OpenShift enables audit logging by default, so there is nothing to configure. This page says which audit logs Collectord forwards, and how the Monitoring OpenShift app finds them.
Collectord reads the kube-apiserver, openshift-apiserver, oauth-apiserver and oauth-server audit logs under /var/log/ on the control-plane nodes. Those are the nodes labelled node-role.kubernetes.io/master (the Helm chart’s controlPlaneNodeSelector). On the other nodes, collectord verify reports the four inputs as not read on this node.
The app’s Audit menu holds dashboards built for API server audit data: who did what, against which resource, and how the API responded. It covers:
- detections, with OAuth logins on Audit: Security Threats;
- activity by user, service account, project and object;
- API server performance;
- deprecated APIs;
- Audit: Data Health, for the audit data itself.
The Splunk app finds audit events through the macro_openshift_audit_logs macro. It reads only the trusted sources, the audit files of kube-apiserver, openshift-apiserver, oauth-apiserver and the OAuth server:
1(`macro_openshift_host_logs` (source="*/kube-apiserver/audit*.log" OR source="*/openshift-apiserver/audit*.log" OR source="*/oauth-apiserver/audit*.log" OR source="*/oauth-server/audit*.log") "audit.k8s.io" _openshift_sourcetype=* _openshift_source=*)The _openshift_sourcetype and _openshift_source terms hold the source type and source Collectord indexed for the line, never a value the line’s own JSON names. So the macro leaves out a pod that prints "sourcetype":"openshift_host_logs". Keep these terms in an override.
Audit: Data Health counts the audit-shaped events the macro rejects.
openshift-apiserver and oauth-apiserver also record a request kube-apiserver passed them, so a search of your own on the macro counts such a request twice. To count each request once, as the dashboards do, add | `macro_openshift_audit_proxied_copy` | search is_proxied_copy=0.
To widen or narrow the sources, override the macro in local/macros.conf. The dashboards, the audit alert templates and the CIM mapping follow it.
Before 26.10, the macro read kube-apiserver’s audit files alone. An override written against that definition must add the openshift-apiserver, oauth-apiserver and oauth-server paths, or the OAuth login and user panels stay empty.