AUDIT(1)

NAME
audit -

DESCRIPTION

CLI for the Audit Service. Use this CLI for compliance monitoring in your tenancy. For more information, see Overview of Audit <https://docs.cloud.oracle.com/iaas/Content/Audit/Concepts/auditoverview.htm>.

Tip: This CLI is good for queries, but not bulk-export operations.

AVAILABLE COMMANDS

•   config

•   get

•   update

•   event

•   list

  config

  Description

The retention period setting, specified in days. For more information, see Setting Audit Log Retention Period <https://docs.cloud.oracle.com/iaas/Content/Audit/Tasks/settingretentionperiod.htm>.

  Available Commands

•   get

•   update

  get

•   Description

•   Usage

•   Required Parameters

•   Optional Parameters

•   Global Parameters

•   Example using required parameter

  Description

Get the configuration

  Usage

oci audit config get [OPTIONS]

  Required Parameters

--compartment-id, -c [text]

    ID of the root compartment (tenancy)

  Optional Parameters

--from-json [text]

    Provide input to this command as a JSON document from a file using the file://path-to/file syntax.

    The --generate-full-command-json-input option can be used to generate a sample json file to be used with this command option. The key names are pre-populated and match the command option names (converted to camelCase format, e.g. compartment-id –> compartmentId), while the values of the keys need to be populated by the user before using the sample file as an input to this command. For any command option that accepts multiple values, the value of the key can be a JSON array.

    Options can still be provided on the command line. If an option exists in both the JSON document and the command line then the command line specified value will be used.

    For examples on usage of this option, please see our “using CLI with advanced JSON options” link: https://docs.cloud.oracle.com/iaas/Content/API/SDKDocs/cliusing.htm#AdvancedJSONOptions

  Global Parameters

Use oci --help for help on global parameters.

--auth-purpose, --auth, --cert-bundle, --cli-auto-prompt, --cli-rc-file, --config-file, --connection-timeout, --debug, --defaults-file, --endpoint, --generate-full-command-json-input, --generate-param-json-input, --help, --latest-version, --max-retries, --no-retry, --opc-client-request-id, --opc-request-id, --output, --profile, --proxy, --query, --raw-output, --read-timeout, --realm-specific-endpoint, --region, --release-info, --request-id, --version, -?, -d, -h, -i, -v

  Example using required parameter

Copy the following CLI commands into a file named example.sh. Run the command by typing “bash example.sh” and replacing the example parameters with your own.

Please note this sample will only work in the POSIX-compliant bash-like shell. You need to set up the OCI configuration <https://docs.oracle.com/en-us/iaas/Content/API/SDKDocs/cliinstall.htm#configfile> and appropriate security policies <https://docs.oracle.com/en-us/iaas/Content/Identity/Concepts/policygetstarted.htm> before trying the examples.

    export compartment_id=<substitute-value-of-compartment_id> # https://docs.cloud.oracle.com/en-us/iaas/tools/oci-cli/latest/oci_cli_docs/cmdref/audit/config/get.html#cmdoption-compartment-id
    oci audit config get --compartment-id $compartment_id

  update

•   Description

•   Usage

•   Required Parameters

•   Optional Parameters

•   Global Parameters

•   Example using required parameter

  Description

Update the configuration

  Usage

oci audit config update [OPTIONS]

  Required Parameters

--compartment-id, -c [text]

    ID of the root compartment (tenancy)

--retention-period-days [integer]

    The retention period setting, specified in days. The minimum is 90, the maximum 365.

    Example:

    90

  Optional Parameters

--from-json [text]

    Provide input to this command as a JSON document from a file using the file://path-to/file syntax.

    The --generate-full-command-json-input option can be used to generate a sample json file to be used with this command option. The key names are pre-populated and match the command option names (converted to camelCase format, e.g. compartment-id –> compartmentId), while the values of the keys need to be populated by the user before using the sample file as an input to this command. For any command option that accepts multiple values, the value of the key can be a JSON array.

    Options can still be provided on the command line. If an option exists in both the JSON document and the command line then the command line specified value will be used.

    For examples on usage of this option, please see our “using CLI with advanced JSON options” link: https://docs.cloud.oracle.com/iaas/Content/API/SDKDocs/cliusing.htm#AdvancedJSONOptions

  Global Parameters

Use oci --help for help on global parameters.

--auth-purpose, --auth, --cert-bundle, --cli-auto-prompt, --cli-rc-file, --config-file, --connection-timeout, --debug, --defaults-file, --endpoint, --generate-full-command-json-input, --generate-param-json-input, --help, --latest-version, --max-retries, --no-retry, --opc-client-request-id, --opc-request-id, --output, --profile, --proxy, --query, --raw-output, --read-timeout, --realm-specific-endpoint, --region, --release-info, --request-id, --version, -?, -d, -h, -i, -v

  Example using required parameter

Copy the following CLI commands into a file named example.sh. Run the command by typing “bash example.sh” and replacing the example parameters with your own.

Please note this sample will only work in the POSIX-compliant bash-like shell. You need to set up the OCI configuration <https://docs.oracle.com/en-us/iaas/Content/API/SDKDocs/cliinstall.htm#configfile> and appropriate security policies <https://docs.oracle.com/en-us/iaas/Content/Identity/Concepts/policygetstarted.htm> before trying the examples.

    export compartment_id=<substitute-value-of-compartment_id> # https://docs.cloud.oracle.com/en-us/iaas/tools/oci-cli/latest/oci_cli_docs/cmdref/audit/config/update.html#cmdoption-compartment-id
    export retention_period_days=<substitute-value-of-retention_period_days> # https://docs.cloud.oracle.com/en-us/iaas/tools/oci-cli/latest/oci_cli_docs/cmdref/audit/config/update.html#cmdoption-retention-period-days
    oci audit config update --compartment-id $compartment_id --retention-period-days $retention_period_days

  event

  Description

All the attributes of an audit event. For more information, see Viewing Audit Log Events <https://docs.cloud.oracle.com/iaas/Content/Audit/Tasks/viewinglogevents.htm>.

  Available Commands

•   list

  list

•   Description

•   Usage

•   Required Parameters

•   Optional Parameters

•   Global Parameters

•   Example using required parameter

  Description

Returns all the audit events processed for the specified compartment within the specified time range.

  Usage

oci audit event list [OPTIONS]

  Required Parameters

--compartment-id, -c [text]

    The OCID <https://docs.cloud.oracle.com/Content/General/Concepts/identifiers.htm> of the compartment.

--end-time [datetime]

    Returns events that were processed before this end date and time, expressed in RFC 3339 <https://tools.ietf.org/html/rfc3339> timestamp format. For example, a start value of 2017-01-01T00:00:00Z and an end value of 2017-01-02T00:00:00Z will retrieve a list of all events processed on January 1, 2017. Similarly, a start value of 2017-01-01T00:00:00Z and an end value of 2017-02-01T00:00:00Z will result in a list of all events processed between January 1, 2017 and January 31, 2017. You can specify a value with granularity to the minute. Seconds (and milliseconds, if included) must be set to 0. The following datetime formats are supported:

  UTC with microseconds

Format: YYYY-MM-DDTHH:mm:ss.ssssssTZD
Example: 2017-09-15T20:30:00.123456Z
UTC with milliseconds
***********************
.. code::
    Format: YYYY-MM-DDTHH:mm:ss.sssTZD
    Example: 2017-09-15T20:30:00.123Z
UTC without milliseconds
**************************
.. code::
    Format: YYYY-MM-DDTHH:mm:ssTZD
    Example: 2017-09-15T20:30:00Z
UTC with minute precision
**************************
.. code::
    Format: YYYY-MM-DDTHH:mmTZD
    Example: 2017-09-15T20:30Z

  Timezone with microseconds

Format: YYYY-MM-DDTHH:mm:ssTZD
Example: 2017-09-15T12:30:00.456789-08:00, 2017-09-15T12:30:00.456789-0800
Timezone with milliseconds
***************************
.. code::
    Format: YYYY-MM-DDTHH:mm:ssTZD
    Example: 2017-09-15T12:30:00.456-08:00, 2017-09-15T12:30:00.456-0800
Timezone without milliseconds
*******************************
.. code::
    Format: YYYY-MM-DDTHH:mm:ssTZD
    Example: 2017-09-15T12:30:00-08:00, 2017-09-15T12:30:00-0800
Timezone with minute precision
*******************************
.. code::
    Format: YYYY-MM-DDTHH:mmTZD
    Example: 2017-09-15T12:30-08:00, 2017-09-15T12:30-0800
Short date and time
********************
The timezone for this date and time will be taken as UTC (Needs to be surrounded by single or double quotes)
.. code::
    Format: 'YYYY-MM-DD HH:mm' or "YYYY-MM-DD HH:mm"
    Example: '2017-09-15 17:25'
Date Only
**********
This date will be taken as midnight UTC of that day
.. code::
    Format: YYYY-MM-DD
    Example: 2017-09-15
Epoch seconds
**************
.. code::
    Example: 1412195400

--start-time [datetime]

    Returns events that were processed at or after this start date and time, expressed in RFC 3339 <https://tools.ietf.org/html/rfc3339> timestamp format. For example, a start value of 2017-01-15T11:30:00Z will retrieve a list of all events processed since 30 minutes after the 11th hour of January 15, 2017, in Coordinated Universal Time (UTC). You can specify a value with granularity to the minute. Seconds (and milliseconds, if included) must be set to 0. The following datetime formats are supported:

  UTC with microseconds

Format: YYYY-MM-DDTHH:mm:ss.ssssssTZD
Example: 2017-09-15T20:30:00.123456Z
UTC with milliseconds
***********************
.. code::
    Format: YYYY-MM-DDTHH:mm:ss.sssTZD
    Example: 2017-09-15T20:30:00.123Z
UTC without milliseconds
**************************
.. code::
    Format: YYYY-MM-DDTHH:mm:ssTZD
    Example: 2017-09-15T20:30:00Z
UTC with minute precision
**************************
.. code::
    Format: YYYY-MM-DDTHH:mmTZD
    Example: 2017-09-15T20:30Z

  Timezone with microseconds

Format: YYYY-MM-DDTHH:mm:ssTZD
Example: 2017-09-15T12:30:00.456789-08:00, 2017-09-15T12:30:00.456789-0800
Timezone with milliseconds
***************************
.. code::
    Format: YYYY-MM-DDTHH:mm:ssTZD
    Example: 2017-09-15T12:30:00.456-08:00, 2017-09-15T12:30:00.456-0800
Timezone without milliseconds
*******************************
.. code::
    Format: YYYY-MM-DDTHH:mm:ssTZD
    Example: 2017-09-15T12:30:00-08:00, 2017-09-15T12:30:00-0800
Timezone with minute precision
*******************************
.. code::
    Format: YYYY-MM-DDTHH:mmTZD
    Example: 2017-09-15T12:30-08:00, 2017-09-15T12:30-0800
Short date and time
********************
The timezone for this date and time will be taken as UTC (Needs to be surrounded by single or double quotes)
.. code::
    Format: 'YYYY-MM-DD HH:mm' or "YYYY-MM-DD HH:mm"
    Example: '2017-09-15 17:25'
Date Only
**********
This date will be taken as midnight UTC of that day
.. code::
    Format: YYYY-MM-DD
    Example: 2017-09-15
Epoch seconds
**************
.. code::
    Example: 1412195400

  Optional Parameters

--all

    Fetches all pages of results.

--from-json [text]

    Provide input to this command as a JSON document from a file using the file://path-to/file syntax.

    The --generate-full-command-json-input option can be used to generate a sample json file to be used with this command option. The key names are pre-populated and match the command option names (converted to camelCase format, e.g. compartment-id –> compartmentId), while the values of the keys need to be populated by the user before using the sample file as an input to this command. For any command option that accepts multiple values, the value of the key can be a JSON array.

    Options can still be provided on the command line. If an option exists in both the JSON document and the command line then the command line specified value will be used.

    For examples on usage of this option, please see our “using CLI with advanced JSON options” link: https://docs.cloud.oracle.com/iaas/Content/API/SDKDocs/cliusing.htm#AdvancedJSONOptions

--page [text]

    For list pagination. The value of the opc-next-page response header from the previous “List” call. For important details about how pagination works, see List Pagination <https://docs.cloud.oracle.com/iaas/Content/API/Concepts/usingapi.htm#nine>.

--skip-deserialization

    Skips deserializing service response into python sdk response models and returns as plain JSON object.

--stream-output

    Print output to stdout as it is fetched so the full response is not stored in memory. This only works with --all.

  Global Parameters

Use oci --help for help on global parameters.

--auth-purpose, --auth, --cert-bundle, --cli-auto-prompt, --cli-rc-file, --config-file, --connection-timeout, --debug, --defaults-file, --endpoint, --generate-full-command-json-input, --generate-param-json-input, --help, --latest-version, --max-retries, --no-retry, --opc-client-request-id, --opc-request-id, --output, --profile, --proxy, --query, --raw-output, --read-timeout, --realm-specific-endpoint, --region, --release-info, --request-id, --version, -?, -d, -h, -i, -v

  Example using required parameter

Copy the following CLI commands into a file named example.sh. Run the command by typing “bash example.sh” and replacing the example parameters with your own.

Please note this sample will only work in the POSIX-compliant bash-like shell. You need to set up the OCI configuration <https://docs.oracle.com/en-us/iaas/Content/API/SDKDocs/cliinstall.htm#configfile> and appropriate security policies <https://docs.oracle.com/en-us/iaas/Content/Identity/Concepts/policygetstarted.htm> before trying the examples.

    export compartment_id=<substitute-value-of-compartment_id> # https://docs.cloud.oracle.com/en-us/iaas/tools/oci-cli/latest/oci_cli_docs/cmdref/audit/event/list.html#cmdoption-compartment-id
    export end_time=<substitute-value-of-end_time> # https://docs.cloud.oracle.com/en-us/iaas/tools/oci-cli/latest/oci_cli_docs/cmdref/audit/event/list.html#cmdoption-end-time
    export start_time=<substitute-value-of-start_time> # https://docs.cloud.oracle.com/en-us/iaas/tools/oci-cli/latest/oci_cli_docs/cmdref/audit/event/list.html#cmdoption-start-time
    oci audit event list --compartment-id $compartment_id --end-time $end_time --start-time $start_time

AUTHOR
Oracle

COPYRIGHT
2016, 2024, Oracle