-
Feature
-
Resolution: Unresolved
-
Normal
-
None
-
None
-
BU Product Work
-
False
-
None
-
False
-
Not Selected
High-level user story: As an organization or registry admin, I want to be able to view audit log events inside the Quay UI when the log forwarding Splunk is enabled, so that I don't have to access to a separate UI/system nor do I need to learn how to write Splunk queries to audit events in my Quay organization or registry.
Background: When implementing PROJQUAY-4993 we only supported forwarding the audit logs to Splunk, we did not deliver the ability to retrieve the respective audit events for a given organization or the entire registry for display and analysis inside the Quay UI. Today a user has to have access and write queries inside Splunk directly, which is a regression compared to when audit logs are forwarded to ElasticSearch or stored in the database.
Acceptance criteria:
- org admins can introspect audit logs via the UI / API for their respective organization only when Splunk log forwarding is enabled
- registry admins / superusers can introspect audit logs via the super user panel for the entire system when Splunk log forwarding is enabled
- no loss in fidelity of the information displayed
- proper pagination through audit events stored in Splunk
- search / filtering through audit events stored in Splunk