Cluster Audit Logging Example¶

This example demonstrates how to configure audit logging on Qumulo clusters. Audit logging captures file system operations for security monitoring, compliance, and troubleshooting.

Features Demonstrated¶

Syslog Audit Logging: Send audit events to a remote syslog server
CloudWatch Audit Logging: Send audit events to AWS CloudWatch Logs
Connection Status Monitoring: Track the health of audit log connections
Multi-Cluster Configuration: Apply consistent audit settings across multiple clusters

Prerequisites¶

A Qumulo cluster with REST API access
Admin credentials for the cluster
For syslog: A syslog server reachable from the cluster
For CloudWatch: An AWS-hosted cluster with appropriate IAM permissions

Usage¶

Create a terraform.tfvars file:

cluster_endpoint = "https://your-cluster:8000"
cluster_username = "admin"
cluster_password = "your-password"

Initialize and apply:

terraform init -upgrade
terraform plan
terraform apply

Syslog Configuration¶

The qumulo_audit_syslog resource configures syslog-based audit logging:

resource "qumulo_audit_syslog" "main" {
  connection_profile = "cluster1"

  enabled        = true
  server_address = "syslog.example.com"
  server_port    = 514
  format         = "json"    # or "csv"
  local_enabled  = false     # per-node local logging
}

Syslog Attributes¶

Attribute	Type	Description
`enabled`	bool	Enable remote syslog audit logging
`server_address`	string	Syslog server hostname or IP (required when enabled)
`server_port`	int	Syslog server port (default: 514)
`format`	string	Output format: "json" or "csv" (default: "json")
`local_enabled`	bool	Enable per-node local logging (default: false)

Computed Status Attributes¶

Attribute	Description
`connection_status`	AUDIT_LOG_CONNECTED, AUDIT_LOG_CONNECTING, AUDIT_LOG_DISABLED, or AUDIT_LOG_DISCONNECTED
`error_message`	Error message if disconnected
`error_details`	Detailed error information

CloudWatch Configuration¶

The qumulo_audit_cloudwatch resource configures CloudWatch-based audit logging:

resource "qumulo_audit_cloudwatch" "main" {
  connection_profile = "cluster1"

  enabled        = true
  log_group_name = "/qumulo/audit"
  region         = "us-west-2"
}

CloudWatch Prerequisites¶

The cluster's IAM role must have permissions to write to CloudWatch Logs. As of Qumulo Core 7.9.0 (audit log V2), the cluster also needs logs:DescribeLogGroups and logs:DescribeLogStreams; without them the cluster returns AccessDenied when writing audit events.

{
  "Effect": "Allow",
  "Action": [
    "logs:CreateLogStream",
    "logs:DescribeLogGroups",
    "logs:DescribeLogStreams",
    "logs:PutLogEvents"
  ],
  "Resource": "arn:aws:logs:*:*:log-group:/qumulo/*"
}

Deleting Resources¶

When these resources are deleted from Terraform, the audit configuration is reset to disabled state. The configuration is a singleton on the cluster, so it cannot be truly removed.

Multi-Cluster Example¶

To configure audit logging across multiple clusters:

variable "clusters" {
  type = map(object({
    endpoint = string
    username = string
    password = string
  }))
}

provider "qumulo" {
  connection_profiles = [
    for name, config in var.clusters : {
      name     = name
      endpoint = config.endpoint
      username = config.username
      password = config.password
    }
  ]
}

resource "qumulo_audit_syslog" "all" {
  for_each = var.clusters

  connection_profile = each.key

  enabled        = true
  server_address = "central-syslog.example.com"
  format         = "json"
}

Import¶

Existing audit configurations can be imported:

# Import syslog configuration
terraform import qumulo_audit_syslog.main "prod"

# Import CloudWatch configuration
terraform import qumulo_audit_cloudwatch.main "prod"

Full Configuration¶

# Cluster Audit Logging Example
#
# This example demonstrates configuring audit logging on Qumulo clusters.
# It shows how to:
# - Configure syslog audit logging
# - Configure CloudWatch audit logging
# - Monitor connection status

terraform {
  required_providers {
    qumulo = {
      source  = "qumulo-terraform-registry.s3.us-east-1.amazonaws.com/qumulo/qumulo"
      version = "~> 1.0"
    }
  }
}

variable "cluster_endpoint" {
  description = "Qumulo cluster REST API endpoint"
  type        = string
}

variable "cluster_username" {
  description = "Qumulo cluster admin username"
  type        = string
  default     = "admin"
}

variable "cluster_password" {
  description = "Qumulo cluster admin password"
  type        = string
  sensitive   = true
}

# Define connection profile for the cluster
provider "qumulo" {
  connection_profiles = [
    {
      name                 = "cluster1"
      endpoint             = var.cluster_endpoint
      username             = var.cluster_username
      password             = var.cluster_password
      insecure_skip_verify = true # Required for clusters with self-signed certificates
    }
  ]
}

# ================================
# Syslog Audit Logging
# ================================

# Basic syslog audit configuration
resource "qumulo_audit_syslog" "main" {
  connection_profile = "cluster1"

  enabled        = true
  server_address = "syslog.example.com"
  server_port    = 514
  format         = "json"
  local_enabled  = false
}

# Output the connection status
output "syslog_connection_status" {
  description = "Syslog audit connection status"
  value       = qumulo_audit_syslog.main.connection_status
}

output "syslog_error_message" {
  description = "Syslog error message if disconnected"
  value       = qumulo_audit_syslog.main.error_message
}

# ================================
# CloudWatch Audit Logging
# ================================

# CloudWatch audit configuration (for AWS-hosted clusters)
# Uncomment to use:
#
# resource "qumulo_audit_cloudwatch" "main" {
#   connection_profile = "cluster1"
#
#   enabled        = true
#   log_group_name = "/qumulo/audit"
#   region         = "us-west-2"
# }

# ================================
# Multi-Cluster Configuration
# ================================

# Example: Configure syslog across multiple clusters
#
# variable "clusters" {
#   type = map(object({
#     endpoint = string
#     username = string
#     password = string
#   }))
# }
#
# provider "qumulo" {
#   connection_profiles = [
#     for name, config in var.clusters : {
#       name     = name
#       endpoint = config.endpoint
#       username = config.username
#       password = config.password
#     }
#   ]
# }
#
# resource "qumulo_audit_syslog" "all" {
#   for_each = var.clusters
#
#   connection_profile = each.key
#
#   enabled        = true
#   server_address = "syslog.example.com"
#   format         = "json"
# }