-
Change Request
-
Resolution: Unresolved
-
Minor
-
None
-
2.0.9, 2.2.1
The auditlog table lends itself to fairly simple reporting that gives nice insights into how Zabbix is being used (and where lots of changes may be taking place).
For example (MySQL) here's some relatively simple queries that give some simple summary info about users, actions, and resources:
(Note these are the last 24h based on `auditlog:clock`)
Audit info by user:
SELECT COUNT(al.auditid), u.alias, al.userid FROM auditlog al JOIN users u ON u.userid=al.userid WHERE al.clock > UNIX_TIMESTAMP(SYSDATE() - INTERVAL 1 DAY) GROUP BY al.userid;
Audit info by user's actions:
SELECT COUNT(al.auditid), al.action, u.alias, al.userid FROM auditlog al JOIN users u ON u.userid=al.userid WHERE al.clock > UNIX_TIMESTAMP(SYSDATE() - INTERVAL 1 DAY) GROUP BY al.userid, al.action;
Audit info by action and resources:
SELECT COUNT(al.auditid), al.action, al.resourcetype FROM auditlog al WHERE al.clock > UNIX_TIMESTAMP(SYSDATE() - INTERVAL 1 DAY) GROUP BY al.action, al.resourcetype;
Auditlog range:
SELECT FROM_UNIXTIME(MIN(clock)), FROM_UNIXTIME(MAX(clock)) FROM auditlog;