Send audit logs to syslog and CloudWatch

When you finish, the cluster sends an audit event for every file system operation to your syslog server, and to CloudWatch Logs as well if it runs on AWS.

Before you start

• A Qumulo cluster whose REST API on port 8000 you can reach from this machine
• An admin account on the cluster for the connection profile
• Terraform 1.11 or later
• A syslog server the cluster can reach on port 514, or on the port you set with server_port
• For CloudWatch, a cluster on AWS and an existing CloudWatch log group, such as /qumulo/audit

1. Copy the configuration

Save this as main.tf in an empty directory.

terraform {
  required_version = ">= 1.11"
  required_providers {
    qumulo = {
      source  = "qumulo-terraform-registry.s3.us-east-1.amazonaws.com/qumulo/qumulo"
      version = "~> 1.0"
    }
  }
}

provider "qumulo" {
  connection_profiles = [
    {
      name                 = "cluster1"
      endpoint             = "https://cluster.example.com:8000" # <-- Replace with your cluster's REST API endpoint
      username             = "admin"
      password             = "YourClusterPassword123!" # <-- Replace with your admin password
      insecure_skip_verify = true
    },
  ]
}

resource "qumulo_audit_syslog" "main" {
  connection_profile = "cluster1"

  enabled        = true
  server_address = "syslog.example.com" # <-- Replace with your syslog server
  server_port    = 514
  format         = "json"
}

output "syslog_connection_status" {
  value = qumulo_audit_syslog.main.connection_status
}

Replace the three values marked <-- Replace, and leave the rest as written. For CSV messages instead of JSON, set format = "csv".

Delete insecure_skip_verify if the cluster's certificate is signed by a CA your machine trusts.

2. Send audit logs to CloudWatch

Skip this step unless the cluster runs on AWS. Add this statement to a policy on the cluster's IAM role.

{
  "Effect": "Allow",
  "Action": [
    "logs:CreateLogStream",
    "logs:DescribeLogGroups",
    "logs:DescribeLogStreams",
    "logs:PutLogEvents"
  ],
  "Resource": "arn:aws:logs:*:*:log-group:/qumulo/*"
}

Qumulo Core 7.9.0 and later need the two Describe actions as well as the write actions. Without them, the cluster gets AccessDenied when it writes audit events.

Then add this block to main.tf.

resource "qumulo_audit_cloudwatch" "main" {
  connection_profile = "cluster1"

  enabled        = true
  log_group_name = "/qumulo/audit" # <-- Replace with your log group
  region         = "us-west-2"     # <-- Replace with the log group's region
}

The plan in step 3 adds qumulo_audit_cloudwatch.main beside the syslog resource.

3. Apply

terraform init -upgrade
terraform plan
terraform apply

The plan ends with Plan: 1 to add, 0 to change, 0 to destroy., or Plan: 2 to add with CloudWatch. The apply ends with Apply complete!, followed by the syslog_connection_status output.

4. Check the connection

terraform apply -refresh-only

The refreshed output shows syslog_connection_status = "AUDIT_LOG_CONNECTED" once the cluster reaches the server. If it shows AUDIT_LOG_DISCONNECTED, run terraform state show qumulo_audit_syslog.main and read error_message and error_details.

Next

Send the same audit settings to every cluster with Manage several clusters from one configuration. If events stop arriving, see Troubleshoot cluster configuration, and the qumulo_audit_syslog and qumulo_audit_cloudwatch references list every attribute.

Audit logging concepts, including what each event records, are in Qumulo's documentation.