<html><body>
<p><font size="2" face="sans-serif">hi Folks,</font><br>
<br>
<font size="2" face="sans-serif">just wanted to bring everyone's attention to this blueprint we have in Ceilometer: </font><a href="https://blueprints.launchpad.net/ceilometer/+spec/support-standard-audit-formats"><font size="3" face="serif"><u>https://blueprints.launchpad.net/ceilometer/+spec/support-standard-audit-formats</u></font></a><font size="3" face="serif"> </font><font size="2" face="sans-serif">(detailed bp: </font><a href="https://wiki.openstack.org/wiki/Ceilometer/blueprints/support-standard-audit-formats#Provide_support_for_auditing_events_in_standardized_formats"><font size="3" face="serif"><u>https://wiki.openstack.org/wiki/Ceilometer/blueprints/support-standard-audit-formats#Provide_support_for_auditing_events_in_standardized_formats</u></font></a><font size="3" face="serif"> </font><font size="2" face="sans-serif">)</font><br>
<br>
<font size="2" face="sans-serif">as a little background, there are many projects that use Ceilometer to track usage information for statistical usage analysis and billing. these projects are seeing similar auditing requirements which are missing currently. the above blueprint's proposal is to add support for auditing APIs access using the Distributed Mgmt. Task Force’s (DMTF) “Cloud Audit” standard (CADF). you can read further into the spec via the latest public draft here: </font><font size="3" face="serif"> </font><font size="3" face="serif"><a href="http://dmtf.org/sites/default/files/standards/documents/DSP0262_1.0.0a_0.pdf">http://dmtf.org/sites/default/files/standards/documents/DSP0262_1.0.0a_0.pdf</a></font><font size="2" face="sans-serif"> but to highlight the standard, it is an open standard developed by multiple enterprises -- IBM, NetIQ, Microsoft, VMware, </font><font size="2" face="Arial">and Fujitsu</font><font size="2" face="sans-serif"> to name a few. Also, the model is regulatory compliant (e.g. PCI-DSS, SoX, ISO 27017, etc.) and extensible so it should adapt to a broad range of uses.</font><br>
<br>
<font size="2" face="sans-serif">initially, we drafted this to be part of Ceilometer but as we've worked through it, we've noticed it is applicable in multiple projects. during the course of our discussions with Keystone developers to assure we were recording the correct data for audit, we found that Keystone itself had a blueprint to add notifications and log audit data for their APIs: </font><a href="https://blueprints.launchpad.net/keystone/+spec/notifications"><font size="3" face="serif"><u>https://blueprints.launchpad.net/keystone/+spec/notifications</u></font></a><font size="3" face="serif">.</font><font size="2" face="sans-serif"><br>
</font><br>
<font size="2" face="sans-serif">i thought i'd present this on the mailing list to gather feedback on the idea of adopting CADF and discuss possibly its inclusion in Oslo so that all the projects can use the same open standard when capturing events.</font><br>
<font size="2" face="sans-serif"><br>
cheers, </font><br>
<font size="2" face="sans-serif"><br>
gordon chung<br>
<br>
openstack, ibm software standards<br>
email: chungg@ca.ibm.com</font></body></html>