<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><span style="font-family: Optima-Regular;" class="">Hi,</span><br style="font-family: Optima-Regular;" class=""><br style="font-family: Optima-Regular;" class=""><span style="font-family: Optima-Regular;" class="">I’ve been trying to get the API audit data flowing based on this document: </span><br style="font-family: Optima-Regular;" class=""><br style="font-family: Optima-Regular;" class=""><a href="http://docs.openstack.org/developer/keystonemiddleware/audit.html" style="font-family: Optima-Regular;" class="">http://docs.openstack.org/developer/keystonemiddleware/audit.html</a><br style="font-family: Optima-Regular;" class=""><br style="font-family: Optima-Regular;" class=""><span style="font-family: Optima-Regular;" class="">So far, I’ve been able to get nova, cinder, and glance to do the right thing,</span><br style="font-family: Optima-Regular;" class=""><span style="font-family: Optima-Regular;" class="">but neutron doesn’t seem to want to play. I am getting some events through</span><br style="font-family: Optima-Regular;" class=""><span style="font-family: Optima-Regular;" class="">to ceilometer. For example, when I create a port, I get a start and end </span><br style="font-family: Optima-Regular;" class=""><span style="font-family: Optima-Regular;" class="">event similar to this:</span><br style="font-family: Optima-Regular;" class=""><br style="font-family: Optima-Regular;" class=""><span style="font-family: Optima-Regular;" class="">{ </span><br style="font-family: Optima-Regular;" class=""><span style="font-family: Optima-Regular;" class=""> "_index": "events_2015-07-17",</span><br style="font-family: Optima-Regular;" class=""><span style="font-family: Optima-Regular;" class=""> "_type": "port.create.end",</span><br style="font-family: Optima-Regular;" class=""><span style="font-family: Optima-Regular;" class=""> "_id": "e1dbf819-3e77-4357-b8db-83a359ef7cd9",</span><br style="font-family: Optima-Regular;" class=""><span style="font-family: Optima-Regular;" class=""> "raw": { },</span><br style="font-family: Optima-Regular;" class=""><span style="font-family: Optima-Regular;" class=""> "timestamp": "2015-07-17T23:10:37.846477",</span><br style="font-family: Optima-Regular;" class=""><span style="font-family: Optima-Regular;" class=""> "traits": {</span><br style="font-family: Optima-Regular;" class=""><span class="Apple-tab-span" style="font-family: Optima-Regular; white-space: pre;"> </span><span style="font-family: Optima-Regular;" class="">"user_id": "e70fcebd828349ca8f1393e62ac87756",</span><br style="font-family: Optima-Regular;" class=""><span class="Apple-tab-span" style="font-family: Optima-Regular; white-space: pre;"> </span><span style="font-family: Optima-Regular;" class="">"service": "</span><a href="http://network.myhost.com" style="font-family: Optima-Regular;" class="">network.myhost.com</a><span style="font-family: Optima-Regular;" class="">",</span><br style="font-family: Optima-Regular;" class=""><span class="Apple-tab-span" style="font-family: Optima-Regular; white-space: pre;"> </span><span style="font-family: Optima-Regular;" class="">"resource_id": "09c1388a-59fe-49e9-bb17-fb353fd8dd3a",</span><br style="font-family: Optima-Regular;" class=""><span class="Apple-tab-span" style="font-family: Optima-Regular; white-space: pre;"> </span><span style="font-family: Optima-Regular;" class="">"tenant_id": "970f2364df174040862210c9185c80ce",</span><br style="font-family: Optima-Regular;" class=""><span class="Apple-tab-span" style="font-family: Optima-Regular; white-space: pre;"> </span><span style="font-family: Optima-Regular;" class="">"request_id": "req-3e2722e6-1903-477c-9523-2e4926caa6fb",</span><br style="font-family: Optima-Regular;" class=""><span class="Apple-tab-span" style="font-family: Optima-Regular; white-space: pre;"> </span><span style="font-family: Optima-Regular;" class="">"project_id": "970f2364df174040862210c9185c80ce"</span><br style="font-family: Optima-Regular;" class=""><span style="font-family: Optima-Regular;" class="">}</span><br style="font-family: Optima-Regular;" class=""><br style="font-family: Optima-Regular;" class=""><span style="font-family: Optima-Regular;" class="">For other services, I’ll see a CADF formatted http.request.audit event.</span><br style="font-family: Optima-Regular;" class=""><br style="font-family: Optima-Regular;" class=""><span style="font-family: Optima-Regular;" class="">Here are the edits I’ve made to /etc/neutron/api-paste.ini file:</span><br style="font-family: Optima-Regular;" class=""><br style="font-family: Optima-Regular;" class=""><span style="font-family: Optima-Regular;" class=""># added the audit filter to the keystone pipeline after authtoken</span><br style="font-family: Optima-Regular;" class=""><span style="font-family: Optima-Regular;" class="">[composite:neutronapi_v2_0]</span><br style="font-family: Optima-Regular;" class=""><span style="font-family: Optima-Regular;" class="">use = call:neutron.auth:pipeline_factory</span><br style="font-family: Optima-Regular;" class=""><span style="font-family: Optima-Regular;" class="">noauth = request_id catch_errors extensions neutronapiapp_v2_0</span><br style="font-family: Optima-Regular;" class=""><span style="font-family: Optima-Regular;" class="">keystone = request_id catch_errors authtoken keystonecontext audit extensions neutronapiapp_v2_0</span><br style="font-family: Optima-Regular;" class=""><br style="font-family: Optima-Regular;" class=""><br style="font-family: Optima-Regular;" class=""><span style="font-family: Optima-Regular;" class=""># added the audit filter</span><br style="font-family: Optima-Regular;" class=""><span style="font-family: Optima-Regular;" class="">[filter:audit]</span><br style="font-family: Optima-Regular;" class=""><span style="font-family: Optima-Regular;" class="">paste.filter_factory = keystonemiddleware.audit:filter_factory</span><br style="font-family: Optima-Regular;" class=""><span style="font-family: Optima-Regular;" class="">audit_map_file = /etc/neutron/neutron_api_audit_map.conf</span><br style="font-family: Optima-Regular;" class=""><br style="font-family: Optima-Regular;" class=""><span style="font-family: Optima-Regular;" class="">The map file is snagged from here:</span><br style="font-family: Optima-Regular;" class=""><br style="font-family: Optima-Regular;" class=""><a href="https://github.com/openstack/pycadf/blob/master/etc/pycadf/neutron_api_audit_map.conf" style="font-family: Optima-Regular;" class="">https://github.com/openstack/pycadf/blob/master/etc/pycadf/neutron_api_audit_map.conf</a><br style="font-family: Optima-Regular;" class=""><br style="font-family: Optima-Regular;" class=""><span style="font-family: Optima-Regular;" class="">Any suggestions, war stories, requests for more detail, etc. are greatly appreciated.</span><br style="font-family: Optima-Regular;" class=""><br style="font-family: Optima-Regular;" class=""><br style="font-family: Optima-Regular;" class=""><span style="font-family: Optima-Regular;" class="">Thanks,</span><br style="font-family: Optima-Regular;" class=""><span style="font-family: Optima-Regular;" class="">John</span><span class="Apple-tab-span" style="font-family: Optima-Regular; white-space: pre;"> </span><span class="Apple-tab-span" style="font-family: Optima-Regular; white-space: pre;"> </span><span class="Apple-tab-span" style="font-family: Optima-Regular; white-space: pre;"> </span><span class="Apple-tab-span" style="font-family: Optima-Regular; white-space: pre;"> </span><span class="Apple-tab-span" style="font-family: Optima-Regular; white-space: pre;"> </span><span class="Apple-tab-span" style="font-family: Optima-Regular; white-space: pre;"> </span><span class="Apple-tab-span" style="font-family: Optima-Regular; white-space: pre;"> </span><span class="Apple-tab-span" style="font-family: Optima-Regular; white-space: pre;"> </span><span class="Apple-tab-span" style="font-family: Optima-Regular; white-space: pre;"> </span><span class="Apple-tab-span" style="font-family: Optima-Regular; white-space: pre;"> </span><div class=""><span style="font-family: Optima-Regular;" class="">@jxstanford</span><br style="font-family: Optima-Regular;" class=""><div apple-content-edited="true" class=""><br class=""></div></div></body></html>