Uploaded image for project: 'Project Quay'
  1. Project Quay
  2. PROJQUAY-6209

Splunk-based audit log display in Quay

XMLWordPrintable

    • BU Product Work
    • False
    • None
    • False
    • Not Selected

      High-level user story: As an organization or registry admin, I want to be able to view audit log events inside the Quay UI when the log forwarding Splunk is enabled, so that I don't have to access to a separate UI/system nor do I need to learn how to write Splunk queries to audit events in my Quay organization or registry.

      Background: When implementing PROJQUAY-4993 we only supported forwarding the audit logs to Splunk, we did not deliver the ability to retrieve the respective audit events for a given organization or the entire registry for display and analysis inside the Quay UI. Today a user has to have access and write queries inside Splunk directly, which is a regression compared to when audit logs are forwarded to ElasticSearch or stored in the database.

      Acceptance criteria:

      • org admins can introspect audit logs via the UI / API for their respective organization only when Splunk log forwarding is enabled
      • registry admins / superusers can introspect audit logs via the super user panel for the entire system when Splunk log forwarding is enabled
      • no loss in fidelity of the information displayed
      • proper pagination through audit events stored in Splunk
      • search / filtering through audit events stored in Splunk

              Unassigned Unassigned
              DanielMesser Daniel Messer
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

                Created:
                Updated: