+ * IMPORTANT WARNING: Audit logs should be strictly backwards-compatible, + * because there are usually parsing tools highly dependent on the audit log + * formatting. Different tools have different ways of parsing the audit log, so + * changing the audit log output in any way is considered incompatible, + * and will haunt the consumer tools / developers. Don't do it. + */ +@InterfaceAudience.Private +@InterfaceStability.Evolving +interface KMSAuditLogger { + enum OpStatus { + OK, UNAUTHORIZED, UNAUTHENTICATED, ERROR; + } + + /** + * Class defining an audit event. + */ + class AuditEvent { + private final AtomicLong accessCount = new AtomicLong(-1); + private final KMS.KMSOp op; + private final String keyName; + private final String user; + private final String impersonator; + private final String remoteHost; + private final String extraMsg; + private final long startTime = System.currentTimeMillis(); + private long endTime = startTime; + + AuditEvent(KMS.KMSOp op, UserGroupInformation ugi, String keyName, + String remoteHost, String msg) { + this.keyName = keyName; + if (ugi == null) { + this.user = null; + this.impersonator = null; + } else { + this.user = ugi.getShortUserName(); + if (ugi.getAuthenticationMethod() + == UserGroupInformation.AuthenticationMethod.PROXY) { + this.impersonator = ugi.getRealUser().getUserName(); + } else { + this.impersonator = null; + } + } + this.remoteHost = remoteHost; + this.op = op; + this.extraMsg = msg; + } + + public AtomicLong getAccessCount() { + return accessCount; + } + + public KMS.KMSOp getOp() { + return op; + } + + public String getKeyName() { + return keyName; + } + + public String getUser() { + return user; + } + + public String getImpersonator() { + return impersonator; + } + + public String getRemoteHost() { + return remoteHost; + } + + public String getExtraMsg() { + return extraMsg; + } + + public long getStartTime() { + return startTime; + } + + public long getEndTime() { + return endTime; + } + + /** + * Set the time this audit event is finished. + */ + void setEndTime(long endTime) { + this.endTime = endTime; + } + + @Override + public String toString() { + StringBuilder sb = new StringBuilder(); + sb.append("op=" + op).append(", keyName=" + keyName) + .append(", user=" + user).append(", impersonator=" + impersonator) + .append(", remoteHost=" + remoteHost) + .append(", extraMsg=" + extraMsg); + return sb.toString(); + } + } + + /** + * Clean up the audit logger. + * + * @throws IOException + */ + void cleanup() throws IOException; + + /** + * Initialize the audit logger. + * + * @param conf The configuration object. + * @throws IOException + */ + void initialize(Configuration conf) throws IOException; + + /** + * Log an audit event. + * + * @param status The status of the event. + * @param event The audit event. + */ + void logAuditEvent(final OpStatus status, final AuditEvent event); +} \ No newline at end of file diff --git a/hadoop-common-project/hadoop-kms/src/main/java/org/apache/hadoop/crypto/key/kms/server/KMSConfiguration.java b/hadoop-common-project/hadoop-kms/src/main/java/org/apache/hadoop/crypto/key/kms/server/KMSConfiguration.java index 23c983f4e5..600f1e976b 100644 --- a/hadoop-common-project/hadoop-kms/src/main/java/org/apache/hadoop/crypto/key/kms/server/KMSConfiguration.java +++ b/hadoop-common-project/hadoop-kms/src/main/java/org/apache/hadoop/crypto/key/kms/server/KMSConfiguration.java @@ -58,6 +58,10 @@ public class KMSConfiguration { // Delay for Audit logs that need aggregation public static final String KMS_AUDIT_AGGREGATION_WINDOW = CONFIG_PREFIX + "audit.aggregation.window.ms"; + + // KMS Audit logger classes to use + public static final String KMS_AUDIT_LOGGER_KEY = CONFIG_PREFIX + + "audit.logger"; public static final boolean KEY_CACHE_ENABLE_DEFAULT = true; // 10 mins diff --git a/hadoop-common-project/hadoop-kms/src/main/java/org/apache/hadoop/crypto/key/kms/server/KMSWebApp.java b/hadoop-common-project/hadoop-kms/src/main/java/org/apache/hadoop/crypto/key/kms/server/KMSWebApp.java index 3b439a4e4d..e3d1a93299 100644 --- a/hadoop-common-project/hadoop-kms/src/main/java/org/apache/hadoop/crypto/key/kms/server/KMSWebApp.java +++ b/hadoop-common-project/hadoop-kms/src/main/java/org/apache/hadoop/crypto/key/kms/server/KMSWebApp.java @@ -147,10 +147,7 @@ public void contextInitialized(ServletContextEvent sce) { unauthenticatedCallsMeter = metricRegistry.register( UNAUTHENTICATED_CALLS_METER, new Meter()); - kmsAudit = - new KMSAudit(kmsConf.getLong( - KMSConfiguration.KMS_AUDIT_AGGREGATION_WINDOW, - KMSConfiguration.KMS_AUDIT_AGGREGATION_WINDOW_DEFAULT)); + kmsAudit = new KMSAudit(kmsConf); // this is required for the the JMXJsonServlet to work properly. // the JMXJsonServlet is behind the authentication filter, diff --git a/hadoop-common-project/hadoop-kms/src/main/java/org/apache/hadoop/crypto/key/kms/server/SimpleKMSAuditLogger.java b/hadoop-common-project/hadoop-kms/src/main/java/org/apache/hadoop/crypto/key/kms/server/SimpleKMSAuditLogger.java new file mode 100644 index 0000000000..4dcbe2c54f --- /dev/null +++ b/hadoop-common-project/hadoop-kms/src/main/java/org/apache/hadoop/crypto/key/kms/server/SimpleKMSAuditLogger.java @@ -0,0 +1,96 @@ +/** + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package org.apache.hadoop.crypto.key.kms.server; + +import static org.apache.hadoop.crypto.key.kms.server.KMSAudit.KMS_LOGGER_NAME; + +import java.io.IOException; +import java.util.LinkedList; +import java.util.List; + +import com.google.common.base.Joiner; +import com.google.common.base.Strings; +import org.apache.hadoop.conf.Configuration; +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; + +/** + * A simple text format audit logger. This is the default. + *
+ * IMPORTANT WARNING: Audit logs should be strictly backwards-compatible,
+ * because there are usually parsing tools highly dependent on the audit log
+ * formatting. Different tools have different ways of parsing the audit log, so
+ * changing the audit log output in any way is considered incompatible,
+ * and will haunt the consumer tools / developers. Don't do it.
+ */
+class SimpleKMSAuditLogger implements KMSAuditLogger {
+ final private Logger auditLog = LoggerFactory.getLogger(KMS_LOGGER_NAME);
+
+ @Override
+ public void cleanup() throws IOException {
+ }
+
+ @Override
+ public void initialize(Configuration conf) throws IOException {
+ }
+
+ @Override
+ public void logAuditEvent(final OpStatus status, final AuditEvent event) {
+ if (!Strings.isNullOrEmpty(event.getUser()) && !Strings
+ .isNullOrEmpty(event.getKeyName()) && (event.getOp() != null)
+ && KMSAudit.AGGREGATE_OPS_WHITELIST.contains(event.getOp())) {
+ switch (status) {
+ case OK:
+ auditLog.info(
+ "{}[op={}, key={}, user={}, accessCount={}, interval={}ms] {}",
+ status, event.getOp(), event.getKeyName(), event.getUser(),
+ event.getAccessCount().get(),
+ (event.getEndTime() - event.getStartTime()), event.getExtraMsg());
+ break;
+ case UNAUTHORIZED:
+ logAuditSimpleFormat(status, event);
+ break;
+ default:
+ logAuditSimpleFormat(status, event);
+ break;
+ }
+ } else {
+ logAuditSimpleFormat(status, event);
+ }
+ }
+
+ private void logAuditSimpleFormat(final OpStatus status,
+ final AuditEvent event) {
+ final List