User Auditing

To meet compliance and regulation objectives, you can audit the user interactions through the Kloudfuse observability platform.

To monitor both authentication and authorization services in the Kloudfuse UI data plane, contact Kloudfuse Support.

Audit Authentication

For authentication, the administrator can view the user login interactions in the kfuse-auth deployment logs.

kubectl logs -n kfuse deployment/kfuse-auth

Audit Authorization

For authorization, the RBAC configuration enables the administrators to examine the logs of user-mgmt-service to view the user actions on the various Kloudfuse resources.

kubectl logs -n kfuse deployment/user-mgmt-service

Enabling Auditing

To be able to view audit logs in the UI, first enable these features in your cluster custom-values.yaml configuration file:

global:
  RBACEnabled: true
  EnableAuditLogs: true

kfuse-audit-log-vector:
  enabled: true
yaml

EnableAuditLogs requires RBACEnabled. This configuration enables RBAC authentication for all operations and captures audit logs for mutation operations, which are viewable in the Logs section.

kfuse-audit-log-vector.enabled turns on self-ingestion of audit logs, routing the audit log stream back into Kloudfuse so it can be queried and viewed through the Logs UI alongside your other telemetry. Enable it on any cluster where you want to browse audit logs in the Kloudfuse UI.

Audit logs only capture mutation events — that is, when a user creates, edits, or deletes a resource — along with authentication events such as user logins. Read-only actions and queries are not recorded in the audit logs; for query-level visibility, see Performance Logs.

After applying these configurations and updating your cluster, you can view the audit logs in the Logs section by filtering with audit_log="true" or by source using Core:source="kf-audit-log".

Performance Logs

Performance logs require Audit Logs to be enabled. Add the following to your custom-values.yaml:

global:
  RBACEnabled: true
  EnableAuditLogs: true
  EnablePerfLogs: true  (1)

kfuse-audit-log-vector:
  enabled: true
yaml
1 EnablePerfLogs is required for performance logs, on top of the audit logs configuration.

Performance logs record every query made against the system, regardless of origin — queries issued by a user through the UI, calls made by a service account, internal service-to-service calls, and queries run by evaluating alerts. Each entry captures how long the query took along with the associated Pinot statistics, giving you visibility into the performance of every request flowing through the platform.

View performance logs in the Logs section by filtering with Core:source="kf-performance-logs" or by perf_log="true". Filter by service-name to identify which service the logs belong to, along with other labels for performance and tracing.