Logging&Audit

• 1: Overview
• 2: How-to guides
• 2.1: Trail management
• 3: API Reference
• 4: CLI Reference
• 5: Release Note

1 - Overview

Service Overview

Logging&Audit stores a record of all actions performed by users, enabling change tracking of cloud resources, troubleshooting, security audits, and more. Collected operation logs can be viewed for 90 days, and can be stored in the user’s Object Storage through Trail creation and management.

Provided Features

Logging&Audit provides the following features.

• Task History Log Collection: All generated logs are collected and stored in real time. * For the entire logs collected from multiple servers and services, you can search using various criteria such as resource type, resource name, time period, and operator name through the web-based console.
• Activity Log Audit: All recorded activity details are retained for 90 days and can be reviewed at any time through the Console.
• Log Management: The numerous logs generated while using cloud services can be stored in the user’s Object Storage by creating a Trail.
• Log Integrity Verification: After creating a Trail, you can confirm through the log file verification feature whether the log files stored in Object Storage have been changed, modified, or deleted.
• ServiceWatch Log Collection: When creating a Trail, using ServiceWatch Log Collection allows you to link Logging&Audit logs to a ServiceWatch log group for monitoring. * If needed, you can set ServiceWatch log patterns to receive notifications when specific logs occur through an alert policy.

Components

Activity History

All user activity logs are stored, enabling tracking of changes to cloud resources, troubleshooting, security audits, and related purposes. It stores activity logs for 90 days without any additional configuration, and you can analyze logs using various search functions, enabling effective log management.

Trail

Trail can store user activity logs generated through the Console and API calls in Object Storage for long-term retention. Additionally, you can select the services and accounts you wish to save and use them for change tracking, troubleshooting, security checks, and other purposes related to cloud resources.

Preceding Service

This is a list of services that must be pre-configured before creating the service. Please refer to the guide provided for each service and prepare in advance.

2 - How-to guides

Users can view activity logs through the Samsung Cloud Platform Console and store those logs using the Trail service without any time constraints. When issues such as security risks or resource changes occur, they can review the activity logs to determine the cause.

View Activity History

To view the list of a user’s activity history, follow these steps.

1. Click the All Services > Management > Logging&Audit menu. Go to the Service Home page of Logging&Audit.
2. On the Service Home page, click the Activity History menu. You will be taken to the Activity History List page.
3. Activity History List page, view the activity history.

   Category	Detailed description
   File download	Save the activity log list in JSON or CSV file format
   Period filter	Select list search period All, Last 30 minutes, Last 1 hour, Last 12 hours, Custom input Select from Custom input: start and end date-times can be entered
   time zone	Select searchable time range
   Search input field	Enter a keyword to search the list
   Advanced Search	Enter a keyword or select information by category to search the list.
   Settings icon	Configure columns to display in the list

   Table. Activity log list items

Activity History Comparison

You can select up to five task histories from the activity log list to compare information.
If you check and select the work history you want to compare, it will be added to the Activity History Comparison page, where you can compare and review the information.

View detailed activity history information

You can view the list of all activity logs and detailed information. On the Activity Log Details page, it consists of Work History Details, Work Log Details tabs.

To view detailed information of the activity log, follow these steps.

1. Click the All Services > Management > Logging&Audit menu. Then navigate to the Service Home page of Logging&Audit.
2. On the Service Home page, click the Activity History menu. It navigates to the Activity History List page.
3. Activity Log List page, click the activity entry you want to view details for. You will be taken to the Activity Log Details page.
   • Activity Details page consists of Work History Details, Work Details tabs.

Task History Details

On the Work History Detail page, you can view detailed information about the work history.

Task Details

Work History Details page lets you view detailed information of the work history.

2.1 - Trail management

Users can view activity logs through the Samsung Cloud Platform Console and store those logs using the Trail service without any time constraints. Activity logs are retained for 90 days, so for long-term retention you must create a Trail service and store them in Object Storage.

Create Trail

In the Samsung Cloud Platform Console, you can use the Logging&Audit Trail service to store activity logs without any time restrictions.

To create a Trail, follow these steps.

1. Click the All Services > Management > Logging&Audit menu. 1. Navigate to the Service Home page of Logging&Audit.
2. On the Service Home page, click the Trail menu. 2. Navigate to the Trail List page.
3. Trail List page, click the Create Trail button. 3. Go to the Create Trail page.
   • Enter or select the required information in the Service Information Input area.

     Category	required status	Detailed description
     Trail name	Required	Trail name Enter using English letters, numbers, and the special character (-) with 5 to 26 characters
     Target region	Required	Region where activity occurred Services that are created without specifying a region select the target region as All If a specific region selection is required, select from the region list The target region can be changed after creation
     Target resource type	Required	Resource type of activity logs to be stored in the Trail Default: All If you want to change to specify only certain resource types, click the Select button to choose the resource types to store Refer to the List of resource types by service for selectable resource types The target resource type can be changed after creation
     Target user	Required	User of activity logs to be stored in Trail Default: All If you want to change to specify only certain users, click the Select button to choose the users to store The target users can be modified after creation
     Storage bucket region	Required	Location (region) of the Object Storage bucket for storing activity logs The storage bucket cannot be changed after creation
     storage bucket	Required	Object Stroage bucket name for storing activity logs The storage bucket cannot be changed after creation
     Save format	Required	File type to save (JSON, CSV) The save format can be changed after creation
     Log file verification	Selection	로그파일 검증 사용 여부 If 사용 is selected, a Digest file is stored in the same bucket to verify changes and deletions of the Trail log file The log file verification setting can be changed after creation
     ServiceWatch log collection	Selection	Send Trail logs to a ServiceWatch log group. By sending Trail logs to a ServiceWatch log group, you can monitor them via ServiceWatch and receive alerts when specific activities occur Use to select, you can view the automatically generated ServiceWatch log group name. You can also select the IAM role required for ServiceWatch log collection The IAM role for ServiceWatch log collection requires the following configuration Set the Principal’s Type to Service, and select loggingaudit.samsungsdscloud.com for Value Attach a policy with the following permissions to the Policy servicewatch:CreateBulkServiceLogEvents servicewatch:CollectLogGroupLogStream For more details, see Setting up IAM role for ServiceWatch log collection. Enabling or disabling ServiceWatch log collection can be changed after creating the Trail

     Table. Trail service information entry fields
   • In the Additional Information Input area, enter or select the required information.

     Category	required status	Detailed description
     Explanation	Selection	Enter additional information or description about the Trail.
     tag	Selection	Add Tag Up to 50 per resource can be added After clicking the Add Tag button, input or select Key, Value values

     Table. Trail additional information input fields

4. Summary Check the detailed information and estimated charges generated in the panel, and click the Complete button.
   • Once creation is complete, check the created resources on the Trail List page.

View Trail detailed information

The Trail service allows you to view the full list and detailed information, and edit them. The Trail Details page includes the Detail Information, Tags, Work History tabs.

To view detailed Trail information, follow these steps.

1. Click the All Services > Management > Logging&Audit menu. 1. Go to the Service Home page of Logging&Audit.
2. On the Service Home page, click the Trail menu. 2. Go to the Trail List page.
3. On the Trail List page, click the resource to view detailed information. 3. Navigate to the Trail Details page.
   • Trail Details page displays status information and additional feature information, and consists of Details, Tags, Activity History tabs.

     Category	Detailed description
     Trail status	Status of the Trail created by the user Active: Trail is running Stopped: Trail stopped
     Trail Control	Button to change the Trail status Start: Starts a stopped Trail. Activity logs are saved again from the day the Trail is started. Stop: Stops a running Trail. Activity logging is halted, and previously saved activity logs are retained.
     Delete Trail	Button to delete the trail

     Table. Trail status information and additional features

Detailed Information

On the Trail List page, you can view detailed information of the selected resource and edit the information if needed.

Tag

On the Trail list page, you can view the tag information of the selected resource and add, modify, or delete it.

Job History

Trail List page lets you view the operation history of the selected resource.

Controlling Trail Resources

You can start or stop depending on the Trail’s state. To manage Trail’s resources, follow these steps.

Getting Started with Trail

You can start a Trail that is stopped (Stopped). Activity logs from the day you started the Trail will be saved again.

1. Click the All Services > Management > Logging&Audit menu. 1. Navigate to the Service Home page of Logging&Audit.
2. On the Service Home page, click the Trail menu. 2. Navigate to the Trail List page.
3. On the Trail List page, click the resource (Trail) to restart the stopped Trail. 3. Navigate to the Trail Details page.
4. On the Trail Details page, click the Start button at the top to start the server. 4. Check the status of the changed Trail in the Status Indicator field.
   • When the trail start is complete, the status changes from Stopped to Active.
   • For detailed information about the Trail status, please refer to View Trail detailed information.

Stop Trail

You can stop a Trail that is operating (Active). Stop recording activity history in Trail, and the previously saved activity history will be retained.

1. Click the All Services > Management > Logging&Audit menu. 1. Go to the Service Home page of Logging&Audit.
2. On the Service Home page, click the Trail menu. 2. Go to the Trail List page.
3. On the Trail List page, click the resource (Trail) you want to stop. 3. Navigate to the Trail Details page.
4. On the Trail Details page, click the Stop button at the top to stop the server. 4. Check the status of the modified Trail in the Status Indicator item.
   • When the Trail stop is complete, the status changes from Active to Stopped.
   • For detailed information about the Trail status, please refer to View Trail detailed information.

Managing Trail Resources

If you need control and management functions for the created Trail resource, you can perform actions on the Trail Details page.

Modify target region

You can modify the target region of the Trail. To modify the target region of a Trail, follow these steps.

1. All Services > Management > Logging&Audit menu, click it. 1. Go to the Service Home page of Logging&Audit.
2. On the Service Home page, click the Trail menu. 2. Go to the Trail List page.
3. Trail List page, click the resource (Trail) for which you want to change the target region. 3. Navigate to the Trail Details page.
4. On the Trail Details page, click the Edit button for the Target Region. 4. Edit Target Region Navigate to the popup window.
5. Select the region to modify from the region list, and click the Confirm button. 5. Go to the Trail Details page.
6. Check the changed Target Region on the Trail Details page.

Edit target resource type

You can modify the target resource type of the Trail. To modify the target resource type of a Trail, follow these steps.

1. Click the All Services > Management > Logging&Audit menu. 1. Go to the Service Home page of Logging&Audit.
2. On the Service Home page, click the Trail menu. 2. Trail List Navigate to the page.
3. On the Trail List page, click the resource (Trail) whose target resource type you want to change. 3. Trail Details page is opened.
4. On the Trail Details page, click the Edit button of the Target Resource Type. 4. Target Resource Type Edit Navigate to the popup window.
5. Add or modify the target resource type, select it, and verify that the selected resource type appears in the Selection at the bottom.
   • For selectable resource types, refer to the List of resource types by service.
6. If you have completed adding or modifying the target resource type, click the Confirm button. 6. Trail Details navigate to the page.
7. Check the changed target resource type on the Trail Details page.

Edit target user

You can modify the target users of the Trail. To modify the target users of Trail, follow these steps.

1. All Services > Management > Logging&Audit menu, click it. 1. Go to the Service Home page of Logging&Audit.
2. On the Service Home page, click the Trail menu. 2. Go to the Trail List page.
3. On the Trail List page, click the resource (Trail) whose target user you want to change. 3. Navigate to the Trail Details page.
4. On the Trail Details page, click the Edit button of the Target User. 4. Edit Target User the popup window opens.
5. Add or modify the target user, select them, and verify that the selected user appears in the Selection Items at the bottom.
6. If you have completed adding or modifying the target user, click the Confirm button. 6. Navigate to the Trail Details page.
7. Check the changed Target Users on the Trail Details page.

Modify storage format

You can modify the log file format stored in the Trail bucket. To modify Trail’s storage format, follow these steps.

1. Click the All Services > Management > Logging&Audit menu. 1. Navigate to the Service Home page of Logging&Audit.
2. On the Service Home page, click the Trail menu. 2. Go to the Trail List page.
3. On the Trail List page, click the resource (Trail) whose log file storage format you want to change. 3. Navigate to the Trail Details page.
4. On the Trail Detail page, click the Edit button of Save Format. 4. Edit Save Format A popup window opens.
5. Change the file format and click the Confirm button. 5. Go to the Trail Details page.
6. Check the changed Save Format on the Trail Details page.

Edit Trail description

You can edit the description of the Trail. To modify the description of Trail, follow these steps.

1. Click the All Services > Management > Logging&Audit menu. 1. Go to the Service Home page of Logging&Audit.
2. On the Service Home page, click the Trail menu. 2. Go to the Trail List page.
3. On the Trail List page, click the resource (Trail) whose description you want to edit. 3. Navigate to the Trail Details page.
4. On the Trail Details page, click the Edit button of the Description. 4. Edit description The popup window opens.
5. After completing the description edit, click the Confirm button. 5. Navigate to the Trail Details page.
6. Check the changed description on the Trail Details page.

Modify log file verification

You can modify whether Trail’s log file verification is enabled. To change the setting for using Trail’s log file verification, follow these steps.

1. All Services > Management > Logging&Audit menu, click. 1. Go to the Service Home page of Logging&Audit.
2. On the Service Home page, click the Trail menu. 2. Navigate to the Trail List page.
3. On the Trail List page, click the resource (Trail) for which you want to change the log file verification setting. 3. Go to the Trail Details page.
4. On the Trail Details page, click the Edit button of Log File Verification. 4. Log File Verification Fix Navigate to the popup window.
5. If you select Use, a Digest file is stored in the same bucket to verify whether the Trail log file has been modified or deleted. 5. Select whether to use it, and click the Confirm button. 5. Navigate to the Trail Details page.
6. Check the changed Log File Verification on the Trail Details page.

Modify ServiceWatch log collection

You can modify whether ServiceWatch log collection is enabled. To modify whether Trail’s ServiceWatch log collection is enabled, follow these steps.

1. Click the All Services > Management > Logging&Audit menu. 1. Go to the Service Home page of Logging&Audit.
2. On the Service Home page, click the Trail menu. 2. Go to the Trail List page.
3. Trail List page, click the resource (Trail) whose ServiceWatch log collection setting you want to change. 3. Navigate to the Trail Details page.
4. On the Trail Details page, click the Edit button of ServiceWatch log collection. 4. ServiceWatch Log Collection Edit Navigate to the popup window.
5. If you select Use, the ServiceWatch log group name that will receive the Trail logs is automatically generated and can be viewed. 5. Also, select the IAM role required for ServiceWatch log collection, and click the Confirm button. 5. Navigate to the Trail Details page.
   • Select Service for the Category of Executor, and select loggingaudit.samsungsdscloud.com for Value.
   • Connect a policy configured with the following Permissions to the Policy.
     • servicewatch:CreateBulkServiceLogEvents
     • servicewatch:CollectLogGroupLogStream
   • For more details, please refer to Setting up IAM role for ServiceWatch log collection.
6. Check the changed ServiceWatch log collection on the Trail Details page.

Setting up IAM role for ServiceWatch log collection

• The IAM role for ServiceWatch log collection requires the following settings.
  • Select Service for the Category of Executor, and choose loggingaudit.samsungsdscloud.com for Value.
  • Policy is connected to a policy set configured with the following permissions.

    • servicewatch:CreateBulkServiceLogEvents

    • servicewatch:CollectLogGroupLogStream

    • If you want to create the authentication type as all authentication, write it as follows.

      • Tab 0

      Sample Code Download

      Copy Code

      Color mode

      {
      	"Statement": [
      		{
      			"Action": [
      				servicewatch:CreateBulkServiceLogEvents
      				servicewatch:CollectLogGroupLogStream
      			],
      			"Effect": "Allow"
      			"Resource": [
      				*
      			],
      			"Sid": "VisualEditor0"
      		}
      	],
      	"Version": "2024-07-01"
      }

      {
      	"Statement": [
      		{
      			"Action": [
      				servicewatch:CreateBulkServiceLogEvents
      				servicewatch:CollectLogGroupLogStream
      			],
      			"Effect": "Allow"
      			"Resource": [
      				*
      			],
      			"Sid": "VisualEditor0"
      		}
      	],
      	"Version": "2024-07-01"
      }

    • If you want to create the Authentication type as temporary key authentication, Console login, you need a Condition clause as shown below.

      • Tab 0

      Sample Code Download

      Copy Code

      Color mode

      {
      	"Statement": [
      		{
      			"Action": [
      				servicewatch:CreateBulkServiceLogEvents
      				servicewatch:CollectLogGroupLogStream
      			],
      			"Effect": "Allow"
      			"Resource": [
      				*
      			],
      			"Sid": "VisualEditor0"
                  "Condition": {
                      "Bool": {
                              "scp:MultiFactorAuthPresent": [
                                  "True"
                          ]
                      }
                  }
      		}
      	],
          "Version": "2024-07-01"
      }

      {
      	"Statement": [
      		{
      			"Action": [
      				servicewatch:CreateBulkServiceLogEvents
      				servicewatch:CollectLogGroupLogStream
      			],
      			"Effect": "Allow"
      			"Resource": [
      				*
      			],
      			"Sid": "VisualEditor0"
                  "Condition": {
                      "Bool": {
                              "scp:MultiFactorAuthPresent": [
                                  "True"
                          ]
                      }
                  }
      		}
      	],
          "Version": "2024-07-01"
      }

Delete Trail

You can reduce operational costs by deleting an unused Trail. However, deleting the Trail may cause the running service to stop immediately, so you should proceed with the termination only after fully considering the impact of service interruption.

To delete a trail, follow these steps.

1. Click the All Services > Management > Logging&Audit menu. 1. Go to the Service Home page of Logging&Audit.
2. On the Service Home page, click the Trail menu. 2. Navigate to the Trail List page.
3. On the Trail List page, click the resource (Trail) you want to delete. 3. Navigate to the Trail Details page.
4. On the Trail Detail page, click the Trail Delete button.
5. Once deletion is complete, check on the Trail List page whether the resource has been deleted.

List of resource types by service

List of resource types by service. When modifying Trail creation and target resource type, this is the list of selectable target resource types.

3 - API Reference

4 - CLI Reference

5 - Release Note

Logging&Audit