You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cassandra.apache.org by ma...@apache.org on 2023/05/25 06:50:31 UTC
[cassandra] branch cassandra-4.1 updated (93efe0ee04 -> 72fc04d238)
This is an automated email from the ASF dual-hosted git repository.
marcuse pushed a change to branch cassandra-4.1
in repository https://gitbox.apache.org/repos/asf/cassandra.git
from 93efe0ee04 Merge branch 'cassandra-4.0' into cassandra-4.1
new aafb4d1944 Improve nodetool enable{audit,fullquery}log
new 72fc04d238 Merge branch 'cassandra-4.0' into cassandra-4.1
The 2 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
CHANGES.txt | 1 +
conf/cassandra.yaml | 2 ++
.../cassandra/config/DatabaseDescriptor.java | 5 ++++
.../apache/cassandra/service/StorageService.java | 8 +++++-
.../cassandra/tools/nodetool/EnableAuditLog.java | 4 ++-
.../tools/nodetool/EnableFullQueryLog.java | 3 ++-
.../cassandra/utils/binlog/BinLogOptions.java | 7 ++++++
.../apache/cassandra/audit/AuditLoggerTest.java | 29 ++++++++++++++++++++++
.../apache/cassandra/fql/FullQueryLoggerTest.java | 27 ++++++++++++++++++++
9 files changed, 83 insertions(+), 3 deletions(-)
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@cassandra.apache.org
For additional commands, e-mail: commits-help@cassandra.apache.org
[cassandra] 01/01: Merge branch 'cassandra-4.0' into cassandra-4.1
Posted by ma...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
marcuse pushed a commit to branch cassandra-4.1
in repository https://gitbox.apache.org/repos/asf/cassandra.git
commit 72fc04d238dbdece34ba6f922b431beb1b14ec7d
Merge: 93efe0ee04 aafb4d1944
Author: Marcus Eriksson <ma...@apache.org>
AuthorDate: Thu May 25 08:42:30 2023 +0200
Merge branch 'cassandra-4.0' into cassandra-4.1
CHANGES.txt | 1 +
conf/cassandra.yaml | 2 ++
.../cassandra/config/DatabaseDescriptor.java | 5 ++++
.../apache/cassandra/service/StorageService.java | 8 +++++-
.../cassandra/tools/nodetool/EnableAuditLog.java | 4 ++-
.../tools/nodetool/EnableFullQueryLog.java | 3 ++-
.../cassandra/utils/binlog/BinLogOptions.java | 7 ++++++
.../apache/cassandra/audit/AuditLoggerTest.java | 29 ++++++++++++++++++++++
.../apache/cassandra/fql/FullQueryLoggerTest.java | 27 ++++++++++++++++++++
9 files changed, 83 insertions(+), 3 deletions(-)
diff --cc CHANGES.txt
index 0f46880950,4f873aa71c..302ac8b936
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@@ -1,11 -1,5 +1,12 @@@
-4.0.10
+4.1.2
+ * Allow keystore and trustrore passwords to be nullable (CASSANDRA-18124)
+ * Return snapshots with dots in their name in nodetool listsnapshots (CASSANDRA-18371)
+ * Fix NPE when loading snapshots and data directory is one directory from root (CASSANDRA-18359)
+ * Do not submit hints when hinted_handoff_enabled=false (CASSANDRA-18304)
+ * Fix COPY ... TO STDOUT behavior in cqlsh (CASSANDRA-18353)
+ * Remove six and Py2SaferScanner merge cruft (CASSANDRA-18354)
+Merged from 4.0:
+ * Improve nodetool enable{audit,fullquery}log (CASSANDRA-18550)
* Report network cache info in nodetool (CASSANDRa-18400)
* Partial compaction can resurrect deleted data (CASSANDRA-18507)
* Allow internal address to change with reconnecting snitches (CASSANDRA-16718)
diff --cc conf/cassandra.yaml
index a15de953c0,3e4da52f5f..4b2711cfb7
--- a/conf/cassandra.yaml
+++ b/conf/cassandra.yaml
@@@ -1580,15 -1352,17 +1580,17 @@@ audit_logging_options
# default options for full query logging - these can be overridden from command line when executing
# nodetool enablefullquerylog
-#full_query_logging_options:
- # log_dir:
- # roll_cycle: HOURLY
- # block: true
- # max_queue_weight: 268435456 # 256 MiB
- # max_log_size: 17179869184 # 16 GiB
- ## archive command is "/path/to/script.sh %path" where %path is replaced with the file being rolled:
- # archive_command:
- ## note that enabling this allows anyone with JMX/nodetool access to run local shell commands as the user running cassandra
- # allow_nodetool_archive_command: false
- # max_archive_retries: 10
+# full_query_logging_options:
+ # log_dir:
+ # roll_cycle: HOURLY
+ # block: true
+ # max_queue_weight: 268435456 # 256 MiB
+ # max_log_size: 17179869184 # 16 GiB
+ ## archive command is "/path/to/script.sh %path" where %path is replaced with the file being rolled:
+ # archive_command:
++ ## note that enabling this allows anyone with JMX/nodetool access to run local shell commands as the user running cassandra
++ # allow_nodetool_archive_command: false
+ # max_archive_retries: 10
# validate tombstones on reads and compaction
# can be either "disabled", "warn" or "exception"
diff --cc src/java/org/apache/cassandra/service/StorageService.java
index 87cfbac046,b53467e81b..ed10f04773
--- a/src/java/org/apache/cassandra/service/StorageService.java
+++ b/src/java/org/apache/cassandra/service/StorageService.java
@@@ -6390,33 -5998,29 +6390,37 @@@ public class StorageService extends Not
public void enableAuditLog(String loggerName, Map<String, String> parameters, String includedKeyspaces, String excludedKeyspaces, String includedCategories, String excludedCategories,
String includedUsers, String excludedUsers) throws ConfigurationException, IllegalStateException
{
- loggerName = loggerName != null ? loggerName : DatabaseDescriptor.getAuditLoggingOptions().logger.class_name;
-
- Preconditions.checkNotNull(loggerName, "cassandra.yaml did not have logger in audit_logging_option and not set as parameter");
- Preconditions.checkState(FBUtilities.isAuditLoggerClassExists(loggerName), "Unable to find AuditLogger class: "+loggerName);
-
- AuditLogOptions auditLogOptions = new AuditLogOptions();
- auditLogOptions.enabled = true;
- auditLogOptions.logger = new ParameterizedClass(loggerName, parameters);
- auditLogOptions.included_keyspaces = includedKeyspaces != null ? includedKeyspaces : DatabaseDescriptor.getAuditLoggingOptions().included_keyspaces;
- auditLogOptions.excluded_keyspaces = excludedKeyspaces != null ? excludedKeyspaces : DatabaseDescriptor.getAuditLoggingOptions().excluded_keyspaces;
- auditLogOptions.included_categories = includedCategories != null ? includedCategories : DatabaseDescriptor.getAuditLoggingOptions().included_categories;
- auditLogOptions.excluded_categories = excludedCategories != null ? excludedCategories : DatabaseDescriptor.getAuditLoggingOptions().excluded_categories;
- auditLogOptions.included_users = includedUsers != null ? includedUsers : DatabaseDescriptor.getAuditLoggingOptions().included_users;
- auditLogOptions.excluded_users = excludedUsers != null ? excludedUsers : DatabaseDescriptor.getAuditLoggingOptions().excluded_users;
-
- AuditLogManager.instance.enable(auditLogOptions);
-
- logger.info("AuditLog is enabled with logger: [{}], included_keyspaces: [{}], excluded_keyspaces: [{}], " +
- "included_categories: [{}], excluded_categories: [{}], included_users: [{}], "
- + "excluded_users: [{}], archive_command: [{}]", auditLogOptions.logger, auditLogOptions.included_keyspaces, auditLogOptions.excluded_keyspaces,
- auditLogOptions.included_categories, auditLogOptions.excluded_categories, auditLogOptions.included_users, auditLogOptions.excluded_users,
- auditLogOptions.archive_command);
+ enableAuditLog(loggerName, parameters, includedKeyspaces, excludedKeyspaces, includedCategories, excludedCategories, includedUsers, excludedUsers,
+ Integer.MIN_VALUE, null, null, Long.MIN_VALUE, Integer.MIN_VALUE, null);
+ }
+ public void enableAuditLog(String loggerName, Map<String, String> parameters, String includedKeyspaces, String excludedKeyspaces, String includedCategories, String excludedCategories,
+ String includedUsers, String excludedUsers, Integer maxArchiveRetries, Boolean block, String rollCycle,
+ Long maxLogSize, Integer maxQueueWeight, String archiveCommand) throws IllegalStateException
+ {
- final AuditLogOptions options = new AuditLogOptions.Builder(DatabaseDescriptor.getAuditLoggingOptions())
++ AuditLogOptions auditOptions = DatabaseDescriptor.getAuditLoggingOptions();
++ if (archiveCommand != null && !auditOptions.allow_nodetool_archive_command)
++ throw new ConfigurationException("Can't enable audit log archiving via nodetool unless audit_logging_options.allow_nodetool_archive_command is set to true");
++
++ final AuditLogOptions options = new AuditLogOptions.Builder(auditOptions)
+ .withEnabled(true)
+ .withLogger(loggerName, parameters)
+ .withIncludedKeyspaces(includedKeyspaces)
+ .withExcludedKeyspaces(excludedKeyspaces)
+ .withIncludedCategories(includedCategories)
+ .withExcludedCategories(excludedCategories)
+ .withIncludedUsers(includedUsers)
+ .withExcludedUsers(excludedUsers)
+ .withMaxArchiveRetries(maxArchiveRetries)
+ .withBlock(block)
+ .withRollCycle(rollCycle)
+ .withMaxLogSize(maxLogSize)
+ .withMaxQueueWeight(maxQueueWeight)
+ .withArchiveCommand(archiveCommand)
+ .build();
+
+ AuditLogManager.instance.enable(options);
+ logger.info("AuditLog is enabled with configuration: {}", options);
}
public boolean isAuditLogEnabled()
diff --cc src/java/org/apache/cassandra/tools/nodetool/EnableAuditLog.java
index ae0bb42d3d,c71d21057d..cf9d05ee64
--- a/src/java/org/apache/cassandra/tools/nodetool/EnableAuditLog.java
+++ b/src/java/org/apache/cassandra/tools/nodetool/EnableAuditLog.java
@@@ -49,25 -47,6 +49,27 @@@ public class EnableAuditLog extends Nod
@Option(title = "excluded_users", name = { "--excluded-users" }, description = "Comma separated list of users to be excluded for audit log. If not set the value from cassandra.yaml will be used")
private String excluded_users = null;
+ @Option(title = "roll_cycle", name = {"--roll-cycle"}, description = "How often to roll the log file (MINUTELY, HOURLY, DAILY).")
+ private String rollCycle = null;
+
+ @Option(title = "blocking", name = {"--blocking"}, description = "If the queue is full whether to block producers or drop samples [true|false].")
+ private String blocking = null;
+
+ @Option(title = "max_queue_weight", name = {"--max-queue-weight"}, description = "Maximum number of bytes of query data to queue to disk before blocking or dropping samples.")
+ private int maxQueueWeight = Integer.MIN_VALUE;
+
+ @Option(title = "max_log_size", name = {"--max-log-size"}, description = "How many bytes of log data to store before dropping segments. Might not be respected if a log file hasn't rolled so it can be deleted.")
+ private long maxLogSize = Long.MIN_VALUE;
+
+ @Option(title = "archive_command", name = {"--archive-command"}, description = "Command that will handle archiving rolled audit log files." +
- " Format is \"/path/to/script.sh %path\" where %path will be replaced with the file to archive")
++ " Format is \"/path/to/script.sh %path\" where %path will be replaced with the file to archive" +
++ " Enable this by setting the audit_logging_options.allow_nodetool_archive_command: true in the config.")
++
+ private String archiveCommand = null;
+
+ @Option(title = "archive_retries", name = {"--max-archive-retries"}, description = "Max number of archive retries.")
+ private int archiveRetries = Integer.MIN_VALUE;
+
@Override
public void execute(NodeProbe probe)
{
diff --cc test/unit/org/apache/cassandra/audit/AuditLoggerTest.java
index b4ae02b6da,ac0170fb1c..1ee66f7340
--- a/test/unit/org/apache/cassandra/audit/AuditLoggerTest.java
+++ b/test/unit/org/apache/cassandra/audit/AuditLoggerTest.java
@@@ -21,6 -21,7 +21,7 @@@ import org.junit.After
import java.io.IOException;
import java.nio.file.Files;
import java.nio.file.Path;
-import java.util.Map;
++import java.util.Collections;
import org.junit.Assert;
import org.junit.Before;
@@@ -716,6 -717,6 +717,34 @@@ public class AuditLoggerTest extends CQ
assertEquals(0, AuthEvents.instance.listenerCount());
}
++ @Test
++ public void testJMXArchiveCommand()
++ {
++ disableAuditLogOptions();
++ AuditLogOptions options = new AuditLogOptions();
++
++ try
++ {
++ StorageService.instance.enableAuditLog("BinAuditLogger", Collections.emptyMap(), "", "", "", "",
++ "", "", 10, true, options.roll_cycle,
++ 1000L, 1000, "/xyz/not/null");
++ fail("not allowed");
++ }
++ catch (ConfigurationException e)
++ {
++ assertTrue(e.getMessage().contains("Can't enable audit log archiving via nodetool"));
++ }
++
++ options.archive_command = "/xyz/not/null";
++ options.audit_logs_dir = "/tmp/abc";
++ DatabaseDescriptor.setAuditLoggingOptions(options);
++ StorageService.instance.enableAuditLog("BinAuditLogger", Collections.emptyMap(), "", "", "", "",
++ "", "", 10, true, options.roll_cycle,
++ 1000L, 1000, null);
++ assertTrue(AuditLogManager.instance.isEnabled());
++ assertEquals("/xyz/not/null", AuditLogManager.instance.getAuditLogOptions().archive_command);
++ }
++
/**
* Helper methods for Audit Log CQL Testing
*/
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@cassandra.apache.org
For additional commands, e-mail: commits-help@cassandra.apache.org