Exporting Cloud Pak for Data audit records to the cluster

Before you begin

About this task

This method is not recommended for long-term record management. Instead, this method is useful to validate that all of the records that are generated by the Audit Logging Service are sent to your SIEM system.

Choose the appropriate option for your environment:

• Edit the zen-audit-config configmap
• Create a custom configmap

Edit the zen-audit-config configmap

You can edit the existing zen-audit-config configmap to export the audit logs to the zen-audit pod stdout logs on the cluster

From the Cloud Pak for Data cluster:

1. Change to the project where Cloud Pak for Data is installed:

   oc project ${PROJECT_CPD_INST_OPERANDS}

2. Make a backup of the current zen-audit-config configmap.
3. Edit the zen-audit-config config map:

   oc edit configmap zen-audit-config

4. Add the <store> configuration to the configmap.
   Tip: The zen-audit-config configmap includes a sample stdout configuration, which is commented out by default.

   The <store> configuration must be inside the <match export export.** records records.** syslog syslog.**> tag and after the @type copy tag.

   apiVersion: v1
   metadata:
     name: zen-audit-config
   data:
     fluent.conf: |-
       <match export export.** records records.** syslog syslog.**> 
         @type copy 
         <store>    
           @type stdout
         </store>
       </match>

5. Save the changes to the zen-audit-config configmap. For example, if you are using vi, hit esc and enter :wq.
6. Delete all zen-audit pods to force a restart to pick up changes:
   1. Get the list of zen-audit pods:

      oc get pods | grep zen-audit

   2. Delete the zen-audit pods.
      Tip: If there are multiple zen-audit pods, delete each pod individually to avoid a forced restart.

      oc delete pods zen-audit-xxxxxx-xxx

      Replace zen-audit-xxxxxx-xxx with the ID returned by the oc get pods command.

Create a custom configmap

You can create a custom configmap to export your audit records to the zen-audit pod stdout logs on the cluster:

From the Cloud Pak for Data cluster:

1. Change to the project where Cloud Pak for Data is installed:

   oc project ${PROJECT_CPD_INST_OPERANDS}

2. Set the following environment variables:
   1. Set CONFIGMAP_NAME to the name that you want to use for the custom configmap:

      export CONFIGMAP_NAME=<configmap-name>

3. Create the configmap:

   cat <<EOF | oc apply -f -
   apiVersion: v1
   kind: ConfigMap
   metadata:
     name: ${CONFIGMAP_NAME}
     namespace: ${PROJECT_CPD_INST_OPERANDS}
   data:
     fluent.conf: |-
       <match export export.** records records.** syslog syslog.**> 
         @type copy 
         <store>    
           @type stdout
         </store>
       </match>
   EOF

4. Patch the zenService custom resource to specify the custom configmap:

   oc patch zenService lite-cr \
   -n ${PROJECT_CPD_INST_OPERANDS} \
   --type='json' \
   --patch '[{"op": "replace", "path":"/spec/zen_audit_config_custom", "value": '${CONFIGMAP_NAME}' }]'

5. Delete all zen-audit pods to force a restart to pick up changes:
   1. Get the list of zen-audit pods:

      oc get pods | grep zen-audit

   2. Delete the zen-audit pods.
      Tip: If there are multiple zen-audit pods, delete each pod individually to avoid a forced restart.

      oc delete pods zen-audit-xxxxxx-xxx

      Replace zen-audit-xxxxxx-xxx with the ID returned by the oc get pods command.

Results

After the changes are applied, new audit events from Cloud Pak for Data are sent to the zen-audit pod stdout logs.