[jira] [Commented] (CASSANDRA-14498) Audit log does not include statements on some system keyspaces
[ https://issues.apache.org/jira/browse/CASSANDRA-14498?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16690417#comment-16690417 ] Vinay Chella commented on CASSANDRA-14498: -- [~krummas] Updated the patch to fix the tests (attached patch worked on trunk without CASSANDRA-13668 changes). Below is the branch and CircleCI unit tests, there is one unit test failing which is being addressed in CASSANDRA-14889 ||trunk||Circle CI|| |[trunk_CASS-14498|https://github.com/vinaykumarchella/cassandra/tree/trunk_CASS-14498]|[utests|https://circleci.com/gh/vinaykumarchella/cassandra/321#tests/containers/68]| > Audit log does not include statements on some system keyspaces > -- > > Key: CASSANDRA-14498 > URL: https://issues.apache.org/jira/browse/CASSANDRA-14498 > Project: Cassandra > Issue Type: Bug > Components: Auth >Reporter: Per Otterström >Assignee: Vinay Chella >Priority: Major > Labels: audit, lhf, security > Fix For: 4.0 > > Attachments: 14498-trunk.txt > > > Audit logs does not include statements on the "system" and "system_schema" > keyspace. > It may be a common use case to whitelist queries on these keyspaces, but > Cassandra should not make assumptions. Users who don't want these statements > in their audit log are still able to whitelist them with configuration. -- This message was sent by Atlassian JIRA (v7.6.3#76005) - To unsubscribe, e-mail: commits-unsubscr...@cassandra.apache.org For additional commands, e-mail: commits-h...@cassandra.apache.org
[jira] [Commented] (CASSANDRA-14498) Audit log does not include statements on some system keyspaces
[ https://issues.apache.org/jira/browse/CASSANDRA-14498?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16690082#comment-16690082 ] Vinay Chella commented on CASSANDRA-14498: -- Thanks for reviewing, I am looking into those failed tests. > Audit log does not include statements on some system keyspaces > -- > > Key: CASSANDRA-14498 > URL: https://issues.apache.org/jira/browse/CASSANDRA-14498 > Project: Cassandra > Issue Type: Bug > Components: Auth >Reporter: Per Otterström >Assignee: Vinay Chella >Priority: Major > Labels: audit, lhf, security > Fix For: 4.0 > > Attachments: 14498-trunk.txt > > > Audit logs does not include statements on the "system" and "system_schema" > keyspace. > It may be a common use case to whitelist queries on these keyspaces, but > Cassandra should not make assumptions. Users who don't want these statements > in their audit log are still able to whitelist them with configuration. -- This message was sent by Atlassian JIRA (v7.6.3#76005) - To unsubscribe, e-mail: commits-unsubscr...@cassandra.apache.org For additional commands, e-mail: commits-h...@cassandra.apache.org
[jira] [Commented] (CASSANDRA-14498) Audit log does not include statements on some system keyspaces
[ https://issues.apache.org/jira/browse/CASSANDRA-14498?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16689455#comment-16689455 ] Marcus Eriksson commented on CASSANDRA-14498: - this lgtm, with a tiny nit: https://github.com/krummas/cassandra/commit/ae103bfef73abdaa5f91bb7a0be75cbcbcd3ae62 running tests here: https://circleci.com/workflow-run/1d78e8cc-98a2-4acd-af47-505064f94c6f - will commit if they look ok > Audit log does not include statements on some system keyspaces > -- > > Key: CASSANDRA-14498 > URL: https://issues.apache.org/jira/browse/CASSANDRA-14498 > Project: Cassandra > Issue Type: Bug > Components: Auth >Reporter: Per Otterström >Assignee: Vinay Chella >Priority: Major > Labels: audit, lhf, security > Fix For: 4.0 > > Attachments: 14498-trunk.txt > > > Audit logs does not include statements on the "system" and "system_schema" > keyspace. > It may be a common use case to whitelist queries on these keyspaces, but > Cassandra should not make assumptions. Users who don't want these statements > in their audit log are still able to whitelist them with configuration. -- This message was sent by Atlassian JIRA (v7.6.3#76005) - To unsubscribe, e-mail: commits-unsubscr...@cassandra.apache.org For additional commands, e-mail: commits-h...@cassandra.apache.org
[jira] [Commented] (CASSANDRA-14498) Audit log does not include statements on some system keyspaces
[ https://issues.apache.org/jira/browse/CASSANDRA-14498?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16670318#comment-16670318 ] Per Otterström commented on CASSANDRA-14498: [~krummas], since you're looking into releated parts in CASSANDRA-14772, would you be able to review (and merge) this patch? > Audit log does not include statements on some system keyspaces > -- > > Key: CASSANDRA-14498 > URL: https://issues.apache.org/jira/browse/CASSANDRA-14498 > Project: Cassandra > Issue Type: Bug > Components: Auth >Reporter: Per Otterström >Assignee: Vinay Chella >Priority: Major > Labels: audit, lhf, security > Fix For: 4.0 > > Attachments: 14498-trunk.txt > > > Audit logs does not include statements on the "system" and "system_schema" > keyspace. > It may be a common use case to whitelist queries on these keyspaces, but > Cassandra should not make assumptions. Users who don't want these statements > in their audit log are still able to whitelist them with configuration. -- This message was sent by Atlassian JIRA (v7.6.3#76005) - To unsubscribe, e-mail: commits-unsubscr...@cassandra.apache.org For additional commands, e-mail: commits-h...@cassandra.apache.org
[jira] [Commented] (CASSANDRA-14498) Audit log does not include statements on some system keyspaces
[
https://issues.apache.org/jira/browse/CASSANDRA-14498?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16658877#comment-16658877
]
Per Otterström commented on CASSANDRA-14498:
{quote}You could have an empty {{excluded_keyspaces}} in yaml without
mentioning any keyspaces.
{quote}
Ahh, right! That works for me. And same approach is applicable for the nodetool
options.
I'm +1 on this patch!
> Audit log does not include statements on some system keyspaces
> --
>
> Key: CASSANDRA-14498
> URL: https://issues.apache.org/jira/browse/CASSANDRA-14498
> Project: Cassandra
> Issue Type: Bug
> Components: Auth
>Reporter: Per Otterström
>Assignee: Vinay Chella
>Priority: Major
> Labels: audit, lhf, security
> Fix For: 4.0
>
> Attachments: 14498-trunk.txt
>
>
> Audit logs does not include statements on the "system" and "system_schema"
> keyspace.
> It may be a common use case to whitelist queries on these keyspaces, but
> Cassandra should not make assumptions. Users who don't want these statements
> in their audit log are still able to whitelist them with configuration.
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
-
To unsubscribe, e-mail: commits-unsubscr...@cassandra.apache.org
For additional commands, e-mail: commits-h...@cassandra.apache.org
[jira] [Commented] (CASSANDRA-14498) Audit log does not include statements on some system keyspaces
[
https://issues.apache.org/jira/browse/CASSANDRA-14498?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16657478#comment-16657478
]
Vinay Chella commented on CASSANDRA-14498:
--
Thanks for reviewing the patch [~eperott]
{quote}There is one corner case that I'm not able to cover properly though;
that is having audit logs on all keyspaces.
{quote}
You could have an empty {{excluded_keyspaces}} in yaml without mentioning any
keyspaces.
e.g.,
{code:java}
excluded_keyspaces: ""
{code}
{quote}Also, most out of curiosity, what's the reasoning for adding
system_virtual_schema to the default exclude-list?
{quote}
{{system_virtual_schema}} was introduced as part of CASSANDRA-7622, these
column families tend to get queries from tools which are often at high
frequency and generates a lot of audit messages from internal tools. However,
if an operator decides to audit this keyspace they can do that from
{{cassandra.yaml}} file
Let me know if this does not satisfy your requirements.
> Audit log does not include statements on some system keyspaces
> --
>
> Key: CASSANDRA-14498
> URL: https://issues.apache.org/jira/browse/CASSANDRA-14498
> Project: Cassandra
> Issue Type: Bug
> Components: Auth
>Reporter: Per Otterström
>Assignee: Vinay Chella
>Priority: Major
> Labels: audit, lhf, security
> Fix For: 4.0
>
> Attachments: 14498-trunk.txt
>
>
> Audit logs does not include statements on the "system" and "system_schema"
> keyspace.
> It may be a common use case to whitelist queries on these keyspaces, but
> Cassandra should not make assumptions. Users who don't want these statements
> in their audit log are still able to whitelist them with configuration.
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
-
To unsubscribe, e-mail: commits-unsubscr...@cassandra.apache.org
For additional commands, e-mail: commits-h...@cassandra.apache.org
[jira] [Commented] (CASSANDRA-14498) Audit log does not include statements on some system keyspaces
[
https://issues.apache.org/jira/browse/CASSANDRA-14498?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16656894#comment-16656894
]
Per Otterström commented on CASSANDRA-14498:
Thanks! The patch looks mostly good to me.
There is one corner case that I'm not able to cover properly though; that is
having audit logs on _all_ keyspaces. This is not possible to configure, I
think, since it is not possible to have an empty {{excluded_keyspaces}} list in
the yaml, and anything listed in {{included_keyspaces}} will be overruled by
things in the {{excluded_keyspaces}} list. The only way around it would be to
configure a single non-existing keyspace in the {{excluded_keyspaces}} list,
but that doesn't feel quite right.
Also, most out of curiosity, what's the reasoning for adding
{{system_virtual_schema}} to the default exclude-list?
> Audit log does not include statements on some system keyspaces
> --
>
> Key: CASSANDRA-14498
> URL: https://issues.apache.org/jira/browse/CASSANDRA-14498
> Project: Cassandra
> Issue Type: Bug
> Components: Auth
>Reporter: Per Otterström
>Assignee: Vinay Chella
>Priority: Major
> Labels: audit, lhf, security
> Fix For: 4.0
>
> Attachments: 14498-trunk.txt
>
>
> Audit logs does not include statements on the "system" and "system_schema"
> keyspace.
> It may be a common use case to whitelist queries on these keyspaces, but
> Cassandra should not make assumptions. Users who don't want these statements
> in their audit log are still able to whitelist them with configuration.
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
-
To unsubscribe, e-mail: commits-unsubscr...@cassandra.apache.org
For additional commands, e-mail: commits-h...@cassandra.apache.org
[jira] [Commented] (CASSANDRA-14498) Audit log does not include statements on some system keyspaces
[
https://issues.apache.org/jira/browse/CASSANDRA-14498?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16654777#comment-16654777
]
Vinay Chella commented on CASSANDRA-14498:
--
[~eperott] Attached the patch to remove {{system}}, {{system_schema}} keyspaces
exclusion from AuditLogManager. This patch allows the user to enable the audit
log for system keyspaces.
> Audit log does not include statements on some system keyspaces
> --
>
> Key: CASSANDRA-14498
> URL: https://issues.apache.org/jira/browse/CASSANDRA-14498
> Project: Cassandra
> Issue Type: Bug
> Components: Auth
>Reporter: Per Otterström
>Assignee: Vinay Chella
>Priority: Major
> Labels: audit, lhf, security
> Fix For: 4.0
>
> Attachments: 14498-trunk.txt
>
>
> Audit logs does not include statements on the "system" and "system_schema"
> keyspace.
> It may be a common use case to whitelist queries on these keyspaces, but
> Cassandra should not make assumptions. Users who don't want these statements
> in their audit log are still able to whitelist them with configuration.
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
-
To unsubscribe, e-mail: commits-unsubscr...@cassandra.apache.org
For additional commands, e-mail: commits-h...@cassandra.apache.org
[jira] [Commented] (CASSANDRA-14498) Audit log does not include statements on some system keyspaces
[ https://issues.apache.org/jira/browse/CASSANDRA-14498?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16653035#comment-16653035 ] Per Otterström commented on CASSANDRA-14498: [~vinaykumarcse], any progress on this ticket? Would be nice to get this into 4.0. > Audit log does not include statements on some system keyspaces > -- > > Key: CASSANDRA-14498 > URL: https://issues.apache.org/jira/browse/CASSANDRA-14498 > Project: Cassandra > Issue Type: Bug > Components: Auth >Reporter: Per Otterström >Assignee: Vinay Chella >Priority: Major > Labels: audit, lhf, security > Fix For: 4.0 > > > Audit logs does not include statements on the "system" and "system_schema" > keyspace. > It may be a common use case to whitelist queries on these keyspaces, but > Cassandra should not make assumptions. Users who don't want these statements > in their audit log are still able to whitelist them with configuration. -- This message was sent by Atlassian JIRA (v7.6.3#76005) - To unsubscribe, e-mail: commits-unsubscr...@cassandra.apache.org For additional commands, e-mail: commits-h...@cassandra.apache.org
[jira] [Commented] (CASSANDRA-14498) Audit log does not include statements on some system keyspaces
[ https://issues.apache.org/jira/browse/CASSANDRA-14498?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16531292#comment-16531292 ] Per Otterström commented on CASSANDRA-14498: Thanks! I'm happy to review. > Audit log does not include statements on some system keyspaces > -- > > Key: CASSANDRA-14498 > URL: https://issues.apache.org/jira/browse/CASSANDRA-14498 > Project: Cassandra > Issue Type: Bug > Components: Auth >Reporter: Per Otterström >Assignee: Vinay Chella >Priority: Major > Labels: audit, lhf, security > Fix For: 4.0 > > > Audit logs does not include statements on the "system" and "system_schema" > keyspace. > It may be a common use case to whitelist queries on these keyspaces, but > Cassandra should not make assumptions. Users who don't want these statements > in their audit log are still able to whitelist them with configuration. -- This message was sent by Atlassian JIRA (v7.6.3#76005) - To unsubscribe, e-mail: commits-unsubscr...@cassandra.apache.org For additional commands, e-mail: commits-h...@cassandra.apache.org
[jira] [Commented] (CASSANDRA-14498) Audit log does not include statements on some system keyspaces
[
https://issues.apache.org/jira/browse/CASSANDRA-14498?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16524363#comment-16524363
]
Vinay Chella commented on CASSANDRA-14498:
--
{quote}The problem I see with a hard coded filter is that it will not only
filter out queries from the driver, but also any query issued by the client
application on those keyspaces.
The decision should be with the administrator of the cluster and it will still
be possible to whitelist these queries with configuration. We could add some
documentation on this so that users will not get surprised when they see
queries in the log that they didn't expect.
{quote}
I buy this argument, will start working on it, we can ship with default
excluding system keyspaces and let administrator tweak it as needed.
> Audit log does not include statements on some system keyspaces
> --
>
> Key: CASSANDRA-14498
> URL: https://issues.apache.org/jira/browse/CASSANDRA-14498
> Project: Cassandra
> Issue Type: Bug
> Components: Auth
>Reporter: Per Otterström
>Priority: Major
> Labels: audit, lhf, security
> Fix For: 4.0
>
>
> Audit logs does not include statements on the "system" and "system_schema"
> keyspace.
> It may be a common use case to whitelist queries on these keyspaces, but
> Cassandra should not make assumptions. Users who don't want these statements
> in their audit log are still able to whitelist them with configuration.
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
-
To unsubscribe, e-mail: commits-unsubscr...@cassandra.apache.org
For additional commands, e-mail: commits-h...@cassandra.apache.org
[jira] [Commented] (CASSANDRA-14498) Audit log does not include statements on some system keyspaces
[ https://issues.apache.org/jira/browse/CASSANDRA-14498?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16504296#comment-16504296 ] Per Otterström commented on CASSANDRA-14498: bq. are there any use cases where you would to audit system keyspaces? One use case would be to get audit logs on all operations from selected users. bq. auditing these generate lot of noise as C* calls system keyspaces in many places Internal calls in C* will not come through the audit logger. Right? I've observed that client drivers will emit some queries on their own. This typically happens when a user login or when there are schema changes. But that only represents a fraction of all operations coming from a client. The problem I see with a hard coded filter is that it will not only filter out queries from the driver, but also any query issued by the client application on those keyspaces. The decision should be with the administrator of the cluster and it will still be possible to whitelist these queries with configuration. We could add some documentation on this so that users will not get surprised when they see queries in the log that they didn't expect. > Audit log does not include statements on some system keyspaces > -- > > Key: CASSANDRA-14498 > URL: https://issues.apache.org/jira/browse/CASSANDRA-14498 > Project: Cassandra > Issue Type: Bug > Components: Auth >Reporter: Per Otterström >Priority: Major > Labels: audit, lhf, security > Fix For: 4.0 > > > Audit logs does not include statements on the "system" and "system_schema" > keyspace. > It may be a common use case to whitelist queries on these keyspaces, but > Cassandra should not make assumptions. Users who don't want these statements > in their audit log are still able to whitelist them with configuration. -- This message was sent by Atlassian JIRA (v7.6.3#76005) - To unsubscribe, e-mail: commits-unsubscr...@cassandra.apache.org For additional commands, e-mail: commits-h...@cassandra.apache.org
[jira] [Commented] (CASSANDRA-14498) Audit log does not include statements on some system keyspaces
[ https://issues.apache.org/jira/browse/CASSANDRA-14498?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16503715#comment-16503715 ] Vinay Chella commented on CASSANDRA-14498: -- Just curious, are there any use cases where you would to audit system keyspaces? fwiw auditing these generate lot of noise as C* calls system keyspaces in many places throughout its lifetime > Audit log does not include statements on some system keyspaces > -- > > Key: CASSANDRA-14498 > URL: https://issues.apache.org/jira/browse/CASSANDRA-14498 > Project: Cassandra > Issue Type: Bug > Components: Auth >Reporter: Per Otterström >Priority: Major > Labels: audit, lhf, security > Fix For: 4.0 > > > Audit logs does not include statements on the "system" and "system_schema" > keyspace. > It may be a common use case to whitelist queries on these keyspaces, but > Cassandra should not make assumptions. Users who don't want these statements > in their audit log are still able to whitelist them with configuration. -- This message was sent by Atlassian JIRA (v7.6.3#76005) - To unsubscribe, e-mail: commits-unsubscr...@cassandra.apache.org For additional commands, e-mail: commits-h...@cassandra.apache.org
