Audit Logging

    This feature requires Consul Enterprise with the Governance and Policy module.

    Consul Enterprise v1.8.0 adds audit logging as a feature that captures a clear and actionable log of authenticated events (both attempted and committed) that Consul processes via its HTTP API and compiles them into a JSON format for easy export. These events contain a timestamp, the operation performed, and the user who initiated the action.

    Audit logging enables security and compliance teams within an organization to get greater insight into Consul access and usage patterns.

    For more experience leveraging Consul’s audit logging functionality, explore our HashiCorp Learn tutorial .

    Audit logging must be enabled on every agent in order to accurately capture all operations performed through the HTTP API. To enable logging, add the audit stanza to the agent’s configuration.

    Note: Consul only logs operations which are initiated via the HTTP API. The audit log does not record operations that take place over the internal RPC communication channel used for agent communication.

    Audit Logging - 图2

    HCL

    Example Audit Log

    In this example a client has issued an HTTP GET request to look up the ssh service in the endpoint.

    Details from the HTTP request are recorded in the audit log. The stage field is set to which indicates the agent has begun processing the request.

    After the request is processed, a corresponding log entry is written for the HTTP response. The field is set to OperationComplete which indicates the agent has completed processing the request.