-
Notifications
You must be signed in to change notification settings - Fork 16
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[GoogleStackDriver] Buffer portion of GCP log not being decoded for AuditLog type #365
[GoogleStackDriver] Buffer portion of GCP log not being decoded for AuditLog type #365
Conversation
CI Service Job Number 970 Logs - SUCCESS
Stages Run:
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Looks good
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
thanks Imran, this looks good; please see my comment about maybe refactoring the protbuf decoding logic out of the pawsGetLogs()
method and let me know what you think
47e6659
to
8af4128
Compare
CI Service Job Number 971 Logs - SUCCESS
Stages Run:
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
sorry for nitpicking but pls make the audit log decoder a component of the collector itself
8af4128
to
8cbdf87
Compare
CI Service Job Number 972 Logs - SUCCESS
Stages Run:
|
8cbdf87
to
fcf3841
Compare
CI Service Job Number 973 Logs - SUCCESS
Stages Run:
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
super; thank you, Imran! 🙇
Problem Description
[GoogleStackDriver] Buffer portion of GCP log not being decoded for AuditLog type
Solution Description
As per google cloud (GCPLogEntry | Cloud Logging | Google Cloud )
documentation the following two logs have type
"type.googleapis.com/google.cloud.audit.AuditLog"
send protoPayload as buffer
we noticed for other customers as well when type of log as Audit “type.googleapis.com/google.cloud.audit.AuditLog" protoPayload coming as buffer.
we see all logs coming as type of log as Audit “type.googleapis.com/google.cloud.audit.AuditLog" logs in search console for this customer, if we can get other log types for example “type.googleapis.com/google.cloud.loadbalancing.type.LoadBalancerLogEntry” you will get to see in json format.
Note used: google-proto-files package to decode protobuf to json format for Audit log type only http://type.googleapis.com/google.cloud.audit.AuditLog).