Project: KICS (Provisioning / Security & Compliance)
File: 35c0a471-f7c8-4993-aa2c-503a3c712a66.md

title: Audit Log Maxsize Not Properly Set hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 35c0a471-f7c8-4993-aa2c-503a3c712a66 Query name: Audit Log Maxsize Not Properly Set Platform: Kubernetes Severity: <span style="color:#edd57e">Low</span> Category: Observability URL: When using kube-apiserver command, the '--audit-log-maxsize' flag should be defined and set to 100 or more MegaBytes<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="11" apiVersion: v1 kind: Pod metadata: name: command-demo labels: purpose: demonstrate-command spec: containers: name: command-demo-container image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 command: ["kube-apiserver"] args: ["--audit-log-maxsize=50"] restartPolicy: OnFailure ``` ```yaml title="Positive test num. 2 - yaml file" hl_lines="11" apiVersion: v1 kind: Pod metadata: name: command-demo labels: purpose: demonstrate-command spec: containers: name: command-demo-container image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 command: ["kube-apiserver"] args: [] restartPolicy: OnFailure ``` ```yaml title="Positive test num. 3 - yaml file" hl_lines="40 27 12 55" apiVersion: serving.knative.dev/v1 kind: Service metadata: name: dummy namespace: knative-sequence spec: template: spec: containers: name: command-demo-container image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 command: ["kube-apiserver"] args: ["--audit-log-maxsize=50"] restartPolicy: OnFailure apiVersion: serving.knative.dev/v1 kind: Configuration metadata: name: dummy-config namespace: knative-sequence spec: template: spec: containers: name: command-demo-container image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 command: ["kube-apiserver"] args: ["--audit-log-maxsize=50"] restartPolicy: OnFailure apiVersion: serving.knative.dev/v1 kind: Revision metadata: name: dummy-rev namespace: knative-sequence spec: containers: name: command-demo-container image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 command: ["kube-apiserver"] args: ["--audit-log-maxsize=50"] restartPolicy: OnFailure apiVersion: sources.knative.dev/v1 kind: ContainerSource metadata: name: dummy-cs namespace: knative-sequence spec: template: spec: containers: name: command-demo-container image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 command: ["kube-apiserver"] args: ["--audit-log-maxsize=50"] restartPolicy: OnFailure ``` ```yaml title="Negative test num. 1 - yaml file" apiVersion: v1 kind: Pod metadata: name: command-demo labels: purpose: demonstrate-command spec: containers: name: command-demo-container image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 command: ["kube-apiserver"] args: ["--audit-log-maxsize=150"] restartPolicy: OnFailure ``` ```yaml title="Negative test num. 2 - yaml file" apiVersion: v1 kind: Pod metadata: name: command-demo labels: purpose: demonstrate-command spec: containers: name: command-demo-container image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 command: ["kube-apiserver","--audit-log-maxsize=100"] args: [] restartPolicy: OnFailure ```