oz0 audit export
For: Operators and developers looking up a command.
Export one hash chain of the audit log as JSON lines: a tenant's with --tenant, the cluster's own without. Each line carries the entry, its place in the chain and its hashes, and the last line is the chain's head, so audit verify --file checks an export without the cluster.
Without the content permission, each entry's private part (what a job read or wrote) is left out and its hash kept, and the digests in its detail are keyed for this one export, so they cannot confirm a guess of what they cover: equal digests stay equal within the export. Such an entry is marked blinded and has no salt, which would confirm a guess too.
Every export's head is signed with the audit key, which stands in for what such an entry's hashes would show and says whose the export is. The export is recorded in the chain (audit.export).
With --follow the command keeps running and writes new entries as they come, each batch followed by a head line, for a SIEM to read; the session is recorded once (audit.follow), not at every poll.
Usage
oz0 audit export [flags]
Flags
| Flag | Type | Default | Description |
|---|---|---|---|
--after | int | only entries after this seq, such as the last one of an earlier export | |
--cluster | bool | export the cluster's own chain | |
--follow | bool | keep running and write new entries as they are recorded | |
--output (-o) | string | write to this file instead of stdout | |
--since | string | only entries recorded at or after this time (RFC 3339) | |
--tenant | string | the cluster's own, for cluster admins | export this tenant's chain |
--until | string | only entries recorded before this time (RFC 3339) |
Inherited flags
| Flag | Type | Default | Description |
|---|---|---|---|
--context | string | $OZ0_CONTEXT or <config dir>/orchestrator-zero/context.json | CLI context file written by server init |
--log-level | string | info | log level: debug, info, warn or error |
See all oz0 commands and the global flags.