everpure.flasharray.purefa_audits module – List FlashArray Audit Events

Note

This module is part of the everpure.flasharray collection (version 1.46.0).

You might already have this collection installed if you are using the ansible package. It is not included in ansible-core. To check whether it is installed, run ansible-galaxy collection list.

To install it, use: ansible-galaxy collection install everpure.flasharray. You need further requirements to be able to use this module, see Requirements for details.

To use it in a playbook, specify: everpure.flasharray.purefa_audits.

New in everpure.flasharray 1.29.0

Synopsis

  • List audit events based on filters provided

Requirements

The below requirements are needed on the host that executes this module.

  • python >= 3.3

  • purestorage >= 1.19

  • py-pure-client >= 1.88.0

  • netaddr

  • requests

  • pycountry

  • urllib3

Parameters

Parameter

Comments

api_token

string

FlashArray API token for admin privileged user.

client_id

string

added in everpure.flasharray 1.43.0

ID of the API Client that issues the identity token.

Used with private_key_file.

context

string

added in everpure.flasharray 1.39.0

Name of fleet member on which to perform the operation.

This requires the array receiving the request is a member of a fleet and the context name to be a member of the same fleet.

Default: ""

disable_warnings

boolean

added in everpure.flasharray 1.29.0

Disable insecure certificate warnings in debug logs

Choices:

  • false ← (default)

  • true

fa_url

string

FlashArray management IPv4 address or Hostname.

id_token

string

added in everpure.flasharray 1.43.0

A pre-signed JWT to authenticate with, as an alternative to api_token.

The token is exchanged by the array for a short-lived access token.

Requires a matching API Client to be registered on the array (see everpure.flasharray.purefa_apiclient).

issuer

string

added in everpure.flasharray 1.43.0

The API Client’s trusted identity issuer registered on the array.

Used with private_key_file.

key_id

string

added in everpure.flasharray 1.43.0

Key ID of the API Client that issues the identity token.

Used with private_key_file.

private_key_file

string

added in everpure.flasharray 1.43.0

Path to the PEM RSA private key used to sign an identity token, as an alternative to api_token.

Requires client_id, key_id, issuer and username.

private_key_password

string

added in everpure.flasharray 1.43.0

Password protecting private_key_file, if encrypted.

start

string

Only audit events logged at or after this date and time are returned.

Interpreted in the timezone given by timezone, or in the timezone resolved when timezone is not provided.

If not provided epoch is assumed

Expected format “YYYY-MM-DD hh:mm:ss”

timezone

string

The timezone in which start is interpreted and in which the time of each returned audit event is reported, for example America/New_York.

If not provided, the timezone configured on the FlashArray is used (Purity//FA 6.5.3 and later). On older Purity versions the local timezone of the host running the module is used instead, falling back to UTC.

username

string

added in everpure.flasharray 1.43.0

Username the issued token should be granted to.

Must be a valid user on the array. Used with private_key_file.

Notes

Note

  • This module requires the py-pure-client Python library.

  • Additional Python libraries may be required for specific modules.

  • You must set PUREFA_URL and PUREFA_API environment variables if fa_url and api_token arguments are not passed to the module directly.

  • Token-based authentication (id_token, or private_key_file with client_id, key_id, issuer and username) may be used as an alternative to api_token, and requires a matching API Client registered on the array via everpure.flasharray.purefa_apiclient.

Examples

- name: Show all audit events that started after the specified date/time and TZ
  purefa_audits:
    start: "2024-06-29 12:31:34"
    timezone: "America/New_York"
    fa_url: 10.10.10.2
    api_token: 89a9356f-c203-d263-8a89-c229486a13ba

- name: Show all audit events that have been logged by the array (to the internal limit of the array)
  purefa_audits:
    fa_url: 10.10.10.2
    api_token: 89a9356f-c203-d263-8a89-c229486a13ba

Return Values

Common return values are documented here, the following are the fields unique to this module:

Key

Description

purefa_audits

dictionary

The audit events read from the array, keyed by audit record name.

A field the array did not record for an event is returned as none.

Returned: always

Sample: {"1044": {"arguments": "--size 10G vol1", "command": "purevol", "origin": "arrayA", "subcommand": "create", "time": "2024-06-29 12:31:34 EDT", "user": "pureuser"}}

arguments

string

The arguments provided to the command.

Returned: success

Sample: "--size 10G vol1"

command

string

The top level command, which by convention starts with pure.

Returned: success

Sample: "purevol"

origin

string

The name of the array from which the command originated.

Returned: success

Sample: "arrayA"

subcommand

string

The command and subcommand combination determines which action the user attempted to perform.

Returned: success

Sample: "create"

time

string

When the command was run, as YYYY-MM-DD HH:MM:SS ZONE in the timezone given by timezone or the timezone resolved when timezone is not provided.

Returned: success

Sample: "2024-06-29 12:31:34 EDT"

user

string

The user who ran the command.

Returned: success

Sample: "pureuser"

Authors

  • Everpure Ansible Team (@sdodsley)