Audit Trail¶
The API audit records which API client changed what through the REST API, and which attempts a known client was refused, so you can trace every recorded change to a named caller.
How it works¶
Every recorded call is attributed to the API client that made it. Under Local only authorization, calls from the MetaMiner Server (MMS) machine are attributed to local. Where the record is kept depends on the Flow Scheduler:
| Flow Scheduler | Where the audit is kept | How to read it |
|---|---|---|
| Switched on | A table in the shared Flow Scheduler database; one audit for both nodes of a high-availability pair | MetaMiner Administrator (MMA) Audit Log..., or GET /fss/v1/audit |
| Switched off | One line per recorded call in the MMS log (server\logs\server.log) |
Search the log for the text API audit: |
Each record holds:
| Field (API) | Column in MMA | Meaning |
|---|---|---|
at |
When | Time of the call |
client |
Client | Name of the API client |
method |
Method | HTTP method |
endpoint |
Endpoint | The endpoint called |
objectType, objectId |
Object | The task, chain, schedule, client or other object concerned |
envId |
Environment | The environment concerned |
status |
Status | HTTP status of the answer |
remote |
From | Source address of the TCP connection |
With the Flow Scheduler switched off, the log line reads API audit: <method> <endpoint> <object> by <client> from <address> -> <status>.
What is recorded¶
| Recorded | Examples |
|---|---|
Changes through /fss/v1 |
Creating, changing and deleting tasks, chains, schedules, parameters and notifications |
| Runs and cancellations | Run a task, run a flow, cancel a run |
| Client management | Create, change, rotate and revoke API clients, including me/rotate and the deprecated /apitoken/rotate |
| Tableau credential changes | A successful POST /tab/credentials, and a change applied but not saved |
| Refused attempts by a known client | 403 answers to writes, runs, credential changes and backup requests |
| Changes made in MMA (Flow Scheduler switched on) | Client MetaMiner Admin (<Windows user>), endpoint MetaMiner Admin: create, change, rotate or revoke, from 127.0.0.1 |
What is not in the audit¶
| Not recorded | Where to look instead |
|---|---|
Reads (GET calls) |
Not recorded anywhere |
Calls refused with 401 or 503 (no client is known) |
The MMS log |
/tab/credentials calls answered 400 or 404 |
The MMS log |
Successful /fss/backup runs |
The MMS log and the backup history (see Flow Scheduler Backup API) |
The MMS log always records the caller's address for /tab/credentials calls. Refused calls are logged with the caller's address and the reason. Search for:
rejected unauthorizedfor a401(missing, unknown, expired or revoked token);the API clients cannot be checkedfor a503;loopback callers onlyfor a remote call refused under Local only.
Tokens are never written to the audit or the log. Client changes are logged by client name.
Read the audit¶
In MMA, choose Preferences > Settings..., open Advanced, click Manage API Clients... and then Audit Log.... The API Audit Log window lists the records.
Over the API, an admin client without environment or site limits calls GET /fss/v1/audit, optionally filtered by client; records come newest first. Parameters, answer format and examples are in the Clients and Audit API. With the Flow Scheduler switched off the answer is an empty list; read the MMS log instead.
Behind a load balancer
remote is the address of the TCP connection, so behind a load balancer it is the balancer's address. Give each caller its own client: the client name then identifies it.