Chapter 7. Configuring audit logging policies You can control MicroShift audit log file rotation and retention by using configuration values. 7.1. About setting limits on audit log files Controlling the rotation and retention of the MicroShift audit log file by using configuration values helps keep the limited storage capacities of far-edge devices from being exceeded. On such devices, logging data accumulation can limit host system or cluster workloads, potentially causing the device stop working. Setting audit log policies can help ensure that critical processing space is continually available. The values you set to limit MicroShift audit logs enable you to enforce the size, number, and age limits of audit log backups. Field values are processed independently of one another and without prioritization. You can set fields in combination to define a maximum storage limit for retained logs. For example: Set both maxFileSize and maxFiles to create a log storage upper limit. Set a maxFileAge value to automatically delete files older than the timestamp in the file name, regardless of the maxFiles value. 7.1.1. Default audit log values MicroShift includes the following default audit log rotation values: Table 7.1. MicroShift default audit log values Audit log parameter Default setting Definition maxFileAge : 0 How long log files are retained before automatic deletion. The default value means that a log file is never deleted based on age. This value can be configured. maxFiles : 10 The total number of log files retained. By default, MicroShift retains 10 log files. The oldest is deleted when an excess file is created. This value can be configured. maxFileSize : 200 By default, when the audit.log file reaches the maxFileSize limit, the audit.log file is rotated and MicroShift begins writing to a new audit.log file. This value is in megabytes and can be configured. profile : Default The Default profile setting only logs metadata for read and write requests; request bodies are not logged except for OAuth access token requests. If you do not specify this field, the Default profile is used. The maximum default storage usage for audit log retention is 2000Mb if there are 10 or fewer files. If you do not specify a value for a field, the default value is used. If you remove a previously set field value, the default value is restored after the MicroShift service restart. Important You must configure audit log retention and rotation in Red Hat Enterprise Linux (RHEL) for logs that are generated by application pods. These logs print to the console and are saved. Ensure that your log preferences are configured for the RHEL /var/log/audit/audit.log file to maintain MicroShift cluster health. Additional resources Configuring auditd for a secure environment Understanding Audit log files How to use logrotate utility to rotate log files (Solutions, dated 7 August 2024) 7.2. About audit log policy profiles Audit log profiles define how to log requests that come to the OpenShift API server and the Kubernetes API server. MicroShift supports the following predefined audit policy profiles: Profile Description Default Logs only metadata for read and write requests; does not log request bodies except for OAuth access token requests. This is the default policy. WriteRequestBodies In addition to logging metadata for all requests, logs request bodies for every write request to the API servers ( create , update , patch , delete , deletecollection ). This profile has more resource overhead than the Default profile. [1] AllRequestBodies In addition to logging metadata for all requests, logs request bodies for every read and write request to the API servers ( get , list , create , update , patch ). This profile has the most resource overhead. [1] None No requests are logged, including OAuth access token requests and OAuth authorize token requests. Warning Do not disable audit logging by using the None profile unless you are fully aware of the risks of not logging data that can be beneficial when troubleshooting issues. If you disable audit logging and a support situation arises, you might need to enable audit logging and reproduce the issue to troubleshoot properly. Sensitive resources, such as Secret , Route , and OAuthClient objects, are only logged at the metadata level. By default, MicroShift uses the Default audit log profile. You can use another audit policy profile that also logs request bodies, but be aware of the increased resource usage such as CPU, memory, and I/O. 7.3. Configuring audit log values You can configure audit log settings by using the MicroShift service configuration file. Procedure Make a copy of the provided config.yaml.default file in the /etc/microshift/ directory, renaming it config.yaml . Keep the new MicroShift config.yaml you create in the /etc/microshift/ directory. The new config.yaml is read whenever the MicroShift service starts. After you create it, the config.yaml file takes precedence over built-in settings. Replace the default values in the auditLog section of the YAML with your desired valid values. Example default auditLog configuration apiServer: # .... auditLog: maxFileAge: 7 1 maxFileSize: 200 2 maxFiles: 1 3 profile: Default 4 # .... 1 Specifies the maximum time in days that log files are kept. Files older than this limit are deleted. In this example, after a log file is more than 7 days old, it is deleted. The files are deleted regardless of whether or not the live log has reached the maximum file size specified in the maxFileSize field. File age is determined by the timestamp written in the name of the rotated log file, for example, audit-2024-05-16T17-03-59.994.log . When the value is 0 , the limit is disabled. 2 The maximum audit log file size in megabytes. In this example, the file is rotated as soon as the live log reaches the 200 MB limit. When the value is set to 0 , the limit is disabled. 3 The maximum number of rotated audit log files retained. After the limit is reached, the log files are deleted in order from oldest to newest. In this example, the value 1 results in only 1 file of size maxFileSize being retained in addition to the current active log. When the value is set to 0 , the limit is disabled. 4 Logs only metadata for read and write requests; does not log request bodies except for OAuth access token requests. If you do not specify this field, the Default profile is used. Optional: To specify a new directory for logs, you can stop MicroShift, and then move the /var/log/kube-apiserver directory to your desired location: Stop MicroShift by running the following command: USD sudo systemctl stop microshift Move the /var/log/kube-apiserver directory to your desired location by running the following command: USD sudo mv /var/log/kube-apiserver <~/kube-apiserver> 1 1 Replace <~/kube-apiserver> with the path to the directory that you want to use. If you specified a new directory for logs, create a symlink to your custom directory at /var/log/kube-apiserver by running the following command: USD sudo ln -s <~/kube-apiserver> /var/log/kube-apiserver 1 1 Replace <~/kube-apiserver> with the path to the directory that you want to use. This enables the collection of logs in sos reports. If you are configuring audit log policies on a running instance, restart MicroShift by entering the following command: USD sudo systemctl restart microshift 7.4. Troubleshooting audit log configuration Use the following steps to troubleshoot custom audit log settings and file locations. Procedure Check the current values that are configured by running the following command: USD sudo microshift show-config --mode effective Example output auditLog: maxFileSize: 200 maxFiles: 1 maxFileAge: 7 profile: AllRequestBodies Check the audit.log file permissions by running the following command: USD sudo ls -ltrh /var/log/kube-apiserver/audit.log Example output -rw-------. 1 root root 46M Mar 12 09:52 /var/log/kube-apiserver/audit.log List the contents of the current log directory by running the following command: USD sudo ls -ltrh /var/log/kube-apiserver/ Example output total 6.0M -rw-------. 1 root root 2.0M Mar 12 10:56 audit-2024-03-12T14-56-16.267.log -rw-------. 1 root root 2.0M Mar 12 10:56 audit-2024-03-12T14-56-49.444.log -rw-------. 1 root root 962K Mar 12 10:57 audit.log

Commands:
apiServer: . auditLog: maxFileAge: 7 1 maxFileSize: 200 2 maxFiles: 1 3 profile: Default 4 .
sudo systemctl stop microshift
sudo mv /var/log/kube-apiserver <~/kube-apiserver> 1
sudo ln -s <~/kube-apiserver> /var/log/kube-apiserver 1
sudo systemctl restart microshift
sudo microshift show-config --mode effective
auditLog: maxFileSize: 200 maxFiles: 1 maxFileAge: 7 profile: AllRequestBodies
sudo ls -ltrh /var/log/kube-apiserver/audit.log
-rw-------. 1 root root 46M Mar 12 09:52 /var/log/kube-apiserver/audit.log
sudo ls -ltrh /var/log/kube-apiserver/
total 6.0M -rw-------. 1 root root 2.0M Mar 12 10:56 audit-2024-03-12T14-56-16.267.log -rw-------. 1 root root 2.0M Mar 12 10:56 audit-2024-03-12T14-56-49.444.log -rw-------. 1 root root 962K Mar 12 10:57 audit.log