How to work with MAAS audit events
Errors or typos? Topics missing? Hard to read? Let us know!
This article provides concise procedures for working with audit events in MAAS (Metal as a Service). Audit events are valuable for tracking and understanding the changes and activities on your managed machines. Here, you will learn how to effectively manage and utilise audit events.
Here, we'll explore:
To get a list of MAAS audit events, you can use the following MAAS CLI command:
$ maas $PROFILE events query level=AUDIT
This command will list all audit events. The output will include details such as username, hostname, date, and event description.
How to filter audit events by hostname
To filter audit events by a specific hostname, use the following MAAS CLI command:
$ maas $PROFILE events query level=AUDIT hostname=your-hostname
Replace your-hostname with the desired hostname. This command will list audit events specific to the provided hostname.
How to filter audit events by MAC address
If you want to filter audit events by a specific MAC address, use this MAAS CLI command:
$ maas $PROFILE events query level=AUDIT mac_address=00:11:22:33:44:55
Replace 00:11:22:33:44:55 with the MAC address you want to filter by. This command will display audit events related to the specified MAC address.
How to filter audit events by system ID
To filter audit events by a specific system ID, use the following MAAS CLI command:
$ maas $PROFILE events query level=AUDIT id=system-id
Replace system-id with the desired system ID. This command will list audit events specific to the provided system ID.
How to filter audit events by zone
If you want to filter audit events by a specific zone, use the following MAAS CLI command:
$ maas $PROFILE events query level=AUDIT zone=your-zone
Replace your-zone with the desired zone name. This command will display audit events for machines in the specified zone.
How to filter audit events by owner
To filter audit events by the owner of the machine, use this MAAS CLI command:
$ maas $PROFILE events query level=AUDIT owner=owner-username
Replace owner-username with the username of the machine's owner. This command will list audit events for machines owned by the specified user.
How to limit the number of audit events displayed
You can limit the number of audit events displayed using the limit parameter. For example:
$ maas $PROFILE events query level=AUDIT limit=10
This command will limit the output to the last 10 audit events. You can adjust the limit to your preference.
How to move the audit event window
To display audit events occurring after a specific event ID, you can use the after parameter. For example:
$ maas $PROFILE events query level=AUDIT after=event-id
Replace event-id with the ID of the event you want to start from. This command will display audit events that occurred after the specified event.
How to audit machine life-cycles with audit events
To audit a machine's life cycle, you can collect audit data for a specific machine over time. First, collect a significant amount of audit data for the machine using the hostname filter:
$ maas $PROFILE events query level=AUDIT hostname=your-hostname limit=1000 > /tmp/audit-data
This command will retrieve a substantial number of audit events for the specified hostname and store them in a file named audit-data.
Next, you can analyse this data to track changes, actions, and events related to the machine's life cycle. This can help in troubleshooting and monitoring machine behaviour over time.
By following these procedures, you can effectively work with audit events in MAAS and gain insights into the activities and changes happening on your managed machines.
Feel free to ask for further clarification or assistance with any specific aspect of managing MAAS audit events.