diff --git a/vault/request_handling.go b/vault/request_handling.go index 1209c8df59e2..eeeda8ae6d55 100644 --- a/vault/request_handling.go +++ b/vault/request_handling.go @@ -534,18 +534,23 @@ func (c *Core) handleCancelableRequest(ctx context.Context, ns *namespace.Namesp } // Create an audit trail of the response + if !isControlGroupRun(req) { - logInput := &logical.LogInput{ - Auth: auth, - Request: req, - Response: auditResp, - OuterErr: err, - NonHMACReqDataKeys: nonHMACReqDataKeys, - NonHMACRespDataKeys: nonHMACRespDataKeys, - } - if auditErr := c.auditBroker.LogResponse(ctx, logInput, c.auditedHeaders); auditErr != nil { - c.logger.Error("failed to audit response", "request_path", req.Path, "error", auditErr) - return nil, ErrInternalError + switch req.Path { + case "sys/replication/dr/status", "sys/replication/performance/status", "sys/replication/status": + default: + logInput := &logical.LogInput{ + Auth: auth, + Request: req, + Response: auditResp, + OuterErr: err, + NonHMACReqDataKeys: nonHMACReqDataKeys, + NonHMACRespDataKeys: nonHMACRespDataKeys, + } + if auditErr := c.auditBroker.LogResponse(ctx, logInput, c.auditedHeaders); auditErr != nil { + c.logger.Error("failed to audit response", "request_path", req.Path, "error", auditErr) + return nil, ErrInternalError + } } } @@ -976,16 +981,20 @@ func (c *Core) handleLoginRequest(ctx context.Context, req *logical.Request) (re return logical.ErrorResponse(ctErr.Error()), auth, retErr } - // Create an audit trail of the request. Attach auth if it was returned, - // e.g. if a token was provided. - logInput := &logical.LogInput{ - Auth: auth, - Request: req, - NonHMACReqDataKeys: nonHMACReqDataKeys, - } - if err := c.auditBroker.LogRequest(ctx, logInput, c.auditedHeaders); err != nil { - c.logger.Error("failed to audit request", "path", req.Path, "error", err) - return nil, nil, ErrInternalError + switch req.Path { + case "sys/replication/dr/status", "sys/replication/performance/status", "sys/replication/status": + default: + // Create an audit trail of the request. Attach auth if it was returned, + // e.g. if a token was provided. + logInput := &logical.LogInput{ + Auth: auth, + Request: req, + NonHMACReqDataKeys: nonHMACReqDataKeys, + } + if err := c.auditBroker.LogRequest(ctx, logInput, c.auditedHeaders); err != nil { + c.logger.Error("failed to audit request", "path", req.Path, "error", err) + return nil, nil, ErrInternalError + } } // The token store uses authentication even when creating a new token,