiVersion: v1
34+
kind: ConfigMap
35+
metadata:
36+
name: cluster-monitoring-config
37+
namespace: openshift-monitoring
38+
data:
39+
config.yaml: |
40+
k8sPrometheusAdapter:
41+
audit:
42+
profile: <audit_log_level> <1>
43+
----
44+
<1> The audit log level to apply to the Prometheus Adapter.
45+
46+
. Set the audit log level by using one of the following values for the `profile:` parameter:
47+
+
48+
* `None`: Do not log events.
49+
* `Metadata`: Log only the metadata for the request, such as user, timestamp, and so forth. Do not log the request text and the response text. `Metadata` is the default audit log level.
50+
* `Request`: Log only the metadata and the request text but not the response text. This option does not apply for non-resource requests.
51+
* `RequestResponse`: Log event metadata, request text, and response text. This option does not apply for non-resource requests.
52+
53+
. Save the file to apply the changes. The pods for the Prometheus Adapter restart automatically when you apply the change.
54+
+
55+
[WARNING]
56+
====
57+
When changes are saved to a monitoring config map, the pods and other resources in the related project might be redeployed. The running monitoring processes in that project might also be restarted.
58+
====
59+
60+
.Verification
61+
62+
. In the config map, under `k8sPrometheusAdapter/audit/profile`, set the log level to `Request` and save the file.
63+
64+
. Confirm that the pods for the Prometheus Adapter are running. The following example lists the status of pods in the `openshift-monitoring` project:
65+
+
66+
[source,terminal]
67+
----
68+
$ oc -n openshift-monitoring get pods
69+
----
70+
71+
. Confirm that the audit log level and audit log file path are correctly configured:
72+
+
73+
[source,terminal]
74+
----
75+
$ oc -n openshift-monitoring get deploy prometheus-adapter -o yaml
76+
----
77+
+
78+
.Example output
79+
[source,terminal]
80+
----
81+
...
82+
- --audit-policy-file=/etc/audit/request-profile.yaml
83+
- --audit-log-path=/var/log/adapter/audit.log
84+
----
85+
86+
. Confirm that the correct log level has been applied in the `prometheus-adapter` deployment in the `openshift-monitoring` project:
87+
+
88+
[source,terminal]
89+
----
90+
$ oc -n openshift-monitoring exec deploy/prometheus-adapter -c prometheus-adapter -- cat /etc/audit/request-profile.yaml
91+
----
92+
+
93+
.Example output
94+
[source,terminal]
95+
----
96+
"apiVersion": "audit.k8s.io/v1"
97+
"kind": "Policy"
98+
"metadata":
99+
"name": "Request"
100+
"omitStages":
101+
- "RequestReceived"
102+
"rules":
103+
- "level": "Request"
104+
----
105+
+
106+
[NOTE]
107+
====
108+
If you enter an unrecognized `profile` value for the Prometheus Adapter in the `ConfigMap` object, no changes are made to the Prometheus Adapter, and an error is logged by the Cluster Monitoring Operator.
109+
====
110+
111+
. Review the audit log for the Prometheus Adapter:
112+
+
113+
[source,terminal]
114+
----
115+
$ oc -n openshift-monitoring exec -c <prometheus_adapter_pod_name> -- cat /var/log/adapter/audit.log
116+
----
117+

monitoring/configuring-the-monitoring-stack.adoc

Lines changed: 16 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -101,7 +101,7 @@ include::modules/monitoring-modifying-retention-time-for-prometheus-metrics-data
101101
[role="_additional-resources"]
102102
.Additional resources
103103

104-
* See xref:../monitoring/configuring-the-monitoring-stack.adoc#preparing-to-configure-the-monitoring-stack[Preparing to configure the monitoring stack] for steps to create monitoring config maps
104+
* See xref:../monitoring/configuring-the-monitoring-stack.adoc#preparing-to-configure-the-monitoring-stack[Preparing to configure the monitoring stack] for steps to create monitoring config maps.
105105
* xref:../monitoring/enabling-monitoring-for-user-defined-projects.adoc#enabling-monitoring-for-user-defined-projects[Enabling monitoring for user-defined projects]
106106
* xref:../storage/understanding-persistent-storage.adoc#understanding-persistent-storage[Understanding persistent storage]
107107
* xref:../scalability_and_performance/optimizing-storage.adoc#optimizing-storage[Optimizing storage]
@@ -126,7 +126,7 @@ include::modules/monitoring-creating-scrape-sample-alerts.adoc[leveloffset=+2]
126126

127127
* xref:../monitoring/configuring-the-monitoring-stack.adoc#creating-user-defined-workload-monitoring-configmap_configuring-the-monitoring-stack[Creating a user-defined workload monitoring config map]
128128
* xref:../monitoring/enabling-monitoring-for-user-defined-projects.adoc#enabling-monitoring-for-user-defined-projects[Enabling monitoring for user-defined projects]
129-
* See xref:../monitoring/troubleshooting-monitoring-issues.html#determining-why-prometheus-is-consuming-disk-space_troubleshooting-monitoring-issues[Determining why Prometheus is consuming a lot of disk space] for steps to query which metrics have the highest number of scrape samples
129+
* See xref:../monitoring/troubleshooting-monitoring-issues.html#determining-why-prometheus-is-consuming-disk-space_troubleshooting-monitoring-issues[Determining why Prometheus is consuming a lot of disk space] for steps to query which metrics have the highest number of scrape samples.
130130

131131
//Configuring external alertmanagers
132132
include::modules/monitoring-configuring-external-alertmanagers.adoc[leveloffset=1]
@@ -137,7 +137,7 @@ include::modules/monitoring-attaching-additional-labels-to-your-time-series-and-
137137
[role="_additional-resources"]
138138
.Additional resources
139139

140-
* See xref:../monitoring/configuring-the-monitoring-stack.adoc#preparing-to-configure-the-monitoring-stack[Preparing to configure the monitoring stack] for steps to create monitoring config maps
140+
* See xref:../monitoring/configuring-the-monitoring-stack.adoc#preparing-to-configure-the-monitoring-stack[Preparing to configure the monitoring stack] for steps to create monitoring config maps.
141141
* xref:../monitoring/enabling-monitoring-for-user-defined-projects.adoc#enabling-monitoring-for-user-defined-projects[Enabling monitoring for user-defined projects]
142142

143143
// Setting log levels for monitoring components
@@ -155,6 +155,17 @@ include::modules/monitoring-setting-query-log-file-for-prometheus.adoc[leveloffs
155155
// Enabling query logging for Thanos Querier
156156
include::modules/monitoring-enabling-query-logging-for-thanos-querier.adoc[leveloffset=+1]
157157

158+
[role="_additional-resources"]
159+
.Additional resources
160+
161+
* See xref:../monitoring/configuring-the-monitoring-stack.adoc#preparing-to-configure-the-monitoring-stack[Preparing to configure the monitoring stack] for steps to create monitoring config maps.
162+
163+
// Setting audit log levels for the Prometheus Adapter
164+
include::modules/monitoring-setting-audit-log-levels-for-the-prometheus-adapter.adoc[leveloffset=1]
165+
166+
[role="_additional-resources"]
167+
.Additional resources
168+
158169
* See xref:../monitoring/configuring-the-monitoring-stack.adoc#preparing-to-configure-the-monitoring-stack[Preparing to configure the monitoring stack] for steps to create monitoring config maps.
159170

160171
// Disabling the default Grafana deployment
@@ -163,7 +174,7 @@ include::modules/monitoring-disabling-grafana.adoc[leveloffset=+1]
163174
[role="_additional-resources"]
164175
.Additional resources
165176

166-
* See xref:../monitoring/configuring-the-monitoring-stack.adoc#preparing-to-configure-the-monitoring-stack[Preparing to configure the monitoring stack] for steps to create monitoring config maps
177+
* See xref:../monitoring/configuring-the-monitoring-stack.adoc#preparing-to-configure-the-monitoring-stack[Preparing to configure the monitoring stack] for steps to create monitoring config maps.
167178

168179
// Disabling the local Alertmanager
169180
include::modules/monitoring-disabling-the-local-alertmanager.adoc[leveloffset=+1]
@@ -176,4 +187,4 @@ include::modules/monitoring-disabling-the-local-alertmanager.adoc[leveloffset=+1
176187
== Next steps
177188

178189
* xref:../monitoring/enabling-monitoring-for-user-defined-projects.adoc#enabling-monitoring-for-user-defined-projects[Enabling monitoring for user-defined projects]
179-
* Learn about xref:../support/remote_health_monitoring/opting-out-of-remote-health-reporting.adoc#opting-out-remote-health-reporting_opting-out-remote-health-reporting[remote health reporting] and, if necessary, opt out of it
190+
* Learn about xref:../support/remote_health_monitoring/opting-out-of-remote-health-reporting.adoc#opting-out-remote-health-reporting_opting-out-remote-health-reporting[remote health reporting] and, if necessary, opt out of it.

0 commit comments

Comments
 (0)