[ZBX-4616] Problems in the "Administration->Audit" report Created: 2012 Feb 06  Updated: 2017 May 30  Resolved: 2015 Oct 26

Status: Closed
Project: ZABBIX BUGS AND ISSUES
Component/s: Frontend (F)
Affects Version/s: 2.0.0rc1
Fix Version/s: None

Type: Incident report Priority: Minor
Reporter: Igor Danoshaites (Inactive) Assignee: Unassigned
Resolution: Duplicate Votes: 4
Labels: None
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified

Issue Links:
Duplicate
duplicates ZBX-2815 Missing audit records for different a... Closed

 Description   

Some missing records in the "Administration->Audit" report:

1. There are no records in the "Administration->Audit" report for the "Logout" action;

2. There are no records in the "Administration->Audit" report for the "Enable" and "Disable" actions. Instead of it there are the following records, for example, when the
enabling/disabling host: "Host Updated 10054 H1 hosts.status: 0 => 1"



 Comments   
Comment by Igor Danoshaites (Inactive) [ 2012 Feb 07 ]

(3). No records for "Add Item" action

Comment by richlv [ 2012 Feb 08 ]

(2) is duplicate of ZBX-4608

Comment by Igor Danoshaites (Inactive) [ 2012 Feb 08 ]

(4). No records for the "Update Item" action, but when enabling / disabling item in the "Audit" report in the "Details" column for the "Update item" action will appear the following info: items.status: 0 => 1

(5). No records in the "Audit" report for the "Enable/Disable Trigger", instead of it there are the following records when enabling / disabling trigger for the "Update action": "triggers.status: 0 => 1"

(6). No records in the "Audit" report for the "Enable/Disable Action", instead of it there are the following records for the "Update" operation: "Actions [11] disabled";

(7). No records in the "Audit" report for the "Enable/Disable Application", also there are NO appropriate records for the "Update Application", also no records in the DB in the "auditlog" table;

(8). There are no records in the DB in the "auditlog" table and in the "Audit" report for the following actions: Add / Update Item, but there are records for the "Delete Item" operation;

(9). No records in the "auditlog" table for the "Delete Action" operation, and hence no records in the "Audit Log" report for such operation;

(10). No any records in the "auditlog" table and in the "Audit" report for the "Enable / Disable application" operations (no even for the "Update Application" category;

(11). No records in the DB in the "auditlog" table and in the "Audit" report for the "Delete graph" operation;

(12). There is set incorrect action number in the auditlog.action field when adding new image: there should be "0", but "1" is written. Value "1" is for the update operation, but not for the Add operation;

(13). There is set incorrect action number in the auditlog.action field when deleting image: there should be "2", but "1" is written. Value "1" is for the Update operation, but not for the Delete operation;

(14). There is no discovery rule name in the "details" column in the DB when deleting discovery rule.
Example: at this moment is shown "[4]", but should be shown "[4] <discovery_rule_name> deleted".

(15). No info about discovery rule status change (when enabling / disabling Drule) in the "auditlog.details" column.
I think that this could be implemented in the same way as it is implemented for the audit of "Actions": when disabling drule, in the "auditlog.details" column should be written the following info: "Drule "[5] drule1" disabled" or "Drule "[5] drule1" enabled".
At this moment in the auditlog is NOT visible what exactly has been performed- drule disabled or enabled, only "drule updated";

(16). Auditlog for the resourcetype=7 (AUDIT_RESOURCE_GRAPH_ELEMENT) is NOT implemented -there are no records at all for such resource;

(17). Incorrect description in the "auditlog.resourcename" when deleting globalmacro: there is written "Array ⇒ abcd" (and hence in the "Audit" report in the "description" column is visible the following text: "Array ⇒ abcd", this is not correct. Should be written the following text: "{$A} ⇒ abcd";

(18). No appropriate record in the "Administration->Audit" report about Media type deletion, there is also no record in the DB in the "auditlog" table for this operation;

(19). No records in the "Administration->Audit" report for the "enable/disable proxy" operation, but there is record in the DB for this operation for the "Host" resource type (auditlog.resourcetype=4 (host) and auditlog.action=1 (update) in this case);

(20). No appropriate record in the "Administration->Audit" report about enabling / disabling Media type, there is also no record in the DB in the "auditlog" table for this operation;

(21). No record in the "Administration->Audit" report for the slide show delete operation, there is also no any record in the DB for this operation (no record for "delete" operation and no record for "update" operation, so this operation is simply ignored);

(22). No records (nor in the Administration->Audit report, nor in the "auditlog" table in the DB) for the "Template update" operation;

(23). When deleting template, in the "auditlog" table in the DB in the "resourcetype" column will be recorded incorrect value: there should be value "30" (AUDIT_RESOURCE_TEMPLATE), but is recorded value "4" (AUDIT_RESOURCE_HOST). But when adding template, in the "auditlog."resourcetype" column will be recorded correct value "30";

(24). When cloning existing host (both clone and full clone operations) together with items, triggers and graphs, in the "auditlog" table will be no info about cloned items and graphs, only about cloned triggers;

(25). Would be nice in the "Administration->Audit->Actions" report in the "Type" column for the executed commands show row "Command", as at this moment for the commands there is empty value, but for the other types (email, Jabber, etc) there will be shown value from the "media_type.description" column;

Comment by Oleksii Zagorskyi [ 2015 Aug 12 ]

additionally to (6):
(maybe similar thing is described already)
In 2.4.5 I got following audit records when I do a single click on enable|disable link in actions list:

2015-08-12 13:22:18	Admin	127.0.0.1	Action	Updated	0		 Actions [3] enabled
2015-08-12 13:22:15	Admin	127.0.0.1	Action	Updated	0		 Actions [3] disabled

But when I open an action settings and set|unset corresponding checkbox (and only it) - I got next records:

2015-08-12 13:27:18	Admin	127.0.0.1	Action	Updated	0		Name: Maintenance test
2015-08-12 13:25:20	Admin	127.0.0.1	Action	Updated	0		Name: Maintenance test

Looks indeed not very user friendly as it's not consistent when users perform only action state change.
Ideally audit records should be the same disregarding on how uses enabled/disabled action (or any other resource).

Comment by richlv [ 2015 Oct 26 ]

let's close this as a duplicate then

Generated at Thu Apr 25 17:02:58 EEST 2024 using Jira 9.12.4#9120004-sha1:625303b708afdb767e17cb2838290c41888e9ff0.