Re: Use case not covered by the audit library?

> No, this is an HTTP server that handles standard HTTP requests like GET, > POST, PUT, and DELETE. The URI specifies what resource is being acted > upon. These requests could come from something as simple as curl, or a > full blown management application, or a web GUI (which is interactive in > the browser). For example, you could issue a POST request to URI > /openswitch/v1/users to create a new user. The body of the request would > contain JSON or XML data indicating the user and password. There are > pre-determined actions/resources that can be changed. In standard REST > APIs, all of the URIs, their parameters and the scheme of the body are > documented and only these requests can be issued.> > > > It's based on client/server and the client may or may not be interactive > (e.g. a web browser). In these types of servers, we'd almost > exclusively be using the audit_log_user_message() API with an event type > of AUDIT_USYS_CONFIG. We're only logging configuration changes to the > switch. I think I don't understand how the "message" parameter is used > in this call. The man page implies a simple text message, but looking at > the audit.log file it appears to consist of a set of key-value > pairs. Is my understanding correct?> > > > My problem is I don't know what the proper set of "keys" are and the > values they should contain. If my assumptions are correct, is there any > documentation on on the key-value pairs and how to format the contents of > the message parameter? Based on what I've seen in the audit log file, I > would add "acct=<user>" to the contents of the message to reflect the > particular authenticated user who issued the REST API call. Well, Steve has published these as a starting point. I'm sure he'll chime in when he sees your message. http://people.redhat.com/sgrubb/audit/audit-events.txt http://people.redhat.com/sgrubb/audit/audit-parse.txt