How to save lifecycle events

Is there a way to save Lifecycle event streams through /1.0/events into a file or database?
Preferably per project.

Will this do ?

lxc monitor --pretty --type=logging --loglevel=info > test.log - its abit verbose but might do, oddly lxc monitor doesn’t support a --format param

@ turtle0x1
It is simple and works. Though the Terminal hangs. By disconnecting the terminal from command (&), it could be applied for multiple projects or different sort of logging.

lxc monitor --pretty --type=logging --loglevel=info > info.log &
lxc monitor --pretty --type=logging --loglevel=iwarn > warn.log &

But the flag --project doesnt work!
lxc monitor --pretty --project=projectx or lxc monitor --pretty --project projectx
still logs default project. Bug?

Above might somehow work for CLI. Though my my question was how to catch it over Api /1.0/events.
It was announced that event type: Lifecycle : Shows an audit trail for specific actions occurring over LXD.
This might help me not sitting there and counting customer/project clicks for the sake of accounting, but try the audit grade lifecycle events!
And Api /1.0/events has the advantage that it produces streams when actions, whilst CLI creates a persistent process and redirects the output to file.

I tried lifecycle events but it didn’t give you what you wanted - from memory it appears bound by project.

This is really a task for a seperate program - LXDMosaic & some of the other web apps will record everything you & your users do - but they require all your users use that program.

I think your going to have to parse the file and write your own program.

@stgraber a --format flag on the lxc monitor command its probably not a bad idea - parsing logs is a pain & offering a JSON is probably pretty sane. (well I think so, you know it all far to well for me to argue)

I am sure, a third party can log all actions, but that requires additional resources, which is redundant when you know that LXD is already logging everything. The lifecycle event types now is a chance to parse and feed it at once to an external further processor.
I just tried the life cycle and it seems to work (CLI) and less verbose, when you use lifecycle flag:

lxc monitor --pretty --type=lifecycle --project 101

> INFO[07-21|19:59:28] Action: instance-created, Source: /1.0/instances/by?project=101

Question: type: lifecycle
Can that be more specific by using sort of action or array of actions? “instance-created’, image-created’ …”
I thinks, that can be parsed. It is sortable by project and by lifecycle event keys, you can sort them.
Point is, catching it live over api only and when it occurs in certain project.

I agree 3rd party app is to much.

But lxc monitor --project=N is to much per project - I agree you should be able to invoke one command that monitors all projects - its failing of LXD that you cant.

@stgraber is the person here, they / he can answer all that I can’t.

I just wanted to try and help between now and then - you are going to be writing a program regardless of who’s solution you use. You dont’ gather logs without the intention of loading them into a web interface or a pipeline that goes to a web interface / report eventually.

lxc monitor --project=* will get you all projects

I’ll send a PR to add a --all-projects which uses that so you don’t need to pass the odd wildcard :wink: