Skip to main content
FOSDEM PWA

CephFS command auditing framework for quicker cluster rescue

UB4.136 | Day 1 | 13:25 - 13:55 | Speakers: Venky Shankar, Dhairya Parmar

CephFS command auditing framework for quicker cluster rescue
A picture of a devroom at FOSDEM 2024
Open in browser

Notes

Abstract

Have you ever found your CephFS setup mysteriously broken and had no clue how it got there? Maybe someone ran a CLI command in haste, or a misstep happened weeks ago. We have suspicions, but can’t really recall what might've splintered the system. That changes now.

In this talk, we introduce a robust command history logging mechanism for CephFS: a persistent log of CephFS commands and standalone tool invocations, backed by LibCephSQLite. Think of it as “shell history,” but purpose-built for Ceph with time ranges, filters, and structured metadata. Every ceph fs subvolume rm, every ceph config set, every mischievous --force — now recorded, timestamped, and queryable.

Want to know what was run last Tuesday at 3 AM? Or who triggered that well-intentioned-but-catastrophic disaster recovery script? Or just list the last 100 commands before things exploded? It’s all there. This helps debug incidents faster, provides a clear audit trail, and opens the door to proactive traceability. So, when things go sideways around CephFS and no one's sure why — this history has your back.

This is CephFS-first but not CephFS-only. The path to full cluster command traceability starts here.

Speakers

Venky Shankar

Venky Shankar leads the Ceph File System (CephFS) development team at IBM. Venky has primarily worked on CephFS since 2018 and is a member of the Ceph Steering Committee. He has worked on open source projects since the last 18 years.

Dhairya Parmar

Dhairya is an open-source enthusiast currently part of the CephFS team. He primarily works on the CephFS client, MDS (Metadata Server), and the manager NFS module. Before joining Ceph, he interned at Red Hat, where he worked on converting legacy sudo-SSSD bash scripts into efficient Python code for the SSSD (System Security Services Daemon) project. He holds a bachelor's degree in computer science.

Notice: The placeholder video image is licensed under CC BY-SA 4.0. The original image can be found hereChanges made to the image are: Cropped the image to a new ratio, part of the image was cut off.