Bastionhost O&M audit types, content, and retention - Bastionhost

Bastionhost audits system operations such as logons and configuration changes, and records asset O&M sessions including session videos and commands.

Audit types

Bastionhost operation audit

Bastionhost records operations such as logons and configuration changes. You can view operation types, users, and source IP addresses by using the following methods:

View operation details on the Operation Logs page of your bastion host. Search for operation logs and view log details.
View operation details in the ActionTrail console. What is ActionTrail?

Asset session audit

Bastionhost generates a session record after each O&M session ends. You can play back the video recording and view session details.

Note

You can archive audit logs, including session command audit logs and operation logs, to Simple Log Service. Archive audit logs in Simple Log Service.
Auditors can monitor real-time SSH and RDP sessions when O&M engineers access assets through Bastionhost. Use the session interruption feature to block high-risk operations.

Audit content and retention period

Audit content	Description	Default retention period
Session audit	When an O&M session ends, a record is generated by protocol type on the Session Audit page. Supported protocols: SSH, RDP, MySQL, SQL Server, and PostgreSQL. On the Session Audit page, you can view session start and end times, the user who performed operations, and the target asset. Search for operation logs and view log details. Note Session videos are available only for SSH and RDP sessions.	Session video retention depends on your Bastionhost storage rule. Use the storage management feature. You can export session recordings to OSS. Export Session Recordings to OSS. Text-based audit records of commands are retained for 180 days.
Real-time monitoring	Auditors can monitor real-time SSH and RDP O&M sessions. Auditors can view session details for database O&M operations. If a user performs an unauthorized or high-risk operation during real-time monitoring, use session blocking to disconnect the user from the asset. Note Session blocking supports only SSH, RDP, and SFTP sessions. Real-time monitoring.	N/A.
Operation logs	Records of Bastionhost logons and configuration changes. Search for operation logs and view log details.	Retained for 180 days.
O&M reports	Administrators can filter O&M data by time range, including session size, O&M count, and O&M duration. Reports can be exported in Word, PDF, or HTML format. View and export O&M reports.	Reports from the previous 180 days can be exported.
Log backups	Command and file transfer audit records are backed up monthly, with daily incremental backups. Use the log backup feature.	Log backups are retained until the bastion host expires. Use the storage management feature. Note You can download log backups to a local computer.

Reference

Logs and audit-related issues