https://openbao.org/assets/js/154d2736.bba89e3c.js

1"use strict";(self.webpackChunkwebsite=self.webpackChunkwebsite||[]).push([["10040"],{37440(e,i,n){n.r(i),n.d(i,{metadata:()=>t,default:()=>h,frontMatter:()=>a,contentTitle:()=>d,toc:()=>r,assets:()=>l});var t=JSON.parse('{"id":"audit/file","title":"File audit device","description":"The \\"file\\" audit device writes audit logs to a file.","source":"@site/versioned_docs/version-2.7.x/audit/file.mdx","sourceDirName":"audit","slug":"/audit/file","permalink":"/docs/audit/file","draft":false,"unlisted":false,"editUrl":"https://github.com/openbao/openbao/blob/release/2.7.x/website/content/docs/audit/file.mdx","tags":[],"version":"2.7.x","frontMatter":{"sidebar_label":"File","description":"The \\"file\\" audit device writes audit logs to a file."},"sidebar":"docs","previous":{"title":"Overview","permalink":"/docs/audit/"},"next":{"title":"HTTP","permalink":"/docs/audit/http"}}'),o=n(94686),s=n(44812);let a={sidebar_label:"File",description:'The "file" audit device writes audit logs to a file.'},d="File audit device",l={},r=[{value:"Examples",id:"examples",level:2},{value:"Configuration",id:"configuration",level:2},{value:"Log file rotation",id:"log-file-rotation",level:2}];function c(e){let i={a:"a",admonition:"admonition",code:"code",h1:"h1",h2:"h2",header:"header",li:"li",p:"p",pre:"pre",ul:"ul",...(0,s.R)(),...e.components};return(0,o.jsxs)(o.Fragment,{children:[(0,o.jsx)(i.header,{children:(0,o.jsx)(i.h1,{id:"file-audit-device",children:"File audit device"})}),"\n",(0,o.jsxs)(i.p,{children:["The ",(0,o.jsx)(i.code,{children:"file"})," audit device writes audit logs to a file. This is a very simple audit\ndevice: it appends logs to a file."]}),"\n",(0,o.jsx)(i.p,{children:"The device does not currently assist with any log rotation. There are very\nstable and feature-filled log rotation tools already, so we recommend using\nexisting tools."}),"\n",(0,o.jsxs)(i.p,{children:["Sending a ",(0,o.jsx)(i.code,{children:"SIGHUP"})," to the OpenBao process will cause ",(0,o.jsx)(i.code,{children:"file"})," audit devices to close\nand re-open their underlying file, which can assist with log rotation needs."]}),"\n",(0,o.jsxs)(i.admonition,{type:"warning",children:[(0,o.jsxs)(i.p,{children:["The File audit device is sensitive as it can write to arbitrary files on the\ninstance. Be cautious when granting operators the ability to create this\ndevice via the API when ",(0,o.jsx)(i.code,{children:"unsafe_allow_api_audit_creation=true"})," is set."]}),(0,o.jsxs)(i.p,{children:["Consider using ",(0,o.jsx)(i.a,{href:"/docs/configuration/audit",children:"declarative audit configuration"}),"\ninstead."]})]}),"\n",(0,o.jsx)(i.h2,{id:"examples",children:"Examples"}),"\n",(0,o.jsx)(i.p,{children:"Enable at the default path:"}),"\n",(0,o.jsx)(i.pre,{children:(0,o.jsx)(i.code,{className:"language-shell-session",children:"$ bao audit enable file file_path=/var/log/openbao_audit.log\n"})}),"\n",(0,o.jsx)(i.p,{children:"Enable at a different path. It is possible to enable multiple copies of an audit\ndevice:"}),"\n",(0,o.jsx)(i.pre,{children:(0,o.jsx)(i.code,{className:"language-shell-session",children:'$ bao audit enable -path="openbao_audit_1" file file_path=/home/user/openbao_audit.log\n'})}),"\n",(0,o.jsx)(i.p,{children:"Enable logs on stdout. This is useful when running in a container:"}),"\n",(0,o.jsx)(i.pre,{children:(0,o.jsx)(i.code,{className:"language-shell-session",children:"$ bao audit enable file file_path=stdout\n"})}),"\n",(0,o.jsx)(i.h2,{id:"configuration",children:"Configuration"}),"\n",(0,o.jsxs)(i.p,{children:["Note the difference between ",(0,o.jsx)(i.code,{children:"audit enable"})," command options and the ",(0,o.jsx)(i.code,{children:"file"})," backend\nconfiguration options. Use ",(0,o.jsx)(i.code,{children:"bao audit enable -help"})," to see the command options."]}),"\n",(0,o.jsxs)(i.p,{children:["The ",(0,o.jsx)(i.code,{children:"file"})," audit device supports the common configuration options documented on\nthe ",(0,o.jsx)(i.a,{href:"/docs/audit/#common-configuration-options",children:"main Audit Devices page"}),", and\nthese device-specific options:"]}),"\n",(0,o.jsxs)(i.ul,{children:["\n",(0,o.jsxs)(i.li,{children:["\n",(0,o.jsxs)(i.p,{children:[(0,o.jsx)(i.co

1de,{children:"file_path"})," ",(0,o.jsx)(i.code,{children:"(string: <required>)"})," - The path to where the audit log will be\nwritten. If a file already exists at the given path, the audit backend will\nappend to it. There are some special keywords:"]}),"\n",(0,o.jsxs)(i.ul,{children:["\n",(0,o.jsxs)(i.li,{children:["\n",(0,o.jsxs)(i.p,{children:[(0,o.jsx)(i.code,{children:"stdout"})," writes the audit log to standard output"]}),"\n"]}),"\n",(0,o.jsxs)(i.li,{children:["\n",(0,o.jsxs)(i.p,{children:[(0,o.jsx)(i.code,{children:"discard"})," discards output, instead of writing it to a device (useful in testing scenarios)"]}),"\n"]}),"\n"]}),"\n"]}),"\n",(0,o.jsxs)(i.li,{children:["\n",(0,o.jsxs)(i.p,{children:[(0,o.jsx)(i.code,{children:"mode"})," ",(0,o.jsx)(i.code,{children:'(string: "0600")'})," - A string containing an octal number representing\nthe bit pattern for the file mode, similar to ",(0,o.jsx)(i.code,{children:"chmod"}),". Set to ",(0,o.jsx)(i.code,{children:'"0000"'})," to\nprevent OpenBao from modifying the file mode."]}),"\n",(0,o.jsx)(i.admonition,{type:"warning",children:(0,o.jsxs)(i.p,{children:["Note: Starting with OpenBao v2.4.0, any executable bits set in ",(0,o.jsx)(i.code,{children:"mode"})," are\nzeroed automatically, for security purposes. For example, ",(0,o.jsx)(i.code,{children:"mode = 777"})," will\nconvert to ",(0,o.jsx)(i.code,{children:"mode = 666"}),". Furthermore, ",(0,o.jsx)(i.code,{children:"mode"})," values that are\n",(0,o.jsx)(i.a,{href:"https://pkg.go.dev/io/fs#FileMode.IsRegular",children:"irregular"})," are rejected with an\nerror."]})}),"\n"]}),"\n"]}),"\n",(0,o.jsx)(i.h2,{id:"log-file-rotation",children:"Log file rotation"}),"\n",(0,o.jsxs)(i.p,{children:["To properly rotate OpenBao File Audit Device log files on BSD, Darwin, or Linux-based OpenBao servers, it is important that you configure your log rotation software to send the ",(0,o.jsx)(i.code,{children:"bao"})," process a signal hang up / ",(0,o.jsx)(i.code,{children:"SIGHUP"})," after each rotation of the log file."]})]})}function h(e={}){let{wrapper:i}={...(0,s.R)(),...e.components};return i?(0,o.jsx)(i,{...e,children:(0,o.jsx)(c,{...e})}):c(e)}},44812(e,i,n){n.d(i,{R:()=>a,x:()=>d});var t=n(92990);let o={},s=t.createContext(o);function a(e){let i=t.useContext(s);return t.useMemo(function(){return"function"==typeof e?e(i):{...i,...e}},[i,e])}function d(e){let i;return i=e.disableParentContext?"function"==typeof e.components?e.components(o):e.components||o:a(e.components),t.createElement(s.Provider,{value:i},e.children)}}}]);