How to extract user events from OpenShift audit logs using the API Audit filter
Issue
How to use KubeAPIAudit filter to capture only specific user-related actions from audit logs, such as:
- user logins
- user logouts
- unsuccessful login attempts
- any other actions performed by users in the cluster
Environment
- Red Hat OpenShift Container Platform (RHOCP)
- 4
- Red Hat OpenShift Logging (RHOL)
- 5.8+
- 6
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.
