Security
Audit log
A record you can hand to somebody a year later that still makes sense. That is a lower bar than it sounds and most tools miss it.
What is recorded
- Every configuration change, with what changed and who changed it.
- Every apply, with the version number it produced.
- Every sign in and every failed sign in, with the source address.
- Account changes: roles, enabling, disabling, second factor resets.
- Cluster events: nodes joining, failovers, forced standby.
- Certificate issue, renewal and failure.
- Every use of the console recovery command, marked as coming from the console.
It stays on the node where it happened
The audit log is written on the node where the event occurred and does not travel. When you are looking for something and cannot find it, check the other node.
This is deliberate. A log that traveled between machines could claim something was done on a server that never did it, which would make it useless as a record. The small inconvenience of looking in two places is the price of the log meaning what it says.
Secrets stay out of it
There is a check in the test suite specifically for this: the audit log keeping secrets out of itself. Tokens, keys and passwords are recorded as having changed, never as values. A log that contains the secrets is a second copy of the secrets.
Config versions are their own history
Alongside the audit log, every applied configuration version is kept with what changed, who did it and which node it came from. That is what makes rollback a click rather than an archaeology exercise.
Common questions
How long is it kept?
Until you clear it. It is small, because it holds events rather than traffic.
Can I export it?
Yes, through the JSON API, which is the sensible way to get it into whatever you use for log analysis.
Is a failed sign in recorded even when the username does not exist?
Yes. A gap in the record where somebody probed for accounts would be exactly the gap that matters.
Step by step instructions
The how to section has searchable, task shaped answers. Search it for audit.