Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

  • User Login
  • User Logout
  • Farm Launch
  • Farm Terminate
  • Farm Ownership Change
  • Script Execute
  • Server Launch
  • Server Terminate
  • Server Suspend
  • Server Resume
  • Cloud Resource Remove

Common attributes

The following attributes are always included in all Audit Log events:

...

Code Block
languagejs
{    
    # common tags are here
    ...
    # Event specific (for farm.terminate only)
    "farm.terminate.farm_id": 1, # Identifier of the Farm which is terminated
    "farm.terminate.farm_name": "My farm", # The name of the Farm which is terminated
    "farm.terminate.owner.user_id": 13, # Identifier of the owner of the Farm
    "farm.terminate.owner.user_email" : "user@scalr.com", # The email address of the owner of the Farm
    "farm.terminate.owner.teams": [2,5], # Identifiers of the Teams by which the Farm is owned
    "service.scheduler.task_id": 139034 # Optional tag which is applied only when crontab is the actor that triggers event
    "tags": ["audit", "farm.terminate"]
}

...

Farm Ownership_change

Code Block
languagejs
script.executefarm.ownership_change {
    # common tags are here
    ...
    # Event specific (for farm.ownership only)
    "scriptfarm.execute.script.ownership_change.farm_id": 1231, # Identifier of the Script being executedFarm which has ownership changes
    "script.execute.scriptfarm.ownership_change.name": "GetMy variablesfarm", # The name of the ScriptFarm
    "script.execute.script.versionfarm.ownership_change.new.owner.id": 2, # Identifier Scriptof versionthe thatnew/current isowner usedof tothe executeFarm
    "service.scheduler.task_idfarm.ownership_change.new.owner.email": 139003"owner2@scalr.com", # OptionalThe tagemail whichaddress isof appliedthe onlynew/current whenowner crontabof is the actor that triggers eventFarm
    "script.execute.executed_byfarm.ownership_change.new.owner.teams": "event"[4], # WhoThe has triggered execution of the script. (event | user | scheduler)list of the Team IDs which the Farm is currently owned by. It can be NULL if there are no Team owner.
    "script.execute.event.namefarm.ownership_change.prev.owner.id": "BeforeHostUp"1, # Optional. The name Identifier of the eventprevious if the Script was triggered by the Event.owner of the Farm
    "script.execute.event.triggered_byfarm.ownership_change.prev.owner.email": "2f929baa-4c81-43cb-a280-7c514012bf26owner1@scalr.com", # IdentifierThe email address of the Scalrprevious serverowner thatof caused this eventthe Farm
    "farm.ownership_change.prev.owner.teams": null, # The list of the Team IDs which the Farm is previously owned by. It can be NULL if there are no Team owner.
    "tags": ["audit", "farm.ownership_change"]
}

Script Execute

Code Block
languagejs
script.execute {    # common tags are here
    ...
    # Event specific
    "script.execute.script.id": 123, # Identifier of the Script being executed
    "script.execute.script.name": "Get variables", # The name of the Script
    "script.execute.script.version": 2, # Script version that is used to execute
    "service.scheduler.task_id": 139003, # Optional tag which is applied only when crontab is the actor that triggers event
    "script.execute.executed_by": "event" # Who has triggered execution of the script. (event | user | scheduler)
    "script.execute.event.name": "BeforeHostUp", # Optional. The name of the event if the Script was triggered by the Event.
    "script.execute.event.triggered_by": "2f929baa-4c81-43cb-a280-7c514012bf26", # Identifier of the Scalr server that caused this event 
    "script.execute.target.account_id": 1, # Identifier of the Account the target Server corresponds to
    "script.execute.target.env_id": 1, # Identifier of the Environment the target Server corresponds to
    "script.execute.target.farm_id": 13003, # Identifier of the Farm the target Server corresponds to
    "script.execute.target.farm_role_id": 133883, # Identifier of the Farm Role the target Server corresponds to
    "script.execute.target.server_id": "64bf1356-b8fb-4A6f-ad89-2416d1c67855", # Identifier of the Server the script executed on
    "script.execute.script.path": "path to script", # Optional tag which indicates which local script run.
    "tags": ["audit", "script.execute"]
}

Server Launch

Code Block
server.launch {
    # common tags are here
    ...
    # Event specific
    "server.launch.server_id": "2f928baa-4c81-43cb-a280-7c514012bf26", # Identifier of the Server being launched
    "server.launch.farm.id": 12000, # Identifier of the Farm that the Server belongs to
    "server.launch.farm_role.id": 130000, # Identifier of the Farm Role that the Server belongs to
    "server.launch.platform": "ec2", # The platform name where the Server is located
    "server.launch.type": "m1.small", # The name of the instance type of the Server
    "server.launch.cloud_location": "us-east-1", # The region where the Server is located
    "server.launch.os.id": "centos-6-x", # The Identifier of the Os that corresponds to the Server
    "server.launch.environment.id": 1234, # Identifier of the Environment that the Server belongs to
    "server.launch.account.id": 123, # Identifier of the Account that the Server belongs to
    "server.launch.reason.code": 2, # The reason code that caused the Server to be launched
    "server.launch.reason.text": "Scaling up", # The verbose message of the launch reason
    "tags": ["audit", "server.launch"]
}


Server Terminate

Code Block
server.terminate {
    # common tags are here
    ...
    # Event specific
    "server.terminate.server_id": "2f928baa-4c81-43cb-a280-7c514012bf26", # Identifier of the Server being terminated
    "server.terminate.farm.id": 12000, # Identifier of the Farm that the Server belongs to
    "server.terminate.farm_role.id": 130000, # Identifier of the Farm Role that the Server belongs to
    "server.terminate.platform": "ec2", # The platform name where the Server is located
    "server.terminate.type": "m1.small", # The name of the instance type of the Server
    "server.terminate.cloud_location": "us-east-1", # The region where the Server is located
    "server.terminate.cloud_location_zone": "us-east-1a", # Optional tag which is applied only for Ec2 and GCE platforms
    "server.terminate.os.id": "centos-6-x", # The Identifier of the Os that corresponds to the Server
    "server.terminate.public_ip": "54.151.25.74", # The remote Ip Address of the Server
    "server.terminate.private_ip": "10.196.75.30", # The local Ip Address of the Server
    "server.terminate.environment.id": 1234, # Identifier of the Environment that the Server belongs to
    "server.terminate.account.id": 123, # Identifier of the Account that the Server belongs to
    "server.terminate.reason.code": 4, # The reason code that caused the Server to be terminated
    "server.terminate.reason.text": "Role removed from farm.", # The verbose message of the terminate reason
    "tags": ["audit", "server.terminate"]
}


Server Suspend

Code Block
server.suspend {
    # common tags are here
    ...
    # Event specific
    "server.suspend.server_id": "2f928baa-4c81-43cb-a280-7c514012bf26", # Identifier of the Server being suspended
    "server.suspend.farm.id": 12000, # Identifier of the Farm that the Server belongs to
    "server.suspend.farm_role.id": 130000, # Identifier of the Farm Role that the Server belongs to
    "server.suspend.platform": "ec2", # The platform name where the Server is located
    "server.suspend.type": "m1.small", # The name of the instance type of the Server
    "server.suspend.cloud_location": "us-east-1", # The region where the Server is located
    "server.suspend.cloud_location_zone": "us-east-1a", # Optional tag which is applied only for Ec2 and GCE platforms
    "server.suspend.os.id": "centos-6-x", # The Identifier of the Os that corresponds to the Server
    "server.suspend.public_ip": "54.151.25.74", # The remote Ip Address of the Server
    "server.suspend.private_ip": "10.196.75.30", # The local Ip Address of the Server
    "server.suspend.environment.id": 1234, # Identifier of the Environment that the Server belongs to
    "server.suspend.account.id": 123, # Identifier of the Account that the Server belongs to
    "tags": ["audit", "server.suspend"]
}


Server Resume

Code Block
server.resume {
    # common tags are here
    ...
    # Event specific
    "server.resume.server_id": "2f928baa-4c81-43cb-a280-7c514012bf26", # Identifier of the Server being resumed
    "server.resume.farm.id": 12000, # Identifier of the Farm that the Server belongs to
    "server.resume.farm_role.id": 130000, # Identifier of the Farm Role that the Server belongs to
    "server.resume.platform": "ec2", # The platform name where the Server is located
    "server.resume.type": "m1.small", # The name of the instance type of the Server
    "server.resume.cloud_location": "us-east-1", # The region where the Server is located
    "server.resume.cloud_location_zone": "us-east-1a", # Optional tag which is applied only for Ec2 and GCE platforms
    "server.resume.os.id": "centos-6-x", # The Identifier of the Os that corresponds to the Server
    "server.resume.environment.id": 1234, # Identifier of the Environment that the Server belongs to
    "server.resume.account.id": 123, # Identifier of the Account that the Server belongs to
    "tags": ["audit", "server.resume"]
}


Cloud Resource Remove

Code Block
cloud_resource.remove {
    # common tags are here
    ...
    # Event
    "cloud_resource.remove.name": "/dev/sdg", # Cloud resource name
    "cloud_resource.remove.type": "17", # Cloud resource type
    "cloud_resource.remove.purpose": "1", # Cloud resource creation purpose
    "cloud_resource.remove.reason": "Not found on cloud", # Cloud resource remove reason
    "cloud_resource.remove.cloud_credentials.id": "0b2eccc44ef7", # Identifier of the cloud credentials that the resource belongs to
    "cloud_resource.remove.cloud_location": "us-east-1", # Cloud location/region where the resource is located
    "cloud_resource.remove.cloud_object_id": "325a9fa0f99f", # Cloud resource object
    "cloud_resource.remove.environment.id": 1234, # Identifier of the Environment that the resource belongs to
    "cloud_resource.remove.owner.id": 123, # Identifier of the User that the resource owned by
    "cloud_resource.remove.owner.teams": [2342, 2348], # The list of the Team IDs which the Resource is owned by. It can be NULL if there are no Team owner
    "cloud_resource.remove.placements": [
      {
        "server.id": "b82b38c4-b747-4739-9546-41d2e8b68207",  # Optional tag which shows placement relation of resource. The Scalr objects using this resource
        "farm_role.id": "68",  # Optional tag which shows placement relation of resource. The Scalr objects using this resource
        "farm.id": "9800014",   # Optional tag which shows placement relation of resource. The Scalr objects using this resource
        "script.execute.target.account_environment.id": 1, # Identifier of the Account the target Server corresponds to"5",  # Optional tag which shows placement relation of resource. The Scalr objects using this resource
        "script.execute.target.env_account.id": "1,"  # Identifier of the Environment the target Server corresponds to
    "script.execute.target.farm_id": 13003, # Identifier of the Farm the target Server corresponds to Optional tag which shows placement relation of resource. The Scalr objects using this resource
      },
      {
        "script.execute.target.farm_role_.id": 133883, # Identifier of the Farm Role the target Server corresponds to"74",
        "farm.id": "9800014",
        "script.execute.target.server_environment.id": "64bf1356-b8fb-4A6f-ad89-2416d1c678555",
# Identifier of the Server the script executed on     "script.execute.script.pathaccount.id": "1"path
 to script", # Optional tag which}
indicates which local script run.],
    "tags": ["audit", "scriptcloud_resource.executeremove"]
}