Audit logs emitting same log thrice with different log levels i.e. info, warn and error

Security
1

Versions (relevant - OpenSearch/Dashboard/Server OS/Browser):
Opensearch v2.2.1

Describe the issue:
I am using Opensearch v2.2.1 and have enabled audit logging. I see that every audit log is getting generated 3 times with just different log levels i.e. warn, error and info.
Please suggest on how to fix this and what is the reason that same log is getting generated 3 times.

Configuration:
Added below config in opensearch.yml file:
plugins.security.audit.type: log4j
plugins.security.audit.config.log4j.logger_name: audit

Relevant Logs or Screenshots:
[2023-04-10T18:19:51,181][INFO ][audit ] [opensearch-75f75866b4-5wkm5] {“audit_cluster_name”:“pratiksha-testifd”,“audit_rest_request_params”:{“v”:“”},“audit_node_name”:“opensearch-client-75f75866b4-5wkm5”,“audit_rest_request_method”:“GET”,“audit_category”:“FAILED_LOGIN”,“audit_request_origin”:“REST”,“audit_node_id”:“HU0PL4bMSIi1DC5vyUi2wA”,“audit_request_layer”:“REST”,“audit_rest_request_path”:“/_cat/indices”,“@timestamp”:“2023-04-10T18:19:51.177+00:00”,“audit_request_effective_user_is_admin”:false,“audit_format_version”:4,“audit_request_remote_address”:“ip”,“audit_node_host_address”:“ip”,“audit_rest_request_headers”:{“User-Agent”:[“curl/7.29.0”],“content-length”:[“0”],“Host”:[“ip:9200”],“Accept”:[“/”]},“audit_request_effective_user”:“user1”,“audit_node_host_name”:“ip”}
[2023-04-10T18:19:51,182][WARN ][audit ] [opensearch-75f75866b4-5wkm5] {“audit_cluster_name”:“pratiksha-testifd”,“audit_rest_request_params”:{“v”:“”},“audit_node_name”:“opensearch-client-75f75866b4-5wkm5”,“audit_rest_request_method”:“GET”,“audit_category”:“FAILED_LOGIN”,“audit_request_origin”:“REST”,“audit_node_id”:“HU0PL4bMSIi1DC5vyUi2wA”,“audit_request_layer”:“REST”,“audit_rest_request_path”:“/_cat/indices”,“@timestamp”:“2023-04-10T18:19:51.177+00:00”,“audit_request_effective_user_is_admin”:false,“audit_format_version”:4,“audit_request_remote_address”:“ip”,“audit_node_host_address”:“ip”,“audit_rest_request_headers”:{“User-Agent”:[“curl/7.29.0”],“content-length”:[“0”],“Host”:[“ip:9200”],“Accept”:[“/”]},“audit_request_effective_user”:“user1”,“audit_node_host_name”:“ip”}
[2023-04-10T18:19:51,182][ERROR][audit ] [opensearch-75f75866b4-5wkm5] {“audit_cluster_name”:“pratiksha-testifd”,“audit_rest_request_params”:{“v”:“”},“audit_node_name”:“opensearch-client-75f75866b4-5wkm5”,“audit_rest_request_method”:“GET”,“audit_category”:“FAILED_LOGIN”,“audit_request_origin”:“REST”,“audit_node_id”:“HU0PL4bMSIi1DC5vyUi2wA”,“audit_request_layer”:“REST”,“audit_rest_request_path”:“/_cat/indices”,“@timestamp”:“2023-04-10T18:19:51.177+00:00”,“audit_request_effective_user_is_admin”:false,“audit_format_version”:4,“audit_request_remote_address”:“ip”,“audit_node_host_address”:“ip”,“audit_rest_request_headers”:{“User-Agent”:[“curl/7.29.0”],“content-length”:[“0”],“Host”:[“ip:9200”],“Accept”:[“/”]},“audit_request_effective_user”:“user1”,“audit_node_host_name”:“ip”}

2

Hey @Pratiksha

Not sure about all your configuration made in the opensearch.yml file, but here is some key configuration points you may need to look for.

Next

# Ignore users, e.g. do not log audit requests from that users (default: no ignored users)
#plugins.security.audit.ignore_users: ['kibanaserver','some*user','/also.*regex possible/']"

# Destination of the auditlog events
plugins.security.audit.type: internal_opensearch
#plugins.security.audit.type: external_opensearch
#plugins.security.audit.type: debug
#plugins.security.audit.type: webhook

Just an Idea

3

Hi @Gsmitt
Yes, I have added all other config also in opensearch.yml and I shared only the config which I added for audit logging to use log4j as the option.

4

Hey,

Out of curiosity where did you see that configuration for log4j option, Im unaware of that since the sample above does not show this.

5

Audit log storage types - OpenSearch documentation I have referred it from the documentation.

6

Sorry I missed it, at the bottom.