Use and manage the intra-container operation audit feature to collect and analyze audit logs - Container Service for Kubernetes

Audit commands that organization members or applications run inside containers to detect threats before they escalate.kubectl exec or shell access to detect threats before they escalate.

Enable the feature, view audit reports and logs, configure alerts, and disable the feature when no longer needed.

This is a whitelist feature. Submit a ticket to enable access before proceeding.

Billing

The feature itself is free. After enablement, Simple Log Service (SLS) usage fees apply. For pricing details, see Billing overview.

Limitations

Cluster types:ACK managed Pro cluster, ACK managed Basic cluster, and ACK dedicated cluster.

Operating system and kernel: Alibaba Cloud Linux, Ubuntu, or ContainerOS with a kernel version later than 4.19.

OS	Minimum cluster version	Additional requirements
Alibaba Cloud Linux	1.18	—
ContainerOS	1.24	—
Ubuntu	1.30 (see Manually upgrade a cluster)	Automatic OS upgrades must be disabled during node initialization. The `/etc/resolv.conf` symlink must point to `/run/systemd/resolve/stub-resolv.conf`, and DNS must be configured by DHCP. Cloud Parallel File System (CPFS) persistent volumes (PVs), image acceleration plugins, and security hardening are not supported.

Step 1: Enable the feature

Enabling the feature installs two add-ons:

Log collection add-on — collects audit logs, sends them to SLS, and creates a default audit report. See Log collection component.
ack-advanced-audit add-on — audits operations within containers.

A Logstore named advaudit-${cluster_id} is created in the log collection project. Audit logs are retained for 180 days by default. To adjust the retention period, see Manage a Logstore.

To enable the feature:

Log in to the ACK console and click Clusters in the left navigation pane.
Click the name of your cluster. In the left navigation pane, choose Security > Audit.
On the Audit page, click the Container Audit tab and then click Install.

Step 2: View audit reports

On the Audit page, click the Container Audit tab and then click the Container Audit Overview tab.

The overview report shows:

Pod access frequency and pod details.
Kubernetes accounts, commands run after access, and common threats.

Step 3: View detailed log records

Two methods are available depending on your goal:

Method	Best for
Audit report page	Quickly reviewing a recent individual event
Logstore page with search statements	Historical queries and complex filters

View logs from the audit report page

On the Container Audit Overview tab, scroll to the Suspicious Process Event List section. Click a link in the traceId or eventId column:

traceId — shows all commands run after a container was accessed.
eventId — shows the details of one specific command.

View logs from the Logstore page

Log in to the ACK console and click Clusters in the left navigation pane.
Click your cluster name. In the left navigation pane, choose Security > Audit.
On the Audit page, click the Container Audit tab and then click the Query Container Audit Logs tab.
Enter a search statement in the search box. Query by pod — replace <namespace> and <pod_name> with actual values:
Category
Field
Description
Pod
k8s.pod.namespace
Namespace of the pod
Pod
k8s.pod.name
Name of the pod
Process
process.name
Name of the process that was executed
```
* and k8s.pod.namespace: <namespace> and k8s.pod.name: <pod_name>
```
Query by process name — replace <name> with the program name:
```
* and process.name: <name>
```
The table above lists key query fields. For all supported methods, see Log search and analysis.
Set a time range and click Search & Analyze.

(Optional) Step 4: Configure alerts

Use the SLS alerting feature to monitor container operations in real time. Supported alert channels include DingTalk chatbot, custom webhooks, and the notification center.

For alert configuration methods, see Alerting.

Disable the feature

Uninstalling the ack-advanced-audit add-on disables the feature.

Important

Disabling the feature does not delete the advaudit-${cluster_id} Logstore. If you leave it in place, SLS storage charges continue to accrue. To stop billing, log in to the SLS console and manually delete the Logstore. See Stop billing for or delete a Logstore.

To uninstall the add-on:

Log in to the ACK console and click Clusters in the left navigation pane.
Click your cluster name. In the left navigation pane, click Add-ons.
On the Add-ons page, find ack-advanced-audit and click Uninstall.

Next steps

See ack-advanced-audit for release notes and details.
To audit API Server operations (who did what to which resource and when), see Use the cluster API Server audit feature.

Category	Field	Description
Pod	`k8s.pod.namespace`	Namespace of the pod
Pod	`k8s.pod.name`	Name of the pod
Process	`process.name`	Name of the process that was executed