Installing and configuring the FluentBit plugin for the data plane

Install Fluent Bit software on the VM if you have not done so already.

Install the vkcloudaudit-fluent-bit-plugin plugin to collect data plane audit events.

 
sudo rpm -i https://cloudaudit.hb.bizmrg.com/vkcloudaudit-fluent-bit-plugin/vkcloudaudit-fluent-bit-plugin-0.2.1-1.x86_64.rpm

 
wget https://cloudaudit.hb.bizmrg.com/vkcloudaudit-fluent-bit-plugin/vkcloudaudit-fluent-bit-plugin_0.2.1_amd64.debsudo dpkg -i vkcloudaudit-fluent-bit-plugin_0.2.1_amd64.deb

 
sudo apt-get install https://cloudaudit.hb.bizmrg.com/vkcloudaudit-fluent-bit-plugin/vkcloudaudit-fluent-bit-plugin-0.2.1-1.x86_64.rpm

After installation, the vkcloudaudit-fluent-bit.service log collection agent will appear in the VM services. By default, it is disabled.

Go to the /etc/vkcloudaudit-fluent-bit-plugin directory, where the YAML files containing the plugin settings must be located. Examples:

• /etc/vkcloudaudit-fluent-bit-plugin/fluent-bit.yaml — the main plugin configuration file. For details, see Data plane audit plugin.
• /etc/vkcloudaudit-fluent-bit-plugin/input-kubernetes.yaml — the file that describes the data plane event source.

Configure the plugin to send logs to the Cloud Audit service.

1. Find out the plugin authorization parameters for your project.

2. Edit the fluent-bit.yaml file and specify the agent connection parameters:

   fluent-bit.yaml

3. Add a file with source parameters to the directory. For example, input-kubernetes.yaml for Kubernetes:

   input-kubernetes.yaml

4. To configure conversion of the data collected by the plugin into the audit event format, add a Lua script file to the /etc/vkcloudaudit-fluent-bit-plugin/filters directory. For example, kubernetes.lua.

   kubernetes.lua

Enable the vkcloudaudit-fluent-bit.service event collection agent by running the command:

 
sudo systemctl enable vkcloudaudit-fluent-bit.servicesudo systemctl start vkcloudaudit-fluent-bit.service

If the configuration was performed on a running agent, restart it:

 
sudo systemctl restart vkcloudaudit-fluent-bit.service

Wait some time for data to accumulate.

Go to the VK Cloud management console and check for events in Monitoring → Event log on the Data plane tab.