Audit logging configuration only uses presets no manual configuration is possible
Issue
- Excessive (many gigabytes) of data is being forwarded to Splunk
- Splunk storage has become unmanageable
- Only 3 presets are provided in the documentation
Environment
- Red Hat Openshift Container Platform (OCP) 4
- Using Log forwarding to send logs to an external service like Splunk
- Audit logging stack set to default mode or least amount of logging
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.
