Offline docs (switch to live docs)                         UI-only         CLI-only

Audit event log reference

Audit events are a subset of the MAAS event logs. This article will provide reference material for those who want to review and report on events designated as MAAS audit events.

About MAAS audit events

MAAS audit events can be viewed via the CLI with a command similar to the following:

maas $PROFILE events query level=AUDIT

Such a command would produce JSON output like this:

Machine-readable output follows:
{
    "count": 14,
    "events": [
        {
            "username": "admin",
            "node": "e86c7h",
            "hostname": "valued-moth",
            "id": 12729,
            "level": "AUDIT",
            "created": "Mon, 25 Apr. 2022 21:51:23",
            "type": "Node",
            "description": "Started deploying 'valued-moth'."
        },
        {
            "username": "admin",
            "node": "e86c7h",
            "hostname": "valued-moth",
            "id": 12725,
            "level": "AUDIT",
            "created": "Mon, 25 Apr. 2022 21:51:18",
            "type": "Node",
            "description": "Acquired 'valued-moth'."
        },
        {
            "username": "admin",
            "node": null,
            "hostname": "valued-moth",
            "id": 12502,
            "level": "AUDIT",
            "created": "Mon, 25 Apr. 2022 21:44:51",
            "type": "Node",
            "description": "Aborted 'commissioning' on 'valued-moth'."
        },
        {
            "username": "admin",
            "node": null,
            "hostname": "valued-moth",
            "id": 12497,
            "level": "AUDIT",
            "created": "Mon, 25 Apr. 2022 21:41:52",
            "type": "Node",
            "description": "Started commissioning on 'valued-moth'."
        },
        {
            "username": "admin",
            "node": null,
            "hostname": "valued-moth",
            "id": 12493,
            "level": "AUDIT",
            "created": "Mon, 25 Apr. 2022 21:41:18",
            "type": "Node",
            "description": "Started releasing 'valued-moth'."
        },
        {
            "username": "admin",
            "node": null,
            "hostname": "valued-moth",
            "id": 12486,
            "level": "AUDIT",
            "created": "Mon, 25 Apr. 2022 21:40:42",
            "type": "Node",
            "description": "Acquired 'valued-moth'."
        },
        {
            "username": "admin",
            "node": null,
            "hostname": "valued-moth",
            "id": 12479,
            "level": "AUDIT",
            "created": "Mon, 25 Apr. 2022 21:40:34",
            "type": "Node",
            "description": "Started releasing 'valued-moth'."
        },
        {
            "username": "admin",
            "node": null,
            "hostname": "valued-moth",
            "id": 134,
            "level": "AUDIT",
            "created": "Thu, 21 Apr. 2022 19:36:48",
            "type": "Node",
            "description": "Started deploying 'valued-moth'."
        },
        {
            "username": "admin",
            "node": null,
            "hostname": "valued-moth",
            "id": 130,
            "level": "AUDIT",
            "created": "Thu, 21 Apr. 2022 19:36:21",
            "type": "Node",
            "description": "Acquired 'valued-moth'."
        },
        {
            "username": "admin",
            "node": null,
            "hostname": "unknown",
            "id": 18,
            "level": "AUDIT",
            "created": "Thu, 21 Apr. 2022 19:21:46",
            "type": "Settings",
            "description": "Updated configuration setting 'completed_intro' to 'True'."
        },
        {
            "username": "admin",
            "node": null,
            "hostname": "unknown",
            "id": 14,
            "level": "AUDIT",
            "created": "Thu, 21 Apr. 2022 19:20:49",
            "type": "Settings",
            "description": "Updated configuration setting 'upstream_dns' to '8.8.8.8'."
        },
        {
            "username": "admin",
            "node": null,
            "hostname": "unknown",
            "id": 13,
            "level": "AUDIT",
            "created": "Thu, 21 Apr. 2022 19:20:49",
            "type": "Settings",
            "description": "Updated configuration setting 'maas_name' to 'neuromancer'."
        },
        {
            "username": "admin",
            "node": null,
            "hostname": "unknown",
            "id": 12,
            "level": "AUDIT",
            "created": "Thu, 21 Apr. 2022 19:20:47",
            "type": "Settings",
            "description": "Updated configuration setting 'http_proxy' to ''."
        },
        {
            "username": "admin",
            "node": null,
            "hostname": "unknown",
            "id": 11,
            "level": "AUDIT",
            "created": "Thu, 21 Apr. 2022 19:20:24",
            "type": "Authorisation",
            "description": "Logged in admin."
        }
    ],
    "next_uri": "/MAAS/api/2.0/events/?op=query&level=AUDIT&owner=admin&after=12729",
    "prev_uri": "/MAAS/api/2.0/events/?op=query&level=AUDIT&owner=admin&before=11"
}

These MAAS audit events consist of the following information:

              name               |                 description                  
---------------------------------+----------------------------------------------
 AUTHORISATION                   | Authorisation
 SETTINGS                        | Settings
 NODE                            | Node
 NODE_HARDWARE_SYNC_MEMORY       | Node Memory hardware sync state change
 NODE_HARDWARE_SYNC_INTERFACE    | Node Interface hardware sync state change
 NODE_HARDWARE_SYNC_BLOCK_DEVICE | Node Block Device hardware sync state change
 NODE_HARDWARE_SYNC_PCI_DEVICE   | Node PCI Device hardware sync state change
 NODE_HARDWARE_SYNC_CPU          | Node CPU hardware sync state change
 NODE_HARDWARE_SYNC_USB_DEVICE   | Node USB Device hardware sync state change

Table of audit events

The following abridged listing gives a sense of the specific events associated with each of these event types:

              name               | action  |                         description                          
---------------------------------+---------+--------------------------------------------------------------
 AUTHORISATION                   |         | Logged in admin.
 NODE                            |         | Started commissioning a machine.
 NODE                            |         | Started releasing a machine.
 NODE                            |         | Acquired a machine.
 NODE                            |         | Aborted commissioning on a machine.
 NODE                            |         | Started deploying a machine.
 NODE                            |         | Aborted deployment of a machine. 
 NODE_HARDWARE_SYNC_BLOCK_DEVICE | added   | Added a block device to a machine.
 NODE_HARDWARE_SYNC_BLOCK_DEVICE | removed | Removed a block device from a machine.
 NODE_HARDWARE_SYNC_BLOCK_DEVICE | updated | Updated a block device on a machine.
 NODE_HARDWARE_SYNC_CPU          | added   | Added a CPU to a machine.
 NODE_HARDWARE_SYNC_CPU          | removed | Removed a CPU from a machine.
 NODE_HARDWARE_SYNC_INTERFACE    | added   | Added an interface to a machine.
 NODE_HARDWARE_SYNC_INTERFACE    | removed | Removed an interface from a machine.
 NODE_HARDWARE_SYNC_INTERFACE    | updated | Updated an interface on a machine.  
 NODE_HARDWARE_SYNC_MEMORY       | added   | Added memory to a machine.
 NODE_HARDWARE_SYNC_MEMORY       | removed | Removed memory from a machine.
 NODE_HARDWARE_SYNC_MEMORY       | updated | Updated memory on a machine.
 NODE_HARDWARE_SYNC_PCI_DEVICE   | updated | Updated a PCI device on a machine.
 NODE_HARDWARE_SYNC_PCI_DEVICE   | added   | Added a PCI device to a machine.
 NODE_HARDWARE_SYNC_PCI_DEVICE   | removed | Removed a PCI device from a machine.
 NODE_HARDWARE_SYNC_USB_DEVICE   | added   | Added a USB device to a machine.
 NODE_HARDWARE_SYNC_USB_DEVICE   | removed | Removed a USB device from a machine.
 NODE_HARDWARE_SYNC_USB_DEVICE   | updated | Updated a USB device on a machine.
 SETTINGS                        |         | Updated MAAS settings.

You will notice that these audit event logs are essentially state changes:

For information on how to use these audit events to answer specific questions, see How to work with audit event logs.