mc log audit

The mc log audit command views and manages the recorded audit logs on a MinIO AIStor deployment.

mc log audit --last 24h myaistor

mc [GLOBALFLAGS] log audit                     \
                 [--last DURATION]             \
                 [--nodes NODE]                \
                 [--buckets BUCKET]            \
                 [--apis API]                  \
                 [--categories CATEGORY]       \
                 [--limit NUMBER]              \
                 [--out FILE | --in FILE]      \
                 [--get-config | --set-config FILE] \
                 [ALIAS]

Parameters

ALIAS

Required

The alias of a MinIO AIStor cluster.

ALIAS is optional when you use --in to view a saved file.

--last

Alias: -l

Optional

Show logs for the last duration, for example 5m, 2h, or 1d.

--nodes

Alias: -n

Optional

Filter logs by node name. Specify multiple times to match multiple nodes. Supports * wildcards: abc* (prefix), *abc (suffix), *abc* (contains).

--buckets

Optional

Filter logs by bucket name. Specify multiple times to match multiple buckets. Supports * wildcards: abc* (prefix), *abc (suffix), *abc* (contains).

--apis

Optional

Filter logs by API name, for example putobject or getobject. Specify multiple times to match multiple APIs. Supports * wildcards: abc* (prefix), *abc (suffix), *abc* (contains).

--categories

Optional

Filter logs by audit category. Specify one or more of: config, user, service-account, policy, group, bucket, lifecycle, replication, notification, encryption, cors, versioning, service, kms, site-replication, pool, idp, log-recorder, heal, batch.

--limit

Optional

Limit the total number of log entries returned. Defaults to 1000.

--out

Alias: -o

Optional

Save the logs to a compressed (.zst) file instead of printing them. View the saved file later with --in.

--in

Optional

View logs from a previously saved file instead of querying the deployment. Filter flags apply to the saved file when replaying.

--get-config

Optional

Export the current audit log recorder configuration to YAML on standard output. Redirect to a file to edit it, for example mc log audit --get-config ALIAS > audit-config.yaml.

The audit recorder configuration includes the enable key.

--set-config

Optional

Apply an audit log recorder configuration from a YAML file to the deployment.

Global flags

This command supports any of the global flags.

Examples

Show recent audit logs

mc log audit --last 24h myaistor

Filter by audit category

mc log audit --categories user myaistor

Save logs for offline review

mc log audit --out audit-logs.zst myaistor
mc log audit --in audit-logs.zst