Red Hat build of MicroShift

Default audit log values

MicroShift includes the following default audit log rotation values:

Table 11. MicroShift default audit log values
Audit log parameter	Default setting	Definition
`maxFileAge`:	`0`	How long log files are retained before automatic deletion. The default value means that a log file is never deleted based on age. This value can be configured.
`maxFiles`:	`10`	The total number of log files retained. By default, MicroShift retains 10 log files. The oldest is deleted when an excess file is created. This value can be configured.
`maxFileSize`:	`200`	By default, when the `audit.log` file reaches the `maxFileSize` limit, the `audit.log` file is rotated and MicroShift begins writing to a new `audit.log` file. This value is in megabytes and can be configured.
`profile`:	`Default`	The `Default` profile setting only logs metadata for read and write requests; request bodies are not logged except for OAuth access token requests. If you do not specify this field, the `Default` profile is used.

The maximum default storage usage for audit log retention is 2000Mb if there are 10 or fewer files.

If you do not specify a value for a field, the default value is used. If you remove a previously set field value, the default value is restored after the next MicroShift service restart.

You must configure audit log retention and rotation in Red Hat Enterprise Linux (RHEL) for logs that are generated by application pods. These logs print to the console and are saved. Ensure that your log preferences are configured for the RHEL /var/log/audit/audit.log file to maintain MicroShift node health.