Skip to content

Commit 301b388

Browse files
gbarideaugbarideau
committed
New KMS troubleshooting guide
1 parent 3f93da4 commit 301b388

File tree

6 files changed

+213
-0
lines changed

6 files changed

+213
-0
lines changed

‎pages/index.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1941,6 +1941,7 @@
19411941
+ [Pushing logs from a Kubernetes cluster to Logs Data Platform using Fluent Bit](manage_and_operate/observability/logs_data_platform/ingestion_kubernetes_fluent_bit)
19421942
+ [Pushing logs from OVHcloud account to Logs Data Platform](manage_and_operate/iam/iam-logs-forwarding)
19431943
+ [Pushing logs from SAP to Logs Data Platform](hosted_private_cloud/sap_on_ovhcloud/cookbook_sap_logs_on_ovhcloud_logs_data_platform_solution_setup)
1944+
+ [Pushing logs from OVHcloud KMS to Logs Data Platform](manage_and_operate/kms/kms-troubleshooting)
19441945
+ [Logs Data Platform - Collect VMware on OVHcloud logs](/pages/hosted_private_cloud/hosted_private_cloud_powered_by_vmware/vmware_ldp)
19451946
+ [Visualizing, querying and exploiting your logs](observability-logs-data-platform-visualizing-querying-exploiting)
19461947
+ [Exposing your logs to third-party tools via the OpenSearch API](manage_and_operate/observability/logs_data_platform/integration_opensearch_api)
@@ -1966,6 +1967,7 @@
19661967
+ [OVHcloud KMS Architecture overview](manage_and_operate/kms/architecture-overview)
19671968
+ [OVHcloud KMS - Responsibility model](manage_and_operate/kms/responsibility-model-kms)
19681969
+ [How to connect a compatible product using KMIP protocol with OVHcloud KMS](manage_and_operate/kms/kms-kmip)
1970+
+ [How to troubleshoot OVHcloud KMS access](manage_and_operate/kms/kms-troubleshooting)
19691971
+ OVHcloud Labs
19701972
+ [Data Collector](products/ovhcloud-labs-data-collector)
19711973
+ [Getting started](ovhcloud-labs-data-collector-getting-started)

‎pages/manage_and_operate/kms/kms-troubleshooting/guide.en-gb.md

Lines changed: 103 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,103 @@
1+
---
2+
title: "How to troubleshoot OVHcloud KMS access"
3+
excerpt: "Analyze KMS logs through LDP"
4+
updated: 2025-06-13
5+
---
6+
7+
## Objective
8+
9+
This guide aim to introduce logs generated by OVHcloud KMS and how to analyze them
10+
11+
## Requirements
12+
13+
- An [OVHcloud customer account](/pages/account_and_service_management/account_information/ovhcloud-account-creation).
14+
- An [OVHcloud KMS ordered and an access certificate created](/pages/manage_and_operate/kms/quick-start)
15+
16+
## Instructions
17+
18+
### Description
19+
20+
OVHcloud KMS has a native integration with [Logs Data Plateform](https://www.ovhcloud.com/en/identity-security-operations/logs-data-platform/) for logs management
21+
22+
### Logs direct access
23+
24+
KMS logs are available from each KMS `Logs`{.action} tab
25+
26+
![Logs tab](images/kms-logs-tab.png){.thumbnail}
27+
28+
This tab display in real time all KMS logs
29+
A selector allow to switch display between the two types of logs
30+
31+
- REST API audit logs
32+
- KMIP audit logs
33+
34+
### Logs access through LDP
35+
36+
From the `Logs`{.action} tab, it's possible to subscribe to a LDP data stream
37+
One the subscribtion enable, all the logs will be pushed to [Logs Data Plateform](https://www.ovhcloud.com/fr/identity-security-operations/logs-data-platform/) to archive generated logs and perform advanced searches, create alerts and visualisations
38+
39+
![LDP Subscription](images/kms-ldp-subscription.png){.thumbnail}
40+
41+
For more informations, please look the [dedicated documentation](pages\manage_and_operate\observability\logs_data_platform\getting_started_quick_start)
42+
43+
### Available logs details
44+
45+
KMS logs contains following information:
46+
47+
- REST API
48+
49+
Logs are display with this format:
50+
51+
```bash
52+
{{ http_method }} {{ http_path }} - {{ http_status }} - identity: {{ iam_identities }} - operation: {{ iam_operation }} on {{ res_urn }} - from {{ip}} with certificate {{cert_id}} - request id: {{ request_id }}
53+
```
54+
55+
As example: INFO | GET /v1/servicekey/77f0a3f6-c2ef-4e76-xxxx-xxxxxxxxxxxx - 200 - identity: urn:v1:eu:identity:group:xx1111-ovh/john.smith - operation: okms:apiovh:serviceKey/get on urn:v1:eu:resource:okms:8d1c84cc-1128-4629-xxxx-xxxxxxxxxx/serviceKey/77f0a3f6-c2ef-4e76-xxxx-xxxxxxxxxxxx - from Manager/APIv2 - request id: EU.manager-5.684c3abe.3880620.2080cff16eaa5539bf92cxxxxxxxx
56+
57+
Elements that can be pushed to Logs Data Plateform:
58+
59+
|**Field**|**Description**|
60+
| :-: | :-: |
61+
|domain_id|OKMS domain ID|
62+
|request_id|request ID|
63+
|log_level|Log priority level|
64+
|client_ip|IP of the client making the request|
65+
|tls_cert_id|Authentication certificate ID used|
66+
|res_urn|target resource URN|
67+
|region|OKMS domain region|
68+
|iam_operation|IAM action evalutated|
69+
|iam_identities|IAM identity used for rights evaluation|
70+
|http_path|Request path|
71+
|http_status|HTTP answer status|
72+
|http_method|Request method|
73+
|err_category|Error category|
74+
75+
- KMIP
76+
77+
Logs are display with this format:
78+
79+
```bash
80+
{{ http_method }} {{ http_path }} - {{ http_status }} - identity: {{ iam_identities }} - operation: {{ iam_operation }} on {{ res_urn }} - from {{ip}} with certificate {{cert_id}} - request id: {{ request_id }}
81+
```
82+
83+
As example : INFO | GET on urn:v1:eu:resource:okms:8d1c84cc-1128-4629-xxxx-xxxxxxxxxxx/kmip/ff55638c-3e86-4cb3-xxxx-xxxxxxxx - identity: urn:v1:eu:identity:account:xx1111-ovh - operation: okms:kmip:get - from XXX.XXX.XXX.XXX with certificate e7850a19-a5de-4527-xxxx-xxxxxxxxx - request id: OKMS.db61c455-abfa-4a66-xxxx-xxxxxxxxxxx"
84+
85+
Elements that can be pushed to Logs Data Plateform:
86+
87+
|**Field**|**Description**|
88+
| :-: | :-: |
89+
|domain_id|OKMS domain ID|
90+
|request_id|request ID|
91+
|log_level|Log priority level|
92+
|client_ip|IP of the client making the request|
93+
|tls_cert_id|Authentication certificate ID used|
94+
|res_urn|target resource URN|
95+
|region|OKMS domain region|
96+
|iam_operation|IAM action evalutated|
97+
|iam_identities|IAM identity used for rights evaluation|
98+
|kmip_operation|KMIP operation used|
99+
|kmip_reason|[Standard KMIP error code](https://docs.oasis-open.org/kmip/spec/v1.4/kmip-spec-v1.4.pdf#%5B%7B%22num%22%3A484%2C%22gen%22%3A0%7D%2C%7B%22name%22%3A%22XYZ%22%7D%2C69%2C720%2C0%5D)|
100+
101+
## Go further
102+
103+
Join our [community of users](/links/community).

‎pages/manage_and_operate/kms/kms-troubleshooting/guide.fr-fr.md

Lines changed: 105 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,105 @@
1+
---
2+
title: "Comment diagnostiquer les accès sur un OVHcloud KMS"
3+
excerpt: "Analyser les logs KMS via LDP"
4+
updated: 2025-06-13
5+
---
6+
7+
## Objectif
8+
9+
L'objectif de ce guide est de présenter les logs générés par le KMS OVHcloud et comment les interprêter
10+
11+
## Prérequis
12+
13+
- Disposer d'un [compte client OVHcloud](/pages/account_and_service_management/account_information/ovhcloud-account-creation).
14+
- Avoir [commandé un KMS OVHcloud et créer un certificat d'accès](/pages/manage_and_operate/kms/quick-start)
15+
16+
## En pratique
17+
18+
### Description
19+
20+
Le KMS OVHcloud dispose d'une intégration native avec [Logs Data Plateform](https://www.ovhcloud.com/en/identity-security-operations/logs-data-platform/) pour la gestion des logs
21+
22+
### Accès aux logs en direct
23+
24+
Les logs du KMS sont accessibles depuis l'onglet `Logs`{.action} d'un KMS
25+
26+
![Logs tab](images/kms-logs-tab.png){.thumbnail}
27+
28+
Cet onglet affiche en temps réel les logs du KMS.
29+
Le sélecteur permet de choisir le type de logs affichés :
30+
31+
- REST API audit logs
32+
- KMIP audit logs
33+
34+
### Accès aux logs via LDP
35+
36+
Depuis l'onglet `Logs`{.action} il est possible de s'abonner à un flux LDP.
37+
Une fois l'abonnement actif, l'ensemble des logs seront transmis à [Logs Data Plateform](https://www.ovhcloud.com/fr/identity-security-operations/logs-data-platform/) pour retrouver l'historique des logs généré et la possiblité de faire des recherches plus avancées, créer des alertes et des visualisations.
38+
39+
![LDP Subscription](images/kms-ldp-subscription.png){.thumbnail}
40+
41+
Pour plus d'informations, il est possible de regarder la [documentation dédiée](pages\manage_and_operate\observability\logs_data_platform\getting_started_quick_start)
42+
43+
### Liste des logs générés
44+
45+
Les logs du KMS comportent les informations suivantes :
46+
47+
- API REST
48+
49+
Les logs sont sous le format suivant :
50+
51+
```bash
52+
{{ http_method }} {{ http_path }} - {{ http_status }} - identity: {{ iam_identities }} - operation: {{ iam_operation }} on {{ res_urn }} - from {{ip}} with certificate {{cert_id}} - request id: {{ request_id }}
53+
```
54+
55+
Par exemple : INFO | GET /v1/servicekey/77f0a3f6-c2ef-4e76-xxxx-xxxxxxxxxxxx - 200 - identity: urn:v1:eu:identity:group:xx1111-ovh/john.smith - operation: okms:apiovh:serviceKey/get on urn:v1:eu:resource:okms:8d1c84cc-1128-4629-xxxx-xxxxxxxxxx/serviceKey/77f0a3f6-c2ef-4e76-xxxx-xxxxxxxxxxxx - from Manager/APIv2 - request id: EU.manager-5.684c3abe.3880620.2080cff16eaa5539bf92cxxxxxxxx
56+
57+
Les éléments pouvant être transmis à Logs Data Plateform étant :
58+
59+
|**Champ**|**Description**|
60+
| :-: | :-: |
61+
|domain_id|ID du domaine OKMS|
62+
|request_id|ID de la requête|
63+
|type||
64+
|log_level|Niveau de priorité du log|
65+
|client_ip|IP du client réalisant la requête|
66+
|tls_cert_id|ID du certificat utilisé pour l'authentification|
67+
|res_urn|URN de la ressource ciblé|
68+
|region|Région du domaine OKMS|
69+
|iam_operation|Action IAM évaluée|
70+
|iam_identities|Identitée IAM utilisé pour l'évaluation des droits|
71+
|http_path|Chemin de la requête|
72+
|http_status|Status de la réponse HTTP|
73+
|http_method|Methode de la requête|
74+
|err_category|Catégorie de l'erreur|
75+
76+
- KMIP
77+
78+
Les logs sont sous le format suivant :
79+
80+
```bash
81+
{{ http_method }} {{ http_path }} - {{ http_status }} - identity: {{ iam_identities }} - operation: {{ iam_operation }} on {{ res_urn }} - from {{ip}} with certificate {{cert_id}} - request id: {{ request_id }}
82+
```
83+
84+
Par exemple : INFO | GET on urn:v1:eu:resource:okms:8d1c84cc-1128-4629-xxxx-xxxxxxxxxxx/kmip/ff55638c-3e86-4cb3-xxxx-xxxxxxxx - identity: urn:v1:eu:identity:account:xx1111-ovh - operation: okms:kmip:get - from XXX.XXX.XXX.XXX with certificate e7850a19-a5de-4527-xxxx-xxxxxxxxx - request id: OKMS.db61c455-abfa-4a66-xxxx-xxxxxxxxxxx"
85+
86+
Les éléments pouvant être transmis à Logs Data Plateform étant :
87+
88+
|**Champ**|**Description**|
89+
| :-: | :-: |
90+
|domain_id|ID du domaine OKMS|
91+
|request_id|ID de la requête|
92+
|type||
93+
|log_level|Niveau de priorité du log|
94+
|client_ip|IP du client réalisant la requête|
95+
|tls_cert_id|ID du certificat utilisé pour l'authentification|
96+
|res_urn|URN de la ressource ciblé|
97+
|region|Région du domaine OKMS|
98+
|iam_operation|Action IAM évaluée|
99+
|iam_identities|Identitée IAM utilisé pour l'évaluation des droits|
100+
|kmip_operation|Opération KMIP utilisée|
101+
|kmip_reason|[code d'erreur KMIP](https://docs.oasis-open.org/kmip/spec/v1.4/kmip-spec-v1.4.pdf#%5B%7B%22num%22%3A484%2C%22gen%22%3A0%7D%2C%7B%22name%22%3A%22XYZ%22%7D%2C69%2C720%2C0%5D)|
102+
103+
## Aller plus loin
104+
105+
Échangez avec notre [communauté d'utilisateurs](/links/community).

‎pages/manage_and_operate/kms/kms-troubleshooting/images/kms-ldp-subscription.png

40.4 KB
Loading

‎pages/manage_and_operate/kms/kms-troubleshooting/images/kms-logs-tab.png

20.1 KB
Loading

‎pages/manage_and_operate/kms/kms-troubleshooting/meta.yaml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
id: 751e237a-47e4-4ac8-854d-189530462197
2+
full_slug: kms-troubleshooting
3+
reference_category: manage-operate-kms

0 commit comments

Comments
 (0)