Kafka Audit Logs
The following section documents environment variables for configuring MinIO AIStor to publish audit logs to a Kafka broker.
The top-level configuration key for defining a Kafka broker target for publishing MinIO AIStor audit logs.
Example
Settings
Enable
Set to “on” to enable the target. Set to “off” to disable the target.
Brokers
A comma-separated list of Kafka broker addresses.
Topic
The name of the Kafka topic to associate to MinIO AIStor audit log events.
TLS
Set to “on” to enable TLS connectivity to the specified Kafka brokers. Defaults to “off”.
TLS skip verify
Set to “on” to direct MinIO AIStor to skip verification of the Kafka broker TLS certificates.
SASL
Set to “on” to direct MinIO AIStor to use SASL to authenticate against the Kafka brokers.
SASL username
The SASL username MinIO AIStor uses for authentication against the Kafka brokers.
SASL password
The SASL password MinIO AIStor uses for authentication against the Kafka brokers.
SASL mechanism
The SASL mechanism MinIO AIStor uses for authentication against the Kafka brokers. Defaults to plain.
SASL Kerberos realm
The realm name to use with SASL/GSSAPI (Kerberos) authentication.
SASL Kerberos keytab
The path to the MinIO AIStor keytab to use with SASL/GSSAPI (Kerberos) authentication.
SASL Kerberos config path
The path to the krb5.conf file to use with SASL/GSSAPI (Kerberos) authentication.
SASL Kerberos principal
The principal name without realm suffix to use with SASL/GSSAPI (Kerberos) authentication.
TLS client auth
An integer from 0 to 4 matching Go’s tls.ClientAuthType.
MinIO AIStor presents its client certificate through client_tls_cert and client_tls_key.
This setting maps to the ClientAuth field of the Go TLS configuration, which Go defines as the policy a TLS server applies to client authentication.
Whether mutual TLS is required is determined by the Kafka broker.
MinIO AIStor rejects the whole audit_kafka configuration if this value is not an integer.
Defaults to 0.
Client TLS cert
The path to the TLS client certificate to use for mTLS authentication.
Client TLS key
The path to the TLS client private key to use for mTLS authentication.
Version
The version of the Kafka broker MinIO AIStor expects at the specified endpoints.
Max retry
The maximum number of times MinIO AIStor retries sending a failed event before dropping it.
A value of 0 retries indefinitely.
Defaults to 0.
Retry interval
The duration MinIO AIStor waits between retries of a failed event, such as 10s.
The maximum allowed value is 1m.
Defaults to 1s.
Comment
A comment to associate with the configuration.
Queue dir
audit_event_queue instead.
Specify the directory path to enable MinIO AIStor’s persistent event store for undelivered messages, such as /opt/minio/events.
Queue size
audit_event_queue instead.
Specify the maximum limit for undelivered messages. Defaults to 100000.