Audit log queue message missing IP address of caller

[bedla]

Is your feature request related to a problem? Please describe.

Hi,
we are processing audit log messages for various user actions. What we are missing is IP address of the caller.
Is it possible to support it?
Thank you
Ivos

Describe the solution you'd like

Have IP address in messages generate by https://www.rabbitmq.com/docs/logging#internal-events

Describe alternatives you've considered

No response

Additional context

No response

[michaelklishin]

@bedla most events do not have any IP address associated with them.

You haven't clarified what a "caller" is or what events you are referring to. We do not guess in this community.

For client connections, the actual client IP address often cannot be known (due to the number of intermediaries/proxies/load balancers used), and the internal event subsystem cannot make any assumptions about the Proxy Protocol use.

[bedla]

Thx for response.

Ad caller) For our audit use-case it is about somebody (or something) in the network calling RabbitMQ API. We usually have topology-operator to do it, but in rare cases some human can make changes using cli/UI/api and this is what want to have audited because of regulatory requirments.

Ad events) I would expect all of them described in the docs, like user.authentication.failure, permission.created, ...
I look at it that when somebody connects to RabbitMQ and does some API calls, then we always see IP for particular action and it would be handy to know this IP in the event (and make alerting more clever).

Ad guessing) I agree, guessing is always bad. So let's have discussion.

Ad proxy) I agree that when Proxy is used, then there might be IP hidden.

In the docs there is sentense "The protocol makes servers such as RabbitMQ aware of the actual client IP address when connections go over a proxy" and if I get it correctly, then it means that if Proxy mode is enabled, then rabbit knows about client IP, right?
In this context I do not get your comment "actual client IP address often cannot be known" / it seems to me that it is contra each other OR your point of view is when incompatible or too many intermediaries used?
If yes, then I think it is responsibility of user to have properly configured "whole path" and not problem of the RabbitMQ that it sees (and reports) somehow wrong IP, right?

I hope I clarified it?

Thx

Ivos

[michaelklishin]

Internal events contain an acting username. For CLI tools, where there is no user context, the acting username is specified as "CLI".

Proxy Protocol

Client connections will be notified of the actual client IP by the proxy. That allows all the emitted metrics, logged messages and CLI tools responses to include an actual client IP, nothing beyond that.

[bedla]

Thx for explanation.

I understand that currently it is not possible to have this information for some events. For example in user.authentication.success I can see in headers connection_name -> 172.17.0.1:45286 -> 172.17.0.3:5672.

Maybe proposal for future feature might be that in case of call-action starts in the context where we can see IP address (standard or proxied one) this information will bubble to logged event?

Or maybe some correlation-id to see which events are from same connection (with ip-address)?

What do you think? (I do not know what is best solution, but in general you do understand what we are trying to achieve, right?).

Thank you

Ivos

[michaelklishin]

Adding IP addresses to internal log events is not a priority for our small team. RabbitMQ is open source software, so those who need this feature will have to contribute it or pay someone else to contribute it.

[bedla]

Thx, maybe in the future somebody will find this feature usefull and make PR or pay for it.