docs/auditlog.html.in

   1 <?xml version="1.0" encoding="UTF-8"?>
   2 <!DOCTYPE html>
   3 <html xmlns="http://www.w3.org/1999/xhtml">
   4   <body>
   5     <h1>Audit log</h1>
   6
   7     <ul id="toc"></ul>
   8
   9     <h2><a id="intro">Introduction</a></h2>
  10
  11     <p>
  12       A number of the libvirt virtualization drivers (QEMU/KVM and LXC) include
  13       support for logging details of important operations to the host's audit
  14       subsystem. This provides administrators / auditors with a canonical historical
  15       record of changes to virtual machines' / containers' lifecycle states and
  16       their configuration. On hosts which are running the Linux audit daemon,
  17       the logs will usually end up in <code>/var/log/audit/audit.log</code>
  18     </p>
  19
  20     <h2><a id="config">Configuration</a></h2>
  21
  22     <p>
  23       The libvirt audit integration is enabled by default on any host which has
  24       the Linux audit subsystem active, and disabled otherwise. It is possible
  25       to alter this behaviour in the <code>/etc/libvirt/libvirtd.conf</code>
  26       configuration file, via the <code>audit_level</code> parameter
  27     </p>
  28
  29     <ul>
  30       <li><code>audit_level=0</code> - libvirt auditing is disabled regardless
  31         of host audit subsystem enablement.</li>
  32       <li><code>audit_level=1</code> - libvirt auditing is enabled if the host
  33         audit subsystem is enabled, otherwise it is disabled. This is the
  34         default behaviour.</li>
  35       <li><code>audit_level=2</code> - libvirt auditing is enabled regardless
  36         of host audit subsystem enablement. If the host audit subsystem is
  37         disabled, then libvirtd will refuse to complete startup and exit with
  38         an error.</li>
  39     </ul>
  40
  41     <p>
  42       In addition to have formal messages sent to the audit subsystem it is
  43       possible to tell libvirt to inject messages into its own logging
  44       layer. This will result in messages ending up in the systemd journal
  45       or <code>/var/log/libvirt/libivrtd.log</code> on non-systemd hosts.
  46       This is disabled by default, but can be requested by setting the
  47       <code>audit_logging=1</code> configuration parameter in the same file
  48       mentioned above.
  49     </p>
  50
  51     <h2><a id="types">Message types</a></h2>
  52
  53     <p>
  54       Libvirt defines three core audit message types each of which will
  55       be described below. There are a number of common fields that will
  56       be reported for all message types.
  57     </p>
  58
  59     <dl>
  60       <dt><code>pid</code></dt>
  61       <dd>Process ID of the libvirtd daemon generating the audit record.</dd>
  62       <dt><code>uid</code></dt>
  63       <dd>User ID of the libvirtd daemon process generating the audit record.</dd>
  64       <dt><code>subj</code></dt>
  65       <dd>Security context of the libvirtd daemon process generating the audit record.</dd>
  66       <dt><code>msg</code></dt>
  67       <dd>String containing a list of key=value pairs specific to the type of audit record being reported.</dd>
  68     </dl>
  69
  70     <p>
  71       Some fields in the <code>msg</code> string are common to audit records
  72     </p>
  73
  74     <dl>
  75       <dt><code>virt</code></dt>
  76       <dd>Type of virtualization driver used. One of <code>qemu</code> or <code>lxc</code></dd>
  77       <dt><code>vm</code></dt>
  78       <dd>Host driver unique name of the guest</dd>
  79       <dt><code>uuid</code></dt>
  80       <dd>Globally unique identifier for the guest</dd>
  81       <dt><code>exe</code></dt>
  82       <dd>Path of the libvirtd daemon</dd>
  83       <dt><code>hostname</code></dt>
  84       <dd>Currently unused</dd>
  85       <dt><code>addr</code></dt>
  86       <dd>Currently unused</dd>
  87       <dt><code>terminal</code></dt>
  88       <dd>Currently unused</dd>
  89       <dt><code>res</code></dt>
  90       <dd>Result of the action, either <code>success</code> or <code>failed</code></dd>
  91     </dl>
  92
  93     <h3><a id="typecontrol">VIRT_CONTROL</a></h3>
  94
  95     <p>
  96       Reports change in the lifecycle state of a virtual machine. The <code>msg</code>
  97       field will include the following sub-fields
  98     </p>
  99
 100     <dl>
 101       <dt><code>op</code></dt>
 102       <dd>Type of operation performed. One of <code>start</code>, <code>stop</code> or <code>init</code></dd>
 103       <dt><code>reason</code></dt>
 104       <dd>The reason which caused the operation to happen</dd>
 105       <dt><code>vm-pid</code></dt>
 106       <dd>ID of the primary/leading process associated with the guest</dd>
 107       <dt><code>init-pid</code></dt>
 108       <dd>ID of the <code>init</code> process in a container. Only if <code>op=init</code> and <code>virt=lxc</code></dd>
 109       <dt><code>pid-ns</code></dt>
 110       <dd>Namespace ID of the <code>init</code> process in a container. Only if <code>op=init</code> and <code>virt=lxc</code></dd>
 111     </dl>
 112
 113     <h3><a id="typemachine">VIRT_MACHINE_ID</a></h3>
 114
 115     <p>
 116       Reports the association of a security context with a guest. The <code>msg</code>
 117       field will include the following sub-fields
 118     </p>
 119
 120     <dl>
 121       <dt><code>model</code></dt>
 122       <dd>The security driver type. One of <code>selinux</code> or <code>apparmor</code></dd>
 123       <dt><code>vm-ctx</code></dt>
 124       <dd>Security context for the guest process</dd>
 125       <dt><code>img-ctx</code></dt>
 126       <dd>Security context for the guest disk images and other assigned host resources</dd>
 127     </dl>
 128
 129     <h3><a id="typeresource">VIRT_RESOURCE</a></h3>
 130
 131     <p>
 132       Reports the usage of a host resource by a guest. The fields include will
 133       vary according to the type of device being reported. When the guest is
 134       initially booted records will be generated for all assigned resources.
 135       If any changes are made to the running guest configuration, for example
 136       hotplug devices, or adjust resources allocation, further records will
 137       be generated.
 138     </p>
 139
 140     <h4><a id="typeresourcevcpu">Virtual CPU</a></h4>
 141
 142     <p>
 143       The <code>msg</code> field will include the following sub-fields
 144     </p>
 145
 146     <dl>
 147       <dt><code>reason</code></dt>
 148       <dd>The reason which caused the resource to be assigned to happen</dd>
 149       <dt><code>resrc</code></dt>
 150       <dd>The type of resource assigned. Set to <code>vcpu</code></dd>
 151       <dt><code>old-vcpu</code></dt>
 152       <dd>Original vCPU count, or 0</dd>
 153       <dt><code>new-vcpu</code></dt>
 154       <dd>Updated vCPU count</dd>
 155     </dl>
 156
 157
 158     <h4><a id="typeresourcemem">Memory</a></h4>
 159
 160     <p>
 161       The <code>msg</code> field will include the following sub-fields
 162     </p>
 163
 164     <dl>
 165       <dt><code>reason</code></dt>
 166       <dd>The reason which caused the resource to be assigned to happen</dd>
 167       <dt><code>resrc</code></dt>
 168       <dd>The type of resource assigned. Set to <code>mem</code></dd>
 169       <dt><code>old-mem</code></dt>
 170       <dd>Original memory size in bytes, or 0</dd>
 171       <dt><code>new-mem</code></dt>
 172       <dd>Updated memory size in bytes</dd>
 173     </dl>
 174
 175     <h4><a id="typeresourcedisk">Disk</a></h4>
 176     <p>
 177       The <code>msg</code> field will include the following sub-fields
 178     </p>
 179
 180     <dl>
 181       <dt><code>reason</code></dt>
 182       <dd>The reason which caused the resource to be assigned to happen</dd>
 183       <dt><code>resrc</code></dt>
 184       <dd>The type of resource assigned. Set to <code>disk</code></dd>
 185       <dt><code>old-disk</code></dt>
 186       <dd>Original host file or device path acting as the disk backing file</dd>
 187       <dt><code>new-disk</code></dt>
 188       <dd>Updated host file or device path acting as the disk backing file</dd>
 189     </dl>
 190
 191     <h4><a id="typeresourcenic">Network interface</a></h4>
 192
 193     <p>
 194       The <code>msg</code> field will include the following sub-fields
 195     </p>
 196
 197     <dl>
 198       <dt><code>reason</code></dt>
 199       <dd>The reason which caused the resource to be assigned to happen</dd>
 200       <dt><code>resrc</code></dt>
 201       <dd>The type of resource assigned. Set to <code>net</code></dd>
 202       <dt><code>old-net</code></dt>
 203       <dd>Original MAC address of the guest network interface</dd>
 204       <dt><code>new-net</code></dt>
 205       <dd>Updated MAC address of the guest network interface</dd>
 206     </dl>
 207
 208     <p>
 209       If there is a host network interface associated with the guest NIC then
 210       further records may be generated
 211     </p>
 212
 213     <dl>
 214       <dt><code>reason</code></dt>
 215       <dd>The reason which caused the resource to be assigned to happen</dd>
 216       <dt><code>resrc</code></dt>
 217       <dd>The type of resource assigned. Set to <code>net</code></dd>
 218       <dt><code>net</code></dt>
 219       <dd>MAC address of the host network interface</dd>
 220       <dt><code>rdev</code></dt>
 221       <dd>Name of the host network interface</dd>
 222     </dl>
 223
 224     <h4><a id="typeresourcefs">Filesystem</a></h4>
 225     <p>
 226       The <code>msg</code> field will include the following sub-fields
 227     </p>
 228
 229     <dl>
 230       <dt><code>reason</code></dt>
 231       <dd>The reason which caused the resource to be assigned to happen</dd>
 232       <dt><code>resrc</code></dt>
 233       <dd>The type of resource assigned. Set to <code>fs</code></dd>
 234       <dt><code>old-fs</code></dt>
 235       <dd>Original host directory, file or device path backing the filesystem </dd>
 236       <dt><code>new-fs</code></dt>
 237       <dd>Updated host directory, file or device path backing the filesystem</dd>
 238     </dl>
 239
 240     <h4><a id="typeresourcehost">Host device</a></h4>
 241     <p>
 242       The <code>msg</code> field will include the following sub-fields
 243     </p>
 244
 245     <dl>
 246       <dt><code>reason</code></dt>
 247       <dd>The reason which caused the resource to be assigned to happen</dd>
 248       <dt><code>resrc</code></dt>
 249       <dd>The type of resource assigned. Set to <code>hostdev</code> or <code>dev</code></dd>
 250       <dt><code>dev</code></dt>
 251       <dd>The unique bus identifier of the USB, PCI or SCSI device, if <code>resrc=dev</code></dd>
 252       <dt><code>disk</code></dt>
 253       <dd>The path of the block device assigned to the guest, if <code>resrc=hostdev</code></dd>
 254       <dt><code>chardev</code></dt>
 255       <dd>The path of the character device assigned to the guest, if <code>resrc=hostdev</code></dd>
 256     </dl>
 257
 258     <h4><a id="typeresourcetpm">TPM</a></h4>
 259     <p>
 260       The <code>msg</code> field will include the following sub-fields
 261     </p>
 262
 263     <dl>
 264       <dt><code>reason</code></dt>
 265       <dd>The reason which caused the resource to be assigned to happen</dd>
 266       <dt><code>resrc</code></dt>
 267       <dd>The type of resource assigned. Set to <code>tpm</code> or <code>tpm-emulator</code></dd>
 268       <dt><code>device</code></dt>
 269       <dd>The path of the host TPM device assigned to the guest</dd>
 270     </dl>
 271
 272     <h4><a id="typeresourcerng">RNG</a></h4>
 273     <p>
 274       The <code>msg</code> field will include the following sub-fields
 275     </p>
 276
 277     <dl>
 278       <dt><code>reason</code></dt>
 279       <dd>The reason which caused the resource to be assigned to happen</dd>
 280       <dt><code>resrc</code></dt>
 281       <dd>The type of resource assigned. Set to <code>rng</code></dd>
 282       <dt><code>old-rng</code></dt>
 283       <dd>Original path of the host entropy source for the RNG</dd>
 284       <dt><code>new-rng</code></dt>
 285       <dd>Updated path of the host entropy source for the RNG</dd>
 286     </dl>
 287
 288     <h4><a id="typeresourcechardev">console/serial/parallel/channel</a></h4>
 289     <p>
 290       The <code>msg</code> field will include the following sub-fields
 291     </p>
 292
 293     <dl>
 294       <dt><code>reason</code></dt>
 295       <dd>The reason which caused the resource to be assigned to happen</dd>
 296       <dt><code>resrc</code></dt>
 297       <dd>The type of resource assigned. Set to <code>chardev</code></dd>
 298       <dt><code>old-chardev</code></dt>
 299       <dd>Original path of the backing character device for given emulated device</dd>
 300       <dt><code>new-chardev</code></dt>
 301       <dd>Updated path of the backing character device for given emulated device</dd>
 302     </dl>
 303
 304     <h4><a id="typeresourcesmartcard">smartcard</a></h4>
 305     <p>
 306       The <code>msg</code> field will include the following sub-fields
 307     </p>
 308
 309     <dl>
 310       <dt><code>reason</code></dt>
 311       <dd>The reason which caused the resource to be assigned to happen</dd>
 312       <dt><code>resrc</code></dt>
 313       <dd>The type of resource assigned. Set to <code>smartcard</code></dd>
 314       <dt><code>old-smartcard</code></dt>
 315       <dd>Original path of the backing character device, certificate store or
 316           "nss-smartcard-device" for host smartcard passthrough.
 317       </dd>
 318       <dt><code>new-smartcard</code></dt>
 319       <dd>Updated path of the backing character device, certificate store or
 320           "nss-smartcard-device" for host smartcard passthrough.
 321       </dd>
 322     </dl>
 323
 324     <h4><a id="typeresourceredir">Redirected device</a></h4>
 325     <p>
 326       The <code>msg</code> field will include the following sub-fields
 327     </p>
 328
 329     <dl>
 330       <dt><code>reason</code></dt>
 331       <dd>The reason which caused the resource to be assigned to happen</dd>
 332       <dt><code>resrc</code></dt>
 333       <dd>The type of resource assigned. Set to <code>redir</code></dd>
 334       <dt><code>bus</code></dt>
 335       <dd>The bus type, only <code>usb</code> allowed</dd>
 336       <dt><code>device</code></dt>
 337       <dd>The device type, only <code>USB redir</code> allowed</dd>
 338     </dl>
 339
 340     <h4><a id="typeresourcecgroup">Control group</a></h4>
 341
 342     <p>
 343       The <code>msg</code> field will include the following sub-fields
 344     </p>
 345
 346     <dl>
 347       <dt><code>reason</code></dt>
 348       <dd>The reason which caused the resource to be assigned to happen</dd>
 349       <dt><code>resrc</code></dt>
 350       <dd>The type of resource assigned. Set to <code>cgroup</code></dd>
 351       <dt><code>cgroup</code></dt>
 352       <dd>The name of the cgroup controller</dd>
 353     </dl>
 354
 355
 356     <h4><a id="typeresourceshmem">Shared memory</a></h4>
 357     <p>
 358       The <code>msg</code> field will include the following sub-fields
 359     </p>
 360
 361     <dl>
 362       <dt><code>resrc</code></dt>
 363       <dd>The type of resource assigned. Set to <code>shmem</code></dd>
 364       <dt><code>reason</code></dt>
 365       <dd>The reason which caused the resource to be assigned to happen</dd>
 366       <dt><code>size</code></dt>
 367       <dd>The size of the shared memory region</dd>
 368       <dt><code>shmem</code></dt>
 369       <dd>Name of the shared memory region</dd>
 370       <dt><code>source</code></dt>
 371       <dd>Path of the backing character device for given emulated device</dd>
 372     </dl>
 373
 374   </body>
 375 </html>