Red Hat OpenShift Container Platform

Configuring the audit log policy

You can configure the audit log policy to use when logging requests that come to the API servers.

Prerequisites

You have access to the cluster as a user with the cluster-admin role.

Procedure

Edit the APIServer resource:
```
$ oc edit apiserver cluster
```

Update the spec.audit.profile field:

apiVersion: config.openshift.io/v1
kind: APIServer
metadata:
...
spec:
  audit:
    profile: WriteRequestBodies

where:

profile

Set to Default, WriteRequestBodies, AllRequestBodies, or None. The default profile is Default.

It is not recommended to disable audit logging by using the None profile unless you are fully aware of the risks of not logging data that can be beneficial when troubleshooting issues. If you disable audit logging and a support situation arises, you might need to enable audit logging and reproduce the issue in order to troubleshoot properly.

Save the file to apply the changes.

Verification

Verify that a new revision of the Kubernetes API server pods is rolled out. It can take several minutes for all nodes to update to the new revision.
```
$ oc get kubeapiserver -o=jsonpath='{range .items[0].status.conditions[?(@.type=="NodeInstallerProgressing")]}{.reason}{"\n"}{.message}{"\n"}'
```
Review the NodeInstallerProgressing status condition for the Kubernetes API server to verify that all nodes are at the latest revision. The output shows AllNodesAtLatestRevision upon successful update:
```
AllNodesAtLatestRevision
3 nodes are at revision 12
```
In this example, the latest revision number is 12.

If the output shows a message similar to one of the following messages, the update is still in progress. Wait a few minutes and try again.
- 3 nodes are at revision 11; 0 nodes have achieved new revision 12
- 2 nodes are at revision 11; 1 nodes are at revision 12