selfhosted
/
coder
mirror of https://github.com/coder/coder.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity
coder/docs/admin/audit-logs.md

118 lines
26 KiB
Markdown
Raw Normal View History

docs: Add audit logs docs (#3975) * docs: Add audit logs docs * Apply suggestions from code review Co-authored-by: Joe Previte <jjprevite@gmail.com> * Add contact link Co-authored-by: Joe Previte <jjprevite@gmail.com>
2022-09-12 01:04:56 +00:00
# Audit Logs
chore(docs): update docs for correct use of shell and console and enforce linewidth (#9245)
2023-08-23 09:27:57 +00:00
Audit Logs allows **Auditors** to monitor user operations in their deployment.
docs: Add audit logs docs (#3975) * docs: Add audit logs docs * Apply suggestions from code review Co-authored-by: Joe Previte <jjprevite@gmail.com> * Add contact link Co-authored-by: Joe Previte <jjprevite@gmail.com>
2022-09-12 01:04:56 +00:00
## Tracked Events
chore: autogenerate audit log documentation (#5862) * added script for table creation * added tags to audit-logs.md * removed log * removed empty block line * PR feedback * modify check_unstaged * third times the charm maybe * spelling * relative path * excluding from the right script this time * sorted resources to ensure table order * running make cmd * running make again * ensuring order on subtable
2023-01-26 23:12:12 +00:00
We track the following resources:
<!-- Code generated by 'make docs/admin/audit-logs.md'. DO NOT EDIT -->
feat: add port-sharing backend (#11939)
2024-02-13 14:31:20 +00:00
| <b>Resource<b> | |
| -------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| APIKey<br><i>login, logout, register, create, delete</i> | <table><thead><tr><th>Field</th><th>Tracked</th></tr></thead><tbody><tr><td>created_at</td><td>true</td></tr><tr><td>expires_at</td><td>true</td></tr><tr><td>hashed_secret</td><td>false</td></tr><tr><td>id</td><td>false</td></tr><tr><td>ip_address</td><td>false</td></tr><tr><td>last_used</td><td>true</td></tr><tr><td>lifetime_seconds</td><td>false</td></tr><tr><td>login_type</td><td>false</td></tr><tr><td>scope</td><td>false</td></tr><tr><td>token_name</td><td>false</td></tr><tr><td>updated_at</td><td>false</td></tr><tr><td>user_id</td><td>true</td></tr></tbody></table> |
| AuditOAuthConvertState<br><i></i> | <table><thead><tr><th>Field</th><th>Tracked</th></tr></thead><tbody><tr><td>created_at</td><td>true</td></tr><tr><td>expires_at</td><td>true</td></tr><tr><td>from_login_type</td><td>true</td></tr><tr><td>to_login_type</td><td>true</td></tr><tr><td>user_id</td><td>true</td></tr></tbody></table> |
| Group<br><i>create, write, delete</i> | <table><thead><tr><th>Field</th><th>Tracked</th></tr></thead><tbody><tr><td>avatar_url</td><td>true</td></tr><tr><td>display_name</td><td>true</td></tr><tr><td>id</td><td>true</td></tr><tr><td>members</td><td>true</td></tr><tr><td>name</td><td>true</td></tr><tr><td>organization_id</td><td>false</td></tr><tr><td>quota_allowance</td><td>true</td></tr><tr><td>source</td><td>false</td></tr></tbody></table> |
| GitSSHKey<br><i>create</i> | <table><thead><tr><th>Field</th><th>Tracked</th></tr></thead><tbody><tr><td>created_at</td><td>false</td></tr><tr><td>private_key</td><td>true</td></tr><tr><td>public_key</td><td>true</td></tr><tr><td>updated_at</td><td>false</td></tr><tr><td>user_id</td><td>true</td></tr></tbody></table> |
| HealthSettings<br><i></i> | <table><thead><tr><th>Field</th><th>Tracked</th></tr></thead><tbody><tr><td>dismissed_healthchecks</td><td>true</td></tr><tr><td>id</td><td>false</td></tr></tbody></table> |
| License<br><i>create, delete</i> | <table><thead><tr><th>Field</th><th>Tracked</th></tr></thead><tbody><tr><td>exp</td><td>true</td></tr><tr><td>id</td><td>false</td></tr><tr><td>jwt</td><td>false</td></tr><tr><td>uploaded_at</td><td>true</td></tr><tr><td>uuid</td><td>true</td></tr></tbody></table> |
| Template<br><i>write, delete</i> | <table><thead><tr><th>Field</th><th>Tracked</th></tr></thead><tbody><tr><td>active_version_id</td><td>true</td></tr><tr><td>activity_bump</td><td>true</td></tr><tr><td>allow_user_autostart</td><td>true</td></tr><tr><td>allow_user_autostop</td><td>true</td></tr><tr><td>allow_user_cancel_workspace_jobs</td><td>true</td></tr><tr><td>autostart_block_days_of_week</td><td>true</td></tr><tr><td>autostop_requirement_days_of_week</td><td>true</td></tr><tr><td>autostop_requirement_weeks</td><td>true</td></tr><tr><td>created_at</td><td>false</td></tr><tr><td>created_by</td><td>true</td></tr><tr><td>created_by_avatar_url</td><td>false</td></tr><tr><td>created_by_username</td><td>false</td></tr><tr><td>default_ttl</td><td>true</td></tr><tr><td>deleted</td><td>false</td></tr><tr><td>deprecated</td><td>true</td></tr><tr><td>description</td><td>true</td></tr><tr><td>display_name</td><td>true</td></tr><tr><td>failure_ttl</td><td>true</td></tr><tr><td>group_acl</td><td>true</td></tr><tr><td>icon</td><td>true</td></tr><tr><td>id</td><td>true</td></tr><tr><td>max_port_sharing_level</td><td>true</td></tr><tr><td>max_ttl</td><td>true</td></tr><tr><td>name</td><td>true</td></tr><tr><td>organization_id</td><td>false</td></tr><tr><td>provisioner</td><td>true</td></tr><tr><td>require_active_version</td><td>true</td></tr><tr><td>time_til_dormant</td><td>true</td></tr><tr><td>time_til_dormant_autodelete</td><td>true</td></tr><tr><td>updated_at</td><td>false</td></tr><tr><td>use_max_ttl</td><td>true</td></tr><tr><td>user_acl</td><td>true</td></tr></tbody></table> |
| TemplateVersion<br><i>create, write</i> | <table><thead><tr><th>Field</th><th>Tracked</th></tr></thead><tbody><tr><td>archived</td><td>true</td></tr><tr><td>created_at</td><td>false</td></tr><tr><td>created_by</td><td>true</td></tr><tr><td>created_by_avatar_url</td><td>false</td></tr><tr><td>created_by_username</td><td>false</td></tr><tr><td>external_auth_providers</td><td>false</td></tr><tr><td>id</td><td>true</td></tr><tr><td>job_id</td><td>false</td></tr><tr><td>message</td><td>false</td></tr><tr><td>name</td><td>true</td></tr><tr><td>organization_id</td><td>false</td></tr><tr><td>readme</td><td>true</td></tr><tr><td>template_id</td><td>true</td></tr><tr><td>updated_at</td><td>false</td></tr></tbody></table> |
| User<br><i>create, write, delete</i> | <table><thead><tr><th>Field</th><th>Tracked</th></tr></thead><tbody><tr><td>avatar_url</td><td>false</td></tr><tr><td>created_at</td><td>false</td></tr><tr><td>deleted</td><td>true</td></tr><tr><td>email</td><td>true</td></tr><tr><td>hashed_password</td><td>true</td></tr><tr><td>id</td><td>true</td></tr><tr><td>last_seen_at</td><td>false</td></tr><tr><td>login_type</td><td>true</td></tr><tr><td>name</td><td>true</td></tr><tr><td>quiet_hours_schedule</td><td>true</td></tr><tr><td>rbac_roles</td><td>true</td></tr><tr><td>status</td><td>true</td></tr><tr><td>theme_preference</td><td>false</td></tr><tr><td>updated_at</td><td>false</td></tr><tr><td>username</td><td>true</td></tr></tbody></table> |
| Workspace<br><i>create, write, delete</i> | <table><thead><tr><th>Field</th><th>Tracked</th></tr></thead><tbody><tr><td>automatic_updates</td><td>true</td></tr><tr><td>autostart_schedule</td><td>true</td></tr><tr><td>created_at</td><td>false</td></tr><tr><td>deleted</td><td>false</td></tr><tr><td>deleting_at</td><td>true</td></tr><tr><td>dormant_at</td><td>true</td></tr><tr><td>favorite</td><td>true</td></tr><tr><td>id</td><td>true</td></tr><tr><td>last_used_at</td><td>false</td></tr><tr><td>name</td><td>true</td></tr><tr><td>organization_id</td><td>false</td></tr><tr><td>owner_id</td><td>true</td></tr><tr><td>template_id</td><td>true</td></tr><tr><td>ttl</td><td>true</td></tr><tr><td>updated_at</td><td>false</td></tr></tbody></table> |
| WorkspaceBuild<br><i>start, stop</i> | <table><thead><tr><th>Field</th><th>Tracked</th></tr></thead><tbody><tr><td>build_number</td><td>false</td></tr><tr><td>created_at</td><td>false</td></tr><tr><td>daily_cost</td><td>false</td></tr><tr><td>deadline</td><td>false</td></tr><tr><td>id</td><td>false</td></tr><tr><td>initiator_by_avatar_url</td><td>false</td></tr><tr><td>initiator_by_username</td><td>false</td></tr><tr><td>initiator_id</td><td>false</td></tr><tr><td>job_id</td><td>false</td></tr><tr><td>max_deadline</td><td>false</td></tr><tr><td>provisioner_state</td><td>false</td></tr><tr><td>reason</td><td>false</td></tr><tr><td>template_version_id</td><td>true</td></tr><tr><td>transition</td><td>false</td></tr><tr><td>updated_at</td><td>false</td></tr><tr><td>workspace_id</td><td>false</td></tr></tbody></table> |
| WorkspaceProxy<br><i></i> | <table><thead><tr><th>Field</th><th>Tracked</th></tr></thead><tbody><tr><td>created_at</td><td>true</td></tr><tr><td>deleted</td><td>false</td></tr><tr><td>derp_enabled</td><td>true</td></tr><tr><td>derp_only</td><td>true</td></tr><tr><td>display_name</td><td>true</td></tr><tr><td>icon</td><td>true</td></tr><tr><td>id</td><td>true</td></tr><tr><td>name</td><td>true</td></tr><tr><td>region_id</td><td>true</td></tr><tr><td>token_hashed_secret</td><td>true</td></tr><tr><td>updated_at</td><td>false</td></tr><tr><td>url</td><td>true</td></tr><tr><td>version</td><td>true</td></tr><tr><td>wildcard_hostname</td><td>true</td></tr></tbody></table> |
chore: autogenerate audit log documentation (#5862) * added script for table creation * added tags to audit-logs.md * removed log * removed empty block line * PR feedback * modify check_unstaged * third times the charm maybe * spelling * relative path * excluding from the right script this time * sorted resources to ensure table order * running make cmd * running make again * ensuring order on subtable
2023-01-26 23:12:12 +00:00
<!-- End generated by 'make docs/admin/audit-logs.md'. -->
docs: Add audit logs docs (#3975) * docs: Add audit logs docs * Apply suggestions from code review Co-authored-by: Joe Previte <jjprevite@gmail.com> * Add contact link Co-authored-by: Joe Previte <jjprevite@gmail.com>
2022-09-12 01:04:56 +00:00
feat: Add audit logs filtering to the UI (#4120)
2022-09-20 00:28:23 +00:00
## Filtering logs
chore(docs): update docs for correct use of shell and console and enforce linewidth (#9245)
2023-08-23 09:27:57 +00:00
In the Coder UI you can filter your audit logs using the pre-defined filter or
by using the Coder's filter query like the examples below:
feat: Add audit logs filtering to the UI (#4120)
2022-09-20 00:28:23 +00:00
- `resource_type:workspace action:delete` to find deleted workspaces
- `resource_type:template action:create` to find created templates
The supported filters are:
chore(docs): update docs for correct use of shell and console and enforce linewidth (#9245)
2023-08-23 09:27:57 +00:00
- `resource_type` - The type of the resource. It can be a workspace, template,
user, etc. You can
[find here](https://pkg.go.dev/github.com/coder/coder/v2/codersdk#ResourceType)
all the resource types that are supported.
docs: Add missing audit logs filtering fields (#4133) * docs: Add missing audit logs filtering fields * Update docs/admin/audit-logs.md Co-authored-by: Ben Potter <ben@coder.com> Co-authored-by: Ben Potter <ben@coder.com>
2022-09-20 17:44:00 +00:00
- `resource_id` - The ID of the resource.
chore(docs): update docs for correct use of shell and console and enforce linewidth (#9245)
2023-08-23 09:27:57 +00:00
- `resource_target` - The name of the resource. Can be used instead of
`resource_id`.
- `action`- The action applied to a resource. You can
[find here](https://pkg.go.dev/github.com/coder/coder/v2/codersdk#AuditAction)
all the actions that are supported.
- `username` - The username of the user who triggered the action. You can also
use `me` as a convenient alias for the logged-in user.
docs: Add missing audit logs filtering fields (#4133) * docs: Add missing audit logs filtering fields * Update docs/admin/audit-logs.md Co-authored-by: Ben Potter <ben@coder.com> Co-authored-by: Ben Potter <ben@coder.com>
2022-09-20 17:44:00 +00:00
- `email` - The email of the user who triggered the action.
Audit date filter/kira pilot (#4845) * sql query * added time_to * added validation error * documentation * attempt to add test * removed whiitespace * fix: ensure date_from and date_to are applied correct audit logs * added more tests * ran make gen * PR feedback Co-authored-by: Dean Sheather <dean@deansheather.com>
2022-11-03 15:04:36 +00:00
- `date_from` - The inclusive start date with format `YYYY-MM-DD`.
feat: add audit log filter for autostarted and autostopped workspace builds (#5830) * added query * fixed query * added example to dropdown * added documentation * added test * fixed formatting * fixed format
2023-01-24 20:34:29 +00:00
- `date_to` - The inclusive end date with format `YYYY-MM-DD`.
chore(docs): update docs for correct use of shell and console and enforce linewidth (#9245)
2023-08-23 09:27:57 +00:00
- `build_reason` - To be used with `resource_type:workspace_build`, the
[initiator](https://pkg.go.dev/github.com/coder/coder/v2/codersdk#BuildReason)
behind the build start or stop.
feat: Add audit logs filtering to the UI (#4120)
2022-09-20 00:28:23 +00:00
fix(docs): capture and export audit logs (#7991) * hotfix(docs): Capturing/exporting audit logs We frequntly get questions about this! * fmt
2023-06-13 04:06:58 +00:00
## Capturing/Exporting Audit Logs
chore(docs): update docs for correct use of shell and console and enforce linewidth (#9245)
2023-08-23 09:27:57 +00:00
In addition to the user interface, there are multiple ways to consume or query
audit trails.
fix(docs): capture and export audit logs (#7991) * hotfix(docs): Capturing/exporting audit logs We frequntly get questions about this! * fmt
2023-06-13 04:06:58 +00:00
## REST API
chore(docs): update docs for correct use of shell and console and enforce linewidth (#9245)
2023-08-23 09:27:57 +00:00
Audit logs can be accessed through our REST API. You can find detailed
information about this in our
[endpoint documentation](../api/audit.md#get-audit-logs).
fix(docs): capture and export audit logs (#7991) * hotfix(docs): Capturing/exporting audit logs We frequntly get questions about this! * fmt
2023-06-13 04:06:58 +00:00
## Service Logs
chore(docs): update docs for correct use of shell and console and enforce linewidth (#9245)
2023-08-23 09:27:57 +00:00
Audit trails are also dispatched as service logs and can be captured and
categorized using any log management tool such as [Splunk](https://splunk.com).
fix(docs): capture and export audit logs (#7991) * hotfix(docs): Capturing/exporting audit logs We frequntly get questions about this! * fmt
2023-06-13 04:06:58 +00:00
chore: fix broken docs links (#8198) * chore: add examples templates to docs filter * chore: fix broken docs links * Discard changes to .github/workflows/ci.yaml
2023-06-27 12:20:57 +00:00
Example of a [JSON formatted](../cli/server.md#--log-json) audit log entry:
fix(docs): capture and export audit logs (#7991) * hotfix(docs): Capturing/exporting audit logs We frequntly get questions about this! * fmt
2023-06-13 04:06:58 +00:00
```json
{
"ts": "2023-06-13T03:45:37.294730279Z",
"level": "INFO",
"msg": "audit_log",
"caller": "/home/runner/work/coder/coder/enterprise/audit/backends/slog.go:36",
"func": "github.com/coder/coder/enterprise/audit/backends.slogBackend.Export",
"logger_names": ["coderd"],
"fields": {
"ID": "033a9ffa-b54d-4c10-8ec3-2aaf9e6d741a",
"Time": "2023-06-13T03:45:37.288506Z",
"UserID": "6c405053-27e3-484a-9ad7-bcb64e7bfde6",
"OrganizationID": "00000000-0000-0000-0000-000000000000",
"Ip": "{IPNet:{IP:\u003cnil\u003e Mask:\u003cnil\u003e} Valid:false}",
"UserAgent": "{String: Valid:false}",
"ResourceType": "workspace_build",
"ResourceID": "ca5647e0-ef50-4202-a246-717e04447380",
"ResourceTarget": "",
"Action": "start",
"Diff": {},
"StatusCode": 200,
"AdditionalFields": {
"workspace_name": "linux-container",
"build_number": "9",
"build_reason": "initiator",
"workspace_owner": ""
},
"RequestID": "bb791ac3-f6ee-4da8-8ec2-f54e87013e93",
"ResourceIcon": ""
}
}
```
chore: fix broken docs links (#8198) * chore: add examples templates to docs filter * chore: fix broken docs links * Discard changes to .github/workflows/ci.yaml
2023-06-27 12:20:57 +00:00
Example of a [human readable](../cli/server.md#--log-human) audit log entry:
fix(docs): capture and export audit logs (#7991) * hotfix(docs): Capturing/exporting audit logs We frequntly get questions about this! * fmt
2023-06-13 04:06:58 +00:00
chore(docs): update docs for correct use of shell and console and enforce linewidth (#9245)
2023-08-23 09:27:57 +00:00
```console
fix(docs): capture and export audit logs (#7991) * hotfix(docs): Capturing/exporting audit logs We frequntly get questions about this! * fmt
2023-06-13 04:06:58 +00:00
2023-06-13 03:43:29.233 [info] coderd: audit_log ID=95f7c392-da3e-480c-a579-8909f145fbe2 Time="2023-06-13T03:43:29.230422Z" UserID=6c405053-27e3-484a-9ad7-bcb64e7bfde6 OrganizationID=00000000-0000-0000-0000-000000000000 Ip=<nil> UserAgent=<nil> ResourceType=workspace_build ResourceID=988ae133-5b73-41e3-a55e-e1e9d3ef0b66 ResourceTarget="" Action=start Diff="{}" StatusCode=200 AdditionalFields="{\"workspace_name\":\"linux-container\",\"build_number\":\"7\",\"build_reason\":\"initiator\",\"workspace_owner\":\"\"}" RequestID=9682b1b5-7b9f-4bf2-9a39-9463f8e41cd6 ResourceIcon=""
```
docs: Add audit logs docs (#3975) * docs: Add audit logs docs * Apply suggestions from code review Co-authored-by: Joe Previte <jjprevite@gmail.com> * Add contact link Co-authored-by: Joe Previte <jjprevite@gmail.com>
2022-09-12 01:04:56 +00:00
## Enabling this feature
chore(docs): update docs for correct use of shell and console and enforce linewidth (#9245)
2023-08-23 09:27:57 +00:00
This feature is only available with an enterprise license.
[Learn more](../enterprise.md)