1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
|
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<!--
This file is autogenerated from auditlog.html.in
Do not edit this file. Changes will be lost.
-->
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
<link rel="stylesheet" type="text/css" href="main.css" />
<link rel="SHORTCUT ICON" href="32favicon.png" />
<title>libvirt: Audit log</title>
<meta name="description" content="libvirt, virtualization, virtualization API" />
</head>
<body>
<div id="header">
<div id="headerLogo"></div>
<div id="headerSearch">
<form action="search.php" enctype="application/x-www-form-urlencoded" method="get"><div>
<input id="query" name="query" type="text" size="12" value="" />
<input id="submit" name="submit" type="submit" value="Search" />
</div></form>
</div>
</div>
<div id="body">
<div id="menu">
<ul class="l0"><li>
<div>
<a title="Front page of the libvirt website" class="inactive" href="index.html">Home</a>
</div>
</li><li>
<div>
<a title="Details of new features and bugs fixed in each release" class="inactive" href="news.html">News</a>
</div>
</li><li>
<div>
<a title="Applications known to use libvirt" class="inactive" href="apps.html">Applications</a>
</div>
</li><li>
<div>
<a title="Get the latest source releases, binary builds and get access to the source repository" class="inactive" href="downloads.html">Downloads</a>
</div>
</li><li>
<div>
<a title="Information for users, administrators and developers" class="active" href="docs.html">Documentation</a>
<ul class="l1"><li>
<div>
<a title="How to compile libvirt" class="inactive" href="compiling.html">Compiling</a>
</div>
</li><li>
<div>
<a title="Information about deploying and using libvirt" class="active" href="deployment.html">Deployment</a>
<ul class="l2"><li>
<div>
<a title="The URI formats used for connecting to libvirt" class="inactive" href="uri.html">URI format</a>
</div>
</li><li>
<div>
<a title="Enable remote access over TCP" class="inactive" href="remote.html">Remote access</a>
</div>
</li><li>
<div>
<a title="Configure authentication for the libvirt daemon" class="inactive" href="auth.html">Authentication</a>
</div>
</li><li>
<div>
<a title="Configure access control libvirt APIs" class="inactive" href="acl.html">Access control</a>
</div>
</li><li>
<div>
<a title="Migrating guests between machines" class="inactive" href="migration.html">Migration</a>
</div>
</li><li>
<div>
<a title="Access the libvirt daemon from a native Windows client" class="inactive" href="windows.html">Windows port</a>
</div>
</li><li>
<div>
<a title="The library and the daemon logging support" class="inactive" href="logging.html">Logging</a>
</div>
</li><li>
<div>
<span class="active">Audit log</span>
</div>
</li><li>
<div>
<a title="Firewall and network filter configuration" class="inactive" href="firewall.html">Firewall</a>
</div>
</li><li>
<div>
<a title="Ensuring exclusive guest access to disks" class="inactive" href="locking.html">Disk locking</a>
</div>
</li><li>
<div>
<a title="Control groups integration" class="inactive" href="cgroups.html">CGroups</a>
</div>
</li><li>
<div>
<a title="Hooks for system specific management" class="inactive" href="hooks.html">Hooks</a>
</div>
</li></ul>
</div>
</li><li>
<div>
<a title="Overview of the logical subsystems in the libvirt API" class="inactive" href="intro.html">Architecture</a>
</div>
</li><li>
<div>
<a title="Description of the XML formats used in libvirt" class="inactive" href="format.html">XML format</a>
</div>
</li><li>
<div>
<a title="Hypervisor specific driver information" class="inactive" href="drivers.html">Drivers</a>
</div>
</li><li>
<div>
<a title="Reference manual for the C public API" class="inactive" href="html/index.html">API reference</a>
</div>
</li><li>
<div>
<a title="Bindings of the libvirt API for other languages" class="inactive" href="bindings.html">Language bindings</a>
</div>
</li><li>
<div>
<a title="Working on the internals of libvirt API, driver and daemon code" class="inactive" href="internals.html">Internals</a>
</div>
</li><li>
<div>
<a title="A guide and reference for developing with libvirt" class="inactive" href="devguide.html">Development Guide</a>
</div>
</li><li>
<div>
<a title="Command reference for virsh" class="inactive" href="virshcmdref.html">Virsh Commands</a>
</div>
</li><li>
<div>
<a title="Project governance and code of conduct" class="inactive" href="governance.html">Governance</a>
</div>
</li></ul>
</div>
</li><li>
<div>
<a title="User contributed content" class="inactive" href="http://wiki.libvirt.org">Wiki</a>
</div>
</li><li>
<div>
<a title="Frequently asked questions" class="inactive" href="http://wiki.libvirt.org/page/FAQ">FAQ</a>
</div>
</li><li>
<div>
<a title="How and where to report bugs and request features" class="inactive" href="bugs.html">Bug reports</a>
</div>
</li><li>
<div>
<a title="How to contact the developers via email and IRC" class="inactive" href="contact.html">Contact</a>
</div>
</li><li>
<div>
<a title="Available test suites for libvirt" class="inactive" href="testsuites.html">Test suites</a>
</div>
</li><li>
<div>
<a title="Miscellaneous links of interest related to libvirt" class="inactive" href="relatedlinks.html">Related Links</a>
</div>
</li><li>
<div>
<a title="Overview of all content on the website" class="inactive" href="sitemap.html">Sitemap</a>
</div>
</li></ul>
</div>
<div id="content">
<h1>Audit log</h1>
<ul><li>
<a href="#intro">Introduction</a>
</li><li>
<a href="#config">Configuration</a>
</li><li>
<a href="#types">Message types</a>
<ul><li>
<a href="#typecontrol">VIRT_CONTROL</a>
</li><li>
<a href="#typemachine">VIRT_MACHINE_ID</a>
</li><li>
<a href="#typeresource">VIRT_RESOURCE</a>
<ul><li>
<a href="#typeresourcevcpu">Virtual CPU</a>
</li><li>
<a href="#typeresourcemem">Memory</a>
</li><li>
<a href="#typeresourcedisk">Disk</a>
</li><li>
<a href="#typeresourcenic">Network interface</a>
</li><li>
<a href="#typeresourcefs">Filesystem</a>
</li><li>
<a href="#typeresourcehost">Host device</a>
</li><li>
<a href="#typeresourcetpm">TPM</a>
</li><li>
<a href="#typeresourcerng">RNG</a>
</li><li>
<a href="#typeresourcechardev">console/serial/parallel/channel</a>
</li><li>
<a href="#typeresourcesmartcard">smartcard</a>
</li><li>
<a href="#typeresourceredir">Redirected device</a>
</li><li>
<a href="#typeresourcecgroup">Control group</a>
</li></ul>
</li></ul>
</li></ul>
<h2>
<a name="intro" shape="rect" id="intro">Introduction</a>
<a class="headerlink" href="#intro" title="Permalink to this headline">¶</a>
</h2>
<p>
A number of the libvirt virtualization drivers (QEMU/KVM and LXC) include
support for logging details of important operations to the host's audit
subsystem. This provides administrators / auditors with a canonical historical
record of changes to virtual machines' / containers' lifecycle states and
their configuration. On hosts which are running the Linux audit daemon,
the logs will usually end up in <code>/var/log/audit/audit.log</code>
</p>
<h2>
<a name="config" shape="rect" id="config">Configuration</a>
<a class="headerlink" href="#config" title="Permalink to this headline">¶</a>
</h2>
<p>
The libvirt audit integration is enabled by default on any host which has
the Linux audit subsystem active, and disabled otherwise. It is possible
to alter this behaviour in the <code>/etc/libvirt/libvirtd.conf</code>
configuration file, via the <code>audit_level</code> parameter
</p>
<ul><li><code>audit_level=0</code> - libvirt auditing is disabled regardless
of host audit subsystem enablement.</li><li><code>audit_level=1</code> - libvirt auditing is enabled if the host
audit subsystem is enabled, otherwise it is disabled. This is the
default behaviour.</li><li><code>audit_level=2</code> - libvirt auditing is enabled regardless
of host audit subsystem enablement. If the host audit subsystem is
disabled, then libvirtd will refuse to complete startup and exit with
an error.</li></ul>
<p>
In addition to have formal messages sent to the audit subsystem it is
possible to tell libvirt to inject messages into its own logging
layer. This will result in messages ending up in the systemd journal
or <code>/var/log/libvirt/libivrtd.log</code> on non-systemd hosts.
This is disabled by default, but can be requested by setting the
<code>audit_logging=1</code> configuration parameter in the same file
mentioned above.
</p>
<h2>
<a name="types" shape="rect" id="types">Message types</a>
<a class="headerlink" href="#types" title="Permalink to this headline">¶</a>
</h2>
<p>
Libvirt defines three core audit message types each of which will
be described below. There are a number of common fields that will
be reported for all message types.
</p>
<dl><dt>pid</dt><dd>Process ID of the libvirtd daemon generating the audit record.</dd><dt>uid</dt><dd>User ID of the libvirtd daemon process generating the audit record.</dd><dt>subj</dt><dd>Security context of the libvirtd daemon process generating the audit record.</dd><dt>msg</dt><dd>String containing a list of key=value pairs specific to the type of audit record being reported.</dd></dl>
<p>
Some fields in the <code>msg</code> string are common to audit records
</p>
<dl><dt>virt</dt><dd>Type of virtualization driver used. One of <code>qemu</code> or <code>lxc</code></dd><dt>vm</dt><dd>Host driver unique name of the guest</dd><dt>uuid</dt><dd>Globally unique identifier for the guest</dd><dt>exe</dt><dd>Path of the libvirtd daemon</dd><dt>hostname</dt><dd>Currently unused</dd><dt>addr</dt><dd>Currently unused</dd><dt>terminal</dt><dd>Currently unused</dd><dt>res</dt><dd>Result of the action, either <code>success</code> or <code>failed</code></dd></dl>
<h3>
<a name="typecontrol" shape="rect" id="typecontrol">VIRT_CONTROL</a>
<a class="headerlink" href="#typecontrol" title="Permalink to this headline">¶</a>
</h3>
<p>
Reports change in the lifecycle state of a virtual machine. The <code>msg</code>
field will include the following sub-fields
</p>
<dl><dt>op</dt><dd>Type of operation performed. One of <code>start</code>, <code>stop</code> or <code>init</code></dd><dt>reason</dt><dd>The reason which caused the operation to happen</dd><dt>vm-pid</dt><dd>ID of the primary/leading process associated with the guest</dd><dt>init-pid</dt><dd>ID of the <code>init</code> process in a container. Only if <code>op=init</code> and <code>virt=lxc</code></dd><dt>pid-ns</dt><dd>Namespace ID of the <code>init</code> process in a container. Only if <code>op=init</code> and <code>virt=lxc</code></dd></dl>
<h3>
<a name="typemachine" shape="rect" id="typemachine">VIRT_MACHINE_ID</a>
<a class="headerlink" href="#typemachine" title="Permalink to this headline">¶</a>
</h3>
<p>
Reports the association of a security context with a guest. The <code>msg</code>
field will include the following sub-fields
</p>
<dl><dt>model</dt><dd>The security driver type. One of <code>selinux</code> or <code>apparmor</code></dd><dt>vm-ctx</dt><dd>Security context for the guest process</dd><dt>img-ctx</dt><dd>Security context for the guest disk images and other assigned host resources</dd></dl>
<h3>
<a name="typeresource" shape="rect" id="typeresource">VIRT_RESOURCE</a>
<a class="headerlink" href="#typeresource" title="Permalink to this headline">¶</a>
</h3>
<p>
Reports the usage of a host resource by a guest. The fields include will
vary according to the type of device being reported. When the guest is
initially booted records will be generated for all assigned resources.
If any changes are made to the running guest configuration, for example
hotplug devices, or adjust resources allocation, further records will
be generated.
</p>
<h4>
<a name="typeresourcevcpu" shape="rect" id="typeresourcevcpu">Virtual CPU</a>
<a class="headerlink" href="#typeresourcevcpu" title="Permalink to this headline">¶</a>
</h4>
<p>
The <code>msg</code> field will include the following sub-fields
</p>
<dl><dt>reason</dt><dd>The reason which caused the resource to be assigned to happen</dd><dt>resrc</dt><dd>The type of resource assigned. Set to <code>vcpu</code></dd><dt>old-vcpu</dt><dd>Original vCPU count, or 0</dd><dt>new-vcpu</dt><dd>Updated vCPU count</dd></dl>
<h4>
<a name="typeresourcemem" shape="rect" id="typeresourcemem">Memory</a>
<a class="headerlink" href="#typeresourcemem" title="Permalink to this headline">¶</a>
</h4>
<p>
The <code>msg</code> field will include the following sub-fields
</p>
<dl><dt>reason</dt><dd>The reason which caused the resource to be assigned to happen</dd><dt>resrc</dt><dd>The type of resource assigned. Set to <code>mem</code></dd><dt>old-mem</dt><dd>Original memory size in bytes, or 0</dd><dt>new-mem</dt><dd>Updated memory size in bytes</dd></dl>
<h4>
<a name="typeresourcedisk" shape="rect" id="typeresourcedisk">Disk</a>
<a class="headerlink" href="#typeresourcedisk" title="Permalink to this headline">¶</a>
</h4>
<p>
The <code>msg</code> field will include the following sub-fields
</p>
<dl><dt>reason</dt><dd>The reason which caused the resource to be assigned to happen</dd><dt>resrc</dt><dd>The type of resource assigned. Set to <code>disk</code></dd><dt>old-disk</dt><dd>Original host file or device path acting as the disk backing file</dd><dt>new-disk</dt><dd>Updated host file or device path acting as the disk backing file</dd></dl>
<h4>
<a name="typeresourcenic" shape="rect" id="typeresourcenic">Network interface</a>
<a class="headerlink" href="#typeresourcenic" title="Permalink to this headline">¶</a>
</h4>
<p>
The <code>msg</code> field will include the following sub-fields
</p>
<dl><dt>reason</dt><dd>The reason which caused the resource to be assigned to happen</dd><dt>resrc</dt><dd>The type of resource assigned. Set to <code>net</code></dd><dt>old-net</dt><dd>Original MAC address of the guest network interface</dd><dt>new-net</dt><dd>Updated MAC address of the guest network interface</dd></dl>
<p>
If there is a host network interface associated with the guest NIC then
further records may be generated
</p>
<dl><dt>reason</dt><dd>The reason which caused the resource to be assigned to happen</dd><dt>resrc</dt><dd>The type of resource assigned. Set to <code>net</code></dd><dt>net</dt><dd>MAC address of the host network interface</dd><dt>rdev</dt><dd>Name of the host network interface</dd></dl>
<h4>
<a name="typeresourcefs" shape="rect" id="typeresourcefs">Filesystem</a>
<a class="headerlink" href="#typeresourcefs" title="Permalink to this headline">¶</a>
</h4>
<p>
The <code>msg</code> field will include the following sub-fields
</p>
<dl><dt>reason</dt><dd>The reason which caused the resource to be assigned to happen</dd><dt>resrc</dt><dd>The type of resource assigned. Set to <code>fs</code></dd><dt>old-fs</dt><dd>Original host directory, file or device path backing the filesystem </dd><dt>new-fs</dt><dd>Updated host directory, file or device path backing the filesystem</dd></dl>
<h4>
<a name="typeresourcehost" shape="rect" id="typeresourcehost">Host device</a>
<a class="headerlink" href="#typeresourcehost" title="Permalink to this headline">¶</a>
</h4>
<p>
The <code>msg</code> field will include the following sub-fields
</p>
<dl><dt>reason</dt><dd>The reason which caused the resource to be assigned to happen</dd><dt>resrc</dt><dd>The type of resource assigned. Set to <code>hostdev</code> or <code>dev</code></dd><dt>dev</dt><dd>The unique bus identifier of the USB, PCI or SCSI device, if <code>resrc=dev</code></dd><dt>disk</dt><dd>The path of the block device assigned to the guest, if <code>resrc=hostdev</code></dd><dt>chardev</dt><dd>The path of the character device assigned to the guest, if <code>resrc=hostdev</code></dd></dl>
<h4>
<a name="typeresourcetpm" shape="rect" id="typeresourcetpm">TPM</a>
<a class="headerlink" href="#typeresourcetpm" title="Permalink to this headline">¶</a>
</h4>
<p>
The <code>msg</code> field will include the following sub-fields
</p>
<dl><dt>reason</dt><dd>The reason which caused the resource to be assigned to happen</dd><dt>resrc</dt><dd>The type of resource assigned. Set to <code>tpm</code></dd><dt>device</dt><dd>The path of the host TPM device assigned to the guest</dd></dl>
<h4>
<a name="typeresourcerng" shape="rect" id="typeresourcerng">RNG</a>
<a class="headerlink" href="#typeresourcerng" title="Permalink to this headline">¶</a>
</h4>
<p>
The <code>msg</code> field will include the following sub-fields
</p>
<dl><dt>reason</dt><dd>The reason which caused the resource to be assigned to happen</dd><dt>resrc</dt><dd>The type of resource assigned. Set to <code>rng</code></dd><dt>old-rng</dt><dd>Original path of the host entropy source for the RNG</dd><dt>new-rng</dt><dd>Updated path of the host entropy source for the RNG</dd></dl>
<h4>
<a name="typeresourcechardev" shape="rect" id="typeresourcechardev">console/serial/parallel/channel</a>
<a class="headerlink" href="#typeresourcechardev" title="Permalink to this headline">¶</a>
</h4>
<p>
The <code>msg</code> field will include the following sub-fields
</p>
<dl><dt>reason</dt><dd>The reason which caused the resource to be assigned to happen</dd><dt>resrc</dt><dd>The type of resource assigned. Set to <code>chardev</code></dd><dt>old-chardev</dt><dd>Original path of the backing character device for given emulated device</dd><dt>new-chardev</dt><dd>Updated path of the backing character device for given emulated device</dd></dl>
<h4>
<a name="typeresourcesmartcard" shape="rect" id="typeresourcesmartcard">smartcard</a>
<a class="headerlink" href="#typeresourcesmartcard" title="Permalink to this headline">¶</a>
</h4>
<p>
The <code>msg</code> field will include the following sub-fields
</p>
<dl><dt>reason</dt><dd>The reason which caused the resource to be assigned to happen</dd><dt>resrc</dt><dd>The type of resource assigned. Set to <code>smartcard</code></dd><dt>old-smartcard</dt><dd>Original path of the backing character device, certificate store or
"nss-smartcard-device" for host smartcard passthrough.
</dd><dt>new-smartcard</dt><dd>Updated path of the backing character device, certificate store or
"nss-smartcard-device" for host smartcard passthrough.
</dd></dl>
<h4>
<a name="typeresourceredir" shape="rect" id="typeresourceredir">Redirected device</a>
<a class="headerlink" href="#typeresourceredir" title="Permalink to this headline">¶</a>
</h4>
<p>
The <code>msg</code> field will include the following sub-fields
</p>
<dl><dt>reason</dt><dd>The reason which caused the resource to be assigned to happen</dd><dt>resrc</dt><dd>The type of resource assigned. Set to <code>redir</code></dd><dt>bus</dt><dd>The bus type, only <code>usb</code> allowed</dd><dt>device</dt><dd>The device type, only <code>USB redir</code> allowed</dd></dl>
<h4>
<a name="typeresourcecgroup" shape="rect" id="typeresourcecgroup">Control group</a>
<a class="headerlink" href="#typeresourcecgroup" title="Permalink to this headline">¶</a>
</h4>
<p>
The <code>msg</code> field will include the following sub-fields
</p>
<dl><dt>reason</dt><dd>The reason which caused the resource to be assigned to happen</dd><dt>resrc</dt><dd>The type of resource assigned. Set to <code>cgroup</code></dd><dt>cgroup</dt><dd>The name of the cgroup controller</dd></dl>
</div>
</div>
<div id="footer">
<p id="sponsor">
Sponsored by:<br /><a href="http://et.redhat.com/"><img src="et.png" alt="Project sponsored by Red Hat Emerging Technology" /></a></p>
</div>
</body>
</html>
|
