Skip to content

Commit 22a9dec

Browse files
Y0CossY0Coss
authored
Merge pull request #8010 from ovh/dev/gbarideau/kms-l2c
New KMS troubleshooting guide
2 parents 4b035dd + e9cfe1d commit 22a9dec

File tree

6 files changed

+234
-0
lines changed

6 files changed

+234
-0
lines changed

‎pages/index.md

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1976,6 +1976,11 @@
19761976
+ [Pushing logs with a forwarder - Syslog-ng 3.8+ (Linux)](manage_and_operate/observability/logs_data_platform/ingestion_syslog_ng)
19771977
+ [Pushing logs with a forwarder - NXLog (Windows)](manage_and_operate/observability/logs_data_platform/ingestion_windows_nxlog)
19781978
+ [Pushing logs from software - Apache](manage_and_operate/observability/logs_data_platform/ingestion_apache)
1979+
+ [Pushing logs from a Kubernetes cluster to Logs Data Platform using Fluent Bit](manage_and_operate/observability/logs_data_platform/ingestion_kubernetes_fluent_bit)
1980+
+ [Pushing logs from OVHcloud account to Logs Data Platform](manage_and_operate/iam/iam-logs-forwarding)
1981+
+ [Pushing logs from OVHcloud KMS to Logs Data Platform](manage_and_operate/kms/kms-troubleshooting)
1982+
+ [Pushing logs from SAP to Logs Data Platform](hosted_private_cloud/sap_on_ovhcloud/cookbook_sap_logs_on_ovhcloud_logs_data_platform_solution_setup)
1983+
+ [Logs Data Platform - Collect VMware on OVHcloud logs](/pages/hosted_private_cloud/hosted_private_cloud_powered_by_vmware/vmware_ldp)
19791984
+ [Visualizing, querying and exploiting your logs](observability-logs-data-platform-visualizing-querying-exploiting)
19801985
+ [Exposing your logs to third-party tools via the OpenSearch API](manage_and_operate/observability/logs_data_platform/integration_opensearch_api)
19811986
+ [Using OpenSearch Dashboards with Logs Data Platform](manage_and_operate/observability/logs_data_platform/visualization_opensearch_dashboards)
@@ -2002,6 +2007,7 @@
20022007
+ [OVHcloud KMS Architecture overview](manage_and_operate/kms/architecture-overview)
20032008
+ [OVHcloud KMS - Responsibility model](manage_and_operate/kms/responsibility-model-kms)
20042009
+ [How to connect a compatible product using KMIP protocol with OVHcloud KMS](manage_and_operate/kms/kms-kmip)
2010+
+ [Pushing logs from OVHcloud KMS to Logs Data Platform](manage_and_operate/kms/kms-troubleshooting)
20052011
+ OVHcloud Labs
20062012
+ [Data Collector](products/ovhcloud-labs-data-collector)
20072013
+ [Getting started](ovhcloud-labs-data-collector-getting-started)

‎pages/manage_and_operate/kms/kms-troubleshooting/guide.en-gb.md

Lines changed: 112 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,112 @@
1+
---
2+
title: "Pushing logs from OVHcloud KMS to Logs Data Platform"
3+
excerpt: "Analyze KMS logs through LDP"
4+
updated: 2025-06-17
5+
---
6+
7+
## Objective
8+
9+
This guide aims to introduce logs generated by OVHcloud KMS and how they are managed from Logs Data Platform.
10+
11+
## Requirements
12+
13+
- An [OVHcloud customer account](/pages/account_and_service_management/account_information/ovhcloud-account-creation).
14+
- An [OVHcloud KMS ordered and an access certificate created](/pages/manage_and_operate/kms/quick-start).
15+
16+
## Instructions
17+
18+
### Description
19+
20+
OVHcloud KMS has a native integration with [Logs Data Platform](/links/manage-operate/ldp) for logs management.
21+
22+
### Logs direct access
23+
24+
KMS logs are available from each KMS `Logs`{.action} tab.
25+
26+
![Logs tab](images/kms-logs-tab.png){.thumbnail}
27+
28+
This tab displays all KMS logsin real time.
29+
A selector allows to switch display between the two types of logs:
30+
31+
- REST API audit logs.
32+
- KMIP audit logs.
33+
34+
### Logs access through LDP
35+
36+
From the `Logs`{.action} tab, you can subscribe to an LDP data stream.
37+
Once the subscription is enabled, all the logs will be pushed to [Logs Data Platform](/links/manage-operate/ldp) to archive generated logs and perform advanced searches, create alerts and visualisations.
38+
39+
![LDP Subscription](images/kms-ldp-subscription.png){.thumbnail}
40+
41+
For more information, please refer to our guide "[Quick start for Logs Data Platform](/pages/manage_and_operate/observability/logs_data_platform/getting_started_quick_start)".
42+
43+
### Available logs details
44+
45+
KMS logs contain the following information:
46+
47+
- REST API
48+
49+
Logs are displayed with this format:
50+
51+
```bash
52+
{{ http_method }} {{ http_path }} - {{ http_status }} - identity: {{ iam_identities }} - operation: {{ iam_operation }} on {{ res_urn }} - from {{ip}} with certificate {{cert_id}} - request id: {{ request_id }}
53+
```
54+
55+
**Example:**
56+
57+
```console
58+
INFO | GET /v1/servicekey/77f0a3f6-c2ef-4e76-xxxx-xxxxxxxxxxxx - 200 - identity: urn:v1:eu:identity:group:xx1111-ovh/john.smith - operation: okms:apiovh:serviceKey/get on urn:v1:eu:resource:okms:8d1c84cc-1128-4629-xxxx-xxxxxxxxxx/serviceKey/77f0a3f6-c2ef-4e76-xxxx-xxxxxxxxxxxx - from Manager/APIv2 - request id: EU.manager-5.684c3abe.3880620.2080cff16eaa5539bf92cxxxxxxxx
59+
```
60+
61+
Elements that can be pushed to Logs Data Platform:
62+
63+
|**Field**|**Description**|
64+
| :-: | :-: |
65+
|domain_id|OKMS domain ID|
66+
|request_id|request ID|
67+
|type||
68+
|log_level|Log priority level|
69+
|client_ip|IP of the client making the request|
70+
|tls_cert_id|Authentication certificate ID used|
71+
|res_urn|target resource URN|
72+
|region|OKMS domain region|
73+
|iam_operation|IAM action evalutated|
74+
|iam_identities|IAM identity used for rights evaluation|
75+
|http_path|Request path|
76+
|http_status|HTTP answer status|
77+
|http_method|Request method|
78+
|err_category|Error category|
79+
80+
- KMIP
81+
82+
Logs are displayed with this format:
83+
84+
```bash
85+
{{ http_method }} {{ http_path }} - {{ http_status }} - identity: {{ iam_identities }} - operation: {{ iam_operation }} on {{ res_urn }} - from {{ip}} with certificate {{cert_id}} - request id: {{ request_id }}
86+
```
87+
88+
**Example:**
89+
90+
```console
91+
INFO | GET on urn:v1:eu:resource:okms:8d1c84cc-1128-4629-xxxx-xxxxxxxxxxx/kmip/ff55638c-3e86-4cb3-xxxx-xxxxxxxx - identity: urn:v1:eu:identity:account:xx1111-ovh - operation: okms:kmip:get - from XXX.XXX.XXX.XXX with certificate e7850a19-a5de-4527-xxxx-xxxxxxxxx - request id: OKMS.db61c455-abfa-4a66-xxxx-xxxxxxxxxxx
92+
```
93+
94+
Elements that can be pushed to Logs Data Platform:
95+
96+
|**Field**|**Description**|
97+
| :-: | :-: |
98+
|domain_id|OKMS domain ID|
99+
|request_id|Request ID|
100+
|log_level|Log priority level|
101+
|client_ip|IP of the client making the request|
102+
|tls_cert_id|Authentication certificate ID used|
103+
|res_urn|Target resource URN|
104+
|region|OKMS domain region|
105+
|iam_operation|IAM action evalutated|
106+
|iam_identities|IAM identity used for rights evaluation|
107+
|kmip_operation|KMIP operation used|
108+
|kmip_reason|[Standard KMIP error code](https://docs.oasis-open.org/kmip/spec/v1.4/kmip-spec-v1.4.pdf#%5B%7B%22num%22%3A484%2C%22gen%22%3A0%7D%2C%7B%22name%22%3A%22XYZ%22%7D%2C69%2C720%2C0%5D){.external}|
109+
110+
## Go further
111+
112+
Join our [community of users](/links/community).

‎pages/manage_and_operate/kms/kms-troubleshooting/guide.fr-fr.md

Lines changed: 113 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,113 @@
1+
---
2+
title: "Transférer les logs du KMS OVHcloud à Logs Data Platform"
3+
excerpt: "Analyser les logs KMS via LDP"
4+
updated: 2025-06-17
5+
---
6+
7+
## Objectif
8+
9+
L'objectif de ce guide est de présenter les logs générés par le KMS OVHcloud et la manière dont ils sont gérés depuis Logs Data Platform.
10+
11+
## Prérequis
12+
13+
- Disposer d'un [compte client OVHcloud](/pages/account_and_service_management/account_information/ovhcloud-account-creation).
14+
- Avoir [commandé un KMS OVHcloud et créé un certificat d'accès](/pages/manage_and_operate/kms/quick-start).
15+
16+
## En pratique
17+
18+
### Description
19+
20+
Le KMS OVHcloud dispose d'une intégration native avec [Logs Data Platform](/links/manage-operate/ldp) pour la gestion des logs.
21+
22+
### Accès aux logs en direct
23+
24+
Les logs du KMS sont accessibles depuis l'onglet `Logs`{.action} d'un KMS.
25+
26+
![Logs tab](images/kms-logs-tab.png){.thumbnail}
27+
28+
Cet onglet affiche en temps réel les logs du KMS.
29+
Le sélecteur permet de choisir le type de logs affichés :
30+
31+
- REST API audit logs.
32+
- KMIP audit logs.
33+
34+
### Accès aux logs via LDP
35+
36+
Depuis l'onglet `Logs`{.action} il est possible de s'abonner à un flux LDP.
37+
Une fois l'abonnement actif, l'ensemble des logs seront transmis à [Logs Data Platform](/links/manage-operate/ldp) pour retrouver l'historique des logs générés et la possiblité de faire des recherches plus avancées, créer des alertes et des visualisations.
38+
39+
![LDP Subscription](images/kms-ldp-subscription.png){.thumbnail}
40+
41+
Pour plus d'informations, veuillez consulter notre guide « [Quick start for Logs Data Platform](/pages/manage_and_operate/observability/logs_data_platform/getting_started_quick_start) ».
42+
43+
### Liste des logs générés
44+
45+
Les logs du KMS comportent les informations suivantes :
46+
47+
- API REST
48+
49+
Les logs sont sous le format suivant :
50+
51+
```bash
52+
{{ http_method }} {{ http_path }} - {{ http_status }} - identity: {{ iam_identities }} - operation: {{ iam_operation }} on {{ res_urn }} - from {{ip}} with certificate {{cert_id}} - request id: {{ request_id }}
53+
```
54+
55+
**Exemple :**
56+
57+
```console
58+
INFO | GET /v1/servicekey/77f0a3f6-c2ef-4e76-xxxx-xxxxxxxxxxxx - 200 - identity: urn:v1:eu:identity:group:xx1111-ovh/john.smith - operation: okms:apiovh:serviceKey/get on urn:v1:eu:resource:okms:8d1c84cc-1128-4629-xxxx-xxxxxxxxxx/serviceKey/77f0a3f6-c2ef-4e76-xxxx-xxxxxxxxxxxx - from Manager/APIv2 - request id: EU.manager-5.684c3abe.3880620.2080cff16eaa5539bf92cxxxxxxxx
59+
```
60+
61+
Les éléments pouvant être transmis à Logs Data Platform sont :
62+
63+
|**Champ**|**Description**|
64+
| :-: | :-: |
65+
|domain_id|ID du domaine OKMS|
66+
|request_id|ID de la requête|
67+
|type||
68+
|log_level|Niveau de priorité du log|
69+
|client_ip|IP du client réalisant la requête|
70+
|tls_cert_id|ID du certificat utilisé pour l'authentification|
71+
|res_urn|URN de la ressource ciblé|
72+
|region|Région du domaine OKMS|
73+
|iam_operation|Action IAM évaluée|
74+
|iam_identities|Identitée IAM utilisé pour l'évaluation des droits|
75+
|http_path|Chemin de la requête|
76+
|http_status|Status de la réponse HTTP|
77+
|http_method|Methode de la requête|
78+
|err_category|Catégorie de l'erreur|
79+
80+
- KMIP
81+
82+
Les logs sont sous le format suivant :
83+
84+
```bash
85+
{{ http_method }} {{ http_path }} - {{ http_status }} - identity: {{ iam_identities }} - operation: {{ iam_operation }} on {{ res_urn }} - from {{ip}} with certificate {{cert_id}} - request id: {{ request_id }}
86+
```
87+
88+
**Exemple :**
89+
90+
```console
91+
INFO | GET on urn:v1:eu:resource:okms:8d1c84cc-1128-4629-xxxx-xxxxxxxxxxx/kmip/ff55638c-3e86-4cb3-xxxx-xxxxxxxx - identity: urn:v1:eu:identity:account:xx1111-ovh - operation: okms:kmip:get - from XXX.XXX.XXX.XXX with certificate e7850a19-a5de-4527-xxxx-xxxxxxxxx - request id: OKMS.db61c455-abfa-4a66-xxxx-xxxxxxxxxxx"
92+
```
93+
94+
Les éléments pouvant être transmis à Logs Data Platform étant :
95+
96+
|**Champ**|**Description**|
97+
| :-: | :-: |
98+
|domain_id|ID du domaine OKMS|
99+
|request_id|ID de la requête|
100+
|type||
101+
|log_level|Niveau de priorité du log|
102+
|client_ip|IP du client réalisant la requête|
103+
|tls_cert_id|ID du certificat utilisé pour l'authentification|
104+
|res_urn|URN de la ressource ciblée|
105+
|region|Région du domaine OKMS|
106+
|iam_operation|Action IAM évaluée|
107+
|iam_identities|Identitée IAM utilisé pour l'évaluation des droits|
108+
|kmip_operation|Opération KMIP utilisée|
109+
|kmip_reason|[code d'erreur KMIP](https://docs.oasis-open.org/kmip/spec/v1.4/kmip-spec-v1.4.pdf#%5B%7B%22num%22%3A484%2C%22gen%22%3A0%7D%2C%7B%22name%22%3A%22XYZ%22%7D%2C69%2C720%2C0%5D){.external}|
110+
111+
## Aller plus loin
112+
113+
Échangez avec notre [communauté d'utilisateurs](/links/community).

‎pages/manage_and_operate/kms/kms-troubleshooting/images/kms-ldp-subscription.png

40.4 KB
Loading

‎pages/manage_and_operate/kms/kms-troubleshooting/images/kms-logs-tab.png

20.1 KB
Loading

‎pages/manage_and_operate/kms/kms-troubleshooting/meta.yaml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
id: 751e237a-47e4-4ac8-854d-189530462197
2+
full_slug: kms-logs
3+
reference_category: manage-operate-kms

0 commit comments

Comments
 (0)