-
Notifications
You must be signed in to change notification settings - Fork 24.5k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Audit trail filtering rules cannot be deleted in the usual way other cluster settings are removed. #68588
Comments
Pinging @elastic/es-security (Team:Security) |
Thanks for reporting this issue. It could be hard to explain, but this behaviour is somewhat intended/expected, but also flawed. A ignore policy is comprised of 4 rules,
Because one can configure only one rule of a policy and expect it to work, e.g.:
The above configuration means that as long as the user is
This makes the ignore policy to only look at the username, as long as it is With above being said, there is an issue when a policy only has a single rule, e.g.
When it is set to the
It makes the whole policy match everything. This is technically correct. However, it no longer shows up in the response of
This is something we can improve, by either automatically remove the policy once all rules are |
I think the behaviour is explainable, but I would argue quite strongly that it is not correct (technically or otherwise). Once there are no more settings for a filter policy the policy does not exist anymore (in the settings) and should not be applied. |
I agree we should fix the behavior, since I don't think it is intentional and it is very counterintuitive and hard to debug from a user perspective. |
+1 Given that the recommended and commonly used way to reset Elasticsearch settings is to set them to null, it's easy for users to inadvertently break audit logging completely (and silently) simply by settings an ignore policy to null. Restarting all nodes in the cluster is a heavy workaround esp. for clusters with large amounts of nodes/data that can take many hours to recover. For those encountering this issue, you will see the following log entry on the nodes indicating that you have set the ignore filter policy to match
|
Ignore filters of audit logging can be configured with the cluster settings APIs. While adding new filters work correclty, removing filters does not work until node restart due to a bug (elastic#68588). This PR fixes the bug by correctly remove the ignore filter when all rules of a filtering policy is set to null. Resolves: elastic#68588
Ignore filters of audit logging can be configured with the cluster settings APIs. While adding new filters work correclty, removing filters does not work until node restart due to a bug (#68588). This PR fixes the bug by correctly remove the ignore filter when all rules of a filtering policy is set to null. Resolves: #68588
Ignore filters of audit logging can be configured with the cluster settings APIs. While adding new filters work correclty, removing filters does not work until node restart due to a bug (elastic#68588). This PR fixes the bug by correctly remove the ignore filter when all rules of a filtering policy is set to null. Resolves: elastic#68588 (cherry picked from commit 06b4900)
Ignore filters of audit logging can be configured with the cluster settings APIs. While adding new filters work correclty, removing filters does not work until node restart due to a bug (elastic#68588). This PR fixes the bug by correctly remove the ignore filter when all rules of a filtering policy is set to null. Resolves: elastic#68588 (cherry picked from commit 06b4900)
Ignore filters of audit logging can be configured with the cluster settings APIs. While adding new filters work correclty, removing filters does not work until node restart due to a bug (elastic#68588). This PR fixes the bug by correctly remove the ignore filter when all rules of a filtering policy is set to null. Resolves: elastic#68588 (cherry picked from commit 06b4900) # Conflicts: # x-pack/plugin/security/src/test/java/org/elasticsearch/xpack/security/audit/logfile/LoggingAuditTrailFilterTests.java
) * Support removing ignore filters for audit logging (#87675) Ignore filters of audit logging can be configured with the cluster settings APIs. While adding new filters work correclty, removing filters does not work until node restart due to a bug (#68588). This PR fixes the bug by correctly remove the ignore filter when all rules of a filtering policy is set to null. Resolves: #68588 (cherry picked from commit 06b4900) * fix
Ignore filters of audit logging can be configured with the cluster settings APIs. While adding new filters work correclty, removing filters does not work until node restart due to a bug (#68588). This PR fixes the bug by correctly remove the ignore filter when all rules of a filtering policy is set to null. Resolves: #68588 (cherry picked from commit 06b4900)
…7947) * Support removing ignore filters for audit logging (#87675) Ignore filters of audit logging can be configured with the cluster settings APIs. While adding new filters work correclty, removing filters does not work until node restart due to a bug (#68588). This PR fixes the bug by correctly remove the ignore filter when all rules of a filtering policy is set to null. Resolves: #68588 (cherry picked from commit 06b4900) # Conflicts: # x-pack/plugin/security/src/test/java/org/elasticsearch/xpack/security/audit/logfile/LoggingAuditTrailFilterTests.java * fix
A user reported an issue where they wanted to delete an existing audit filter rule by changing the cluster setting to null (the usual way cluster settings are effectively removed).
Unfortunately the net effect was to create a rule that filtered all audit log entries.
I reproduced this by adding this test to LoggingAuditTrailFilterTests
The text was updated successfully, but these errors were encountered: