Audit log export?

alssi

Hi,

We are using XO from sources and also the audit plugin to identify what users are doing.
As a bonus, we would like to export those logs into a remote server (via syslog for example).

I couldn't find anything related or any documentation / Discussion on the subject. Is it something we can do ?

Thanks

olivierlambert

Hi!

There's no audit log export at the moment (from the UI at least), except if you use XOA, where you can save chain integrity hosted on xen-orchestra.com

However, I think you might use CLI to get those record and export them somehow. @julien-f or @badrAZ might be helpful here

badrAZ

Hi,

Currently, it's not possible to export logs into a remote, but you can export them locally on clicking on the button Download records.

alssi

Thanks for your quick answers.

What about the CLI xo-server-logs then ?
It seems to export only error logs, does these logs comes from audit logs and is it possible to change the severity in order to get all logs ?

I think that it can do the job especially if it generate json, that's something that we can easily pipe into a analyse tool like an elastic stack. I think it can be ok if it async (via crontab for example).

badrAZ

Hi,

Audit logs aren't in the same location than the xo-server logs.

To get Audit logs you can use this command xo-cli audit.getRecords which returns an array of records.

xo-cli audit.getRecords

This command has an option ndjson, which allows you to export logs in a ndjson format.

xo-cli audit.getRecords ndjson="json:true" @=<outputPath>