Security group rule AUDIT message could be more useful

[Jay Pipes]

Hi! This is mostly just a wishlist request related to operational usability.

Recently I was investigating a report of changes to security group rules for a tenant and found that the AUDIT log messages captured during security group rule changes was, well, less than useful :)

Example:

2013-03-12 17:25:31 AUDIT nova.compute.api [req-ea8ad999-2154-4631-8d80-e33eeeb5f9b6 a8f944429f2b43758079dfda3a123222 8a25888b704146ab95c1e3e8928253f6] Authorize security group ingress default

What would be more useful to know in this particular AUDIT log message would be something like this:

2013-03-12 17:25:31 AUDIT nova.compute.api [req-ea8ad999-2154-4631-8d80-e33eeeb5f9b6 a8f944429f2b43758079dfda3a123222 8a25888b704146ab95c1e3e8928253f6] Security group default added TCP ingress (22:22)

or:

2013-03-12 17:25:31 AUDIT nova.compute.api [req-ea8ad999-2154-4631-8d80-e33eeeb5f9b6 a8f944429f2b43758079dfda3a123222 8a25888b704146ab95c1e3e8928253f6] Security group default removed ICMP ingress (-1:-1)

Best,
-jay

[Michael Still (mikal)]

This sounds like the sort of thing we could easily tweak in havana-1.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/27295

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/69396

[Sean Dague (sdague)]

Disagree that this should be at AUDIT level. I'm fine with it as debug.

[Alex Hmelevsky (alex-hmelevsky)]

According to the comments in code review, it looks like it's out of scope of this bug, so it was proposed to create a separate ticket to consider/change audit to debug log level.
I'd create it, but I have no background of the reason to do this.

[Openstack Gerrit (openstack-gerrit)]

Reviewed: https://review.openstack.org/69396
Committed: https://git.openstack.org/cgit/openstack/nova/commit/?id=67179bf58f35d54bee12e6e8eaf084e2f70ea6a2
Submitter: Jenkins
Branch: master

commit 67179bf58f35d54bee12e6e8eaf084e2f70ea6a2
Author: Alex Hmelevsky <email address hidden>
Date: Mon Jan 27 17:54:51 2014 +0200

    Improved logs for add/remove security group rules.

    Added more details - protocol and port information to AUDIT log
    messages on add/remove rule actions for security groups.

    Change-Id: Ib446a63976dade90c51c13f30367a3ee17a739ea
    Closes-Bug: #1154303