Audit log setting parameters not working

Security
1

Versions (relevant - OpenSearch/Dashboard/Server OS/Browser):
Opensearch v2.2.1

Describe the issue:
I am using Opensearch v2.2.1 and have enabled audit logging. I observed that few setting parameters are not taking any effect and not working. Below is the configuration I have added in opensearch.yml file after following documentation: Audit logs - OpenSearch documentation

Configuration:
plugins.security.audit.type: log4j
plugins.security.audit.config.log4j.logger_name: audit
plugins.security.audit.config.log4j.level: INFO
plugins.security.audit.config.disabled_rest_categories: NONE
plugins.security.audit.config.disabled_transport_categories: NONE
plugins.security.audit.ignore_users: NONE

For plugins.security.audit.config.disabled_rest_categories and plugins.security.audit.config.disabled_transport_categories it is not throwing any error, however it is not having any impact.
For plugins.security.audit.ignore_users setting it throws below error:

Relevant Logs or Screenshots:
org.opensearch.bootstrap.StartupException: java.lang.IllegalArgumentException: unknown setting [plugins.security.audit.ignore_users] did you mean [plugins.security.audit.config.username]?

Please suggest if there is anything missed from the configuration or if this is a known bug.
Thanks in advance.

2

Hey @Pratiksha

from what I get with that error…

The settings your using such as plugins.security.audit.ignore_users instead of configuring it in the configuration file, did you try to use the Web UI instead?

image
image1548×868 72.4 KB

3

Hi @Gsmitt
Yes, I have tried that from UI and it has worked. However, these settings in config file should also work right as per documentation Audit logs - OpenSearch documentation

4

Also faced the issue with 2.6.0.
Working from the UI but not from backend.

5

Yup, issue being experienced in 2.5.0 and 2.6.0. Audit logs also logging source IP address as instance/node of opensearch dashboard.