How to review audit logs

Errors or typos? Topics missing? Hard to read? Let us know.

Audit events are a subset of the MAAS event logs. This page provides reference material for those who want to review and report on events designated as MAAS audit events.

Auditing MAAS

MAAS audit events can be viewed using the CLI with a command similar to the following:

maas $PROFILE events query level=AUDIT

Such a command would produce JSON output like this:

These MAAS audit events consist of the following information:

• username: the name of the user whose actions triggered the event. This field is frequently blank, since many recordable events are triggered by MAAS and not by a specific user.
• node: this is the $SYSTEM_ID frequently used in the CLI to reference node. This field is filled if a particular node participated in the event, even if the node did not trigger that event.
• hostname: this is the node which triggered the event. Generally, this will be the name of the region controller, the name of a machine, or blank. Blank entries are events triggered by MAAS itself, such as Starting rack boot image import, which are not triggered by node.
• id: a unique ID number assigned to table records as a primary key.
• level: the level of event, such as AUDIT, DEBUG, etc.
• created: the timestamp when this event entry was created.
• description: a long text description of what took place. This field is almost always populated; this is the primary information used for auditing MAAS events.
• type: this is the type of event that occurred, as shown in the following table.

For information on how to use these audit events to answer specific questions, see How to work with audit event logs.

---

Last updated 6 months ago.