enableauditlog — 감사 로그 활성화

enableauditlog — 감사 로그 활성화

nodetool enableauditlog 명령은 노드의 감사 로그(audit log)를 활성화하는 명령이에요. 필터링·로깅 옵션을 명령 인자로 지정할 수 있어요.

출처: nodetool enableauditlog

본문

enableauditlog는 감사 로깅을 켜는 명령이에요. 포함·제외할 카테고리, 키스페이스, 사용자를 --included-*/--excluded-* 옵션으로 지정할 수 있고, 옵션을 지정하지 않으면 cassandra.yaml의 설정값을 사용해요. 로그 롤링 주기는 --roll-cycle로(MINUTELY, HOURLY, DAILY) 정해요. 아래는 완전한 사용법이에요.

NAME
        nodetool enableauditlog - Enable the audit log

SYNOPSIS
        nodetool [(-h <host> | --host <host>)] [(-p <port> | --port <port>)]
                [(-pp | --print-port)] [(-pw <password> | --password <password>)]
                [(-pwf <passwordFilePath> | --password-file <passwordFilePath>)]
                [(-u <username> | --username <username>)] enableauditlog
                [--archive-command <archive_command>] [--blocking <blocking>]
                [--excluded-categories <excluded_categories>]
                [--excluded-keyspaces <excluded_keyspaces>]
                [--excluded-users <excluded_users>]
                [--included-categories <included_categories>]
                [--included-keyspaces <included_keyspaces>]
                [--included-users <included_users>] [--logger <logger>]
                [--max-archive-retries <archive_retries>]
                [--max-log-size <max_log_size>] [--max-queue-weight <max_queue_weight>]
                [--roll-cycle <roll_cycle>]

OPTIONS
        --archive-command <archive_command>
            Command that will handle archiving rolled audit log files. Format is
            "/path/to/script.sh %path" where %path will be replaced with the
            file to archive Enable this by setting the
            audit_logging_options.allow_nodetool_archive_command: true in the
            config.

        --blocking <blocking>
            If the queue is full whether to block producers or drop samples
            [true|false].

        --excluded-categories <excluded_categories>
            Comma separated list of Audit Log Categories to be excluded for
            audit log. If not set the value from cassandra.yaml will be used

        --excluded-keyspaces <excluded_keyspaces>
            Comma separated list of keyspaces to be excluded for audit log. If
            not set the value from cassandra.yaml will be used

        --excluded-users <excluded_users>
            Comma separated list of users to be excluded for audit log. If not
            set the value from cassandra.yaml will be used

        -h <host>, --host <host>
            Node hostname or ip address

        --included-categories <included_categories>
            Comma separated list of Audit Log Categories to be included for
            audit log. If not set the value from cassandra.yaml will be used

        --included-keyspaces <included_keyspaces>
            Comma separated list of keyspaces to be included for audit log. If
            not set the value from cassandra.yaml will be used

        --included-users <included_users>
            Comma separated list of users to be included for audit log. If not
            set the value from cassandra.yaml will be used

        --logger <logger>
            Logger name to be used for AuditLogging. Default BinAuditLogger. If
            not set the value from cassandra.yaml will be used

        --max-archive-retries <archive_retries>
            Max number of archive retries.

        --max-log-size <max_log_size>
            How many bytes of log data to store before dropping segments. Might
            not be respected if a log file hasn't rolled so it can be deleted.

        --max-queue-weight <max_queue_weight>
            Maximum number of bytes of query data to queue to disk before
            blocking or dropping samples.

        -p <port>, --port <port>
            Remote jmx agent port number

        -pp, --print-port
            Operate in 4.0 mode with hosts disambiguated by port number

        -pw <password>, --password <password>
            Remote jmx agent password

        -pwf <passwordFilePath>, --password-file <passwordFilePath>
            Path to the JMX password file

        --roll-cycle <roll_cycle>
            How often to roll the log file (MINUTELY, HOURLY, DAILY).

        -u <username>, --username <username>
            Remote jmx agent username

로그 파일을 보관(archive)할 때는 --archive-command "/path/to/script.sh %path"처럼 %path 자리에 파일 경로가 치환되는 명령을 지정하고, 설정 파일에서 audit_logging_options.allow_nodetool_archive_command: true를 켜야 해요.

더 알아보기 (Learn more)