Block storage (BLOCK)

Block storage (BLOCK) audit logs in Google Distributed Cloud (GDC) air-gapped let you track create, modify, and delete operations that you run over the CLI, REST API, or Simple Network Management Protocol (SNMP). Read-only requests are not logged, and the complete set of logged operations corresponds to the CLI and REST API reference documentation. Each syslog entry records the caller identity, action, timestamp, source IP address, and response status for volume operations.

Workload location	Block storage
Audit log source	Block storage
Example audited operations	Create a volume Set the size of a volume Delete a volume

Create a volume

Fields in the log entry that contain audit information
Audit metadata	Audit field name	Value
User or service identity	message.user.identity	For example, "message":"{"user":{"identity":"root-admin-client-cert"}}
Target (Fields and values that call the API)	message.action	For example, "message":"{"action":"volume-create"}"
Action (Fields containing the performed operation)	action	For example, "action":"volume-create"
Event timestamp	time	For example, "time":"2022-12-07T13:46:49.133781Z"
Source of action	message.sourceIPs	For example, "message":"{"sourceIPs":["10.252.143.2"]}"
Outcome	message.response	For example, "message":"{"response":"success"}"
Other fields	Not applicable	Not applicable

Example log

{
  "pri":"14",
  "time":"2022-12-07T13:46:49.133781Z",
  "host":"storage",
  "ident":"storage",
  "pid":"-",
  "msgid":"-",
  "extradata":"-",
  "message":"{"time":"2022-12-07T13:40:18Z","auditID":"90199274229","user":{"identity":"root-admin-client-cert"},"resource":"{"Application":"ontapi","Hostname":"zh-ad-stge02-02","StorageVirtualMachine":"root-admin"}","action":"volume-create","sourceIPs":["10.252.143.2"],"response":"success","_gdch_org":"root-admin"}",
  "_gdch_cluster":"root-admin",
  "_gdch_fluentbit_pod":"anthos-audit-logs-forwarder-vn8f9",
  "_gdch_service_name":"admin-audit-logs"
}

Set the size of a volume

Fields in the log entry that contain audit information
Audit metadata	Audit field name	Value
User or service identity	message.user.identity	For example, "message":"{"user":{"identity":"root-admin-client-cert"}}
Target (Fields and values that call the API)	message.action	For example, "message":"{"action":"volume-size"}"
Action (Fields containing the performed operation)	action	For example, "action":"volume-size"
Event timestamp	time	For example, "time":"2022-12-07T13:46:49.133781Z"
Source of action	message.sourceIPs	For example, "message":"{"sourceIPs":["10.252.143.2"]}"
Outcome	message.response	For example, "message":"{"response":"success"}"
Other fields	Not applicable	Not applicable

Example log

{
  "pri":"14",
  "time":"2022-12-07T13:46:49.135968Z",
  "host":"storage",
  "ident":"storage",
  "pid":"-",
  "msgid":"-",
  "extradata":"-",
  "message":"{"time":"2022-12-07T13:46:36Z","auditID":"120264072202","user":{"identity":"root-admin-client-cert"},"resource":"{"Application":"ontapi","Hostname":"zh-ad-stge03-01","StorageVirtualMachine":"root-admin"}","action":"volume-size","sourceIPs":["10.252.143.2"],"response":"success","_gdch_org":"root-admin"}",
  "_gdch_cluster":"root-admin",
  "_gdch_fluentbit_pod":"anthos-audit-logs-forwarder-vn8f9",
  "_gdch_service_name":"admin-audit-logs"
}

Delete a volume

Fields in the log entry that contain audit information
Audit metadata	Audit field name	Value
User or service identity	message.user.identity	For example, "message":"{"user":{"identity":"root-admin-client-cert"}}
Target (Fields and values that call the API)	message.action	For example, "message":"{"action":"volume-destroy"}"
Action (Fields containing the performed operation)	action	For example, "action":"volume-destroy"
Event timestamp	time	For example, "time":"2022-12-07T13:46:49.133781Z"
Source of action	message.sourceIPs	For example, "message":"{"sourceIPs":["10.252.143.2"]}"
Outcome	message.response	For example, "message":"{"response":"success"}"
Other fields	Not applicable	Not applicable

Example log

{
  "pri":"14",
  "time":"2022-12-07T13:46:49.136236Z",
  "host":"storage",
  "ident":"storage",
  "pid":"-",
  "msgid":"-",
  "extradata":"-",
  "message":"{"time":"2022-12-07T13:46:37Z","auditID":"90203137689","user":{"identity":"root-admin-client-cert"},"resource":"{"Application":"ontapi","Hostname":"zh-ad-stge01-02","StorageVirtualMachine":"root-admin"}","action":"volume-destroy","sourceIPs":["10.252.143.2"],"response":"success","_gdch_org":"root-admin"}",
  "_gdch_cluster":"root-admin",
  "_gdch_fluentbit_pod":"anthos-audit-logs-forwarder-vn8f9",
  "_gdch_service_name":"admin-audit-logs"
}