[ZBXNEXT-6470] Make audit log complete and reliable Created: 2021 Jan 26  Updated: 2025 Apr 07

Status: READY TO DEVELOP
Project: ZABBIX FEATURE REQUESTS
Component/s: Frontend (F)
Affects Version/s: None
Fix Version/s: 7.0.12rc1, 7.2.6rc1, 7.4.0rc1 (master)

Type: Change Request Priority: Trivial
Reporter: Rostislav Palivoda Assignee: Vladimirs Maksimovs
Resolution: Unresolved Votes: 18
Labels: None
Σ Remaining Estimate: Not Specified Remaining Estimate: Not Specified
Σ Time Spent: 100.5h Time Spent: Not Specified
Σ Original Estimate: Not Specified Original Estimate: Not Specified

Attachments: PNG File Screenshot from 2022-05-06 10-14-33.png     PNG File image-2023-05-31-14-11-03-423.png     PNG File image-2023-05-31-14-16-16-735.png    
Issue Links:
Causes
caused by ZBX-19803 Not logging in audit log when tag is ... Closed
Duplicate
is duplicated by ZBX-2815 Missing audit records for different a... Closed
Sub-task
depends on ZBXNEXT-6768 Implement audit for server (except fo... Closed
depends on ZBXNEXT-6802 Implement audit for server (linking t... Closed
depends on ZBXNEXT-6810 Implement audit on server (processing... Closed
depends on ZBXNEXT-6817 Implement audit for server (linking t... Closed
depends on ZBXNEXT-6830 Implement audit on server (processing... Closed
depends on ZBXNEXT-6855 Implement audit for server (linking t... Closed
depends on ZBXNEXT-6856 Implement audit for server (linking t... Closed
depends on ZBXNEXT-6857 Implement audit for server (linking t... Closed
depends on ZBXNEXT-6871 Implement audit on server (processin... Closed
depends on ZBXNEXT-6911 Implement audit for server (LLD - tri... Closed
depends on ZBXNEXT-6912 Implement audit for server (LLD - gra... Closed
depends on ZBXNEXT-6528 Audit log bulk operations performance... READY TO DEVELOP
depends on ZBX-19989 Server crashes after creating a Host ... Closed
depends on ZBX-19781 Server does not link host prototype i... Closed
depends on ZBX-19889 Server does not update trigger depend... Closed
depends on ZBX-19914 Server does not update many Web scena... Closed
depends on ZBX-20006 Server must not audit default DB values Closed
depends on ZBX-20014 Server audit must generate CUID durin... Closed
depends on ZBX-21857 Server and frontend inconsistently lo... Closed
depends on ZBXNEXT-6715 Make auditlog workable with new audit... Closed
depends on ZBXNEXT-6716 Item and web scenario history cleaning Closed
depends on ZBXNEXT-6717 Create API for regex Closed
depends on ZBXNEXT-6920 Implement audit for Action (API) Closed
depends on ZBX-21026 Some bugs in the new audit Confirmed
part of ZBX-20913 Runtime error importing templates Closed
Sub-Tasks:
Key
 Summary
 Type
 Status
 Assignee
ZBXNEXT-6471 Server audit log refactoring (PoC) Specification change (Sub-task) Closed Zabbix Development Team  
ZBXNEXT-6555 CUID С implementation Specification change (Sub-task) Closed Zabbix Development Team  
ZBXNEXT-6715 Make auditlog workable with new audit... Specification change (Sub-task) Closed Roberts Lataria  
ZBXNEXT-6716 Item and web scenario history cleaning Specification change (Sub-task) Closed Roberts Lataria  
ZBXNEXT-6717 Create API for regex Specification change (Sub-task) Closed Roberts Lataria  
ZBXNEXT-6718 Refactor logging of authentication Specification change (Sub-task) Closed Vladimirs Maksimovs  
ZBXNEXT-6775 Implementation of new audit log model... Specification change (Sub-task) Closed Vladimirs Maksimovs  
ZBXNEXT-6859 Logging deleted tokens when user was ... Specification change (Sub-task) Closed Roberts Lataria  
ZBXNEXT-6866 Implement audit for frontend (User gr... Specification change (Sub-task) Closed Roberts Lataria  
ZBXNEXT-6867 Implement audit for frontend (Templates) Specification change (Sub-task) Closed Vladimirs Maksimovs  
ZBXNEXT-6868 Implement audit for frontend (Host Gr... Specification change (Sub-task) Closed Vladimirs Maksimovs  
ZBXNEXT-6885 Implement audit for frontend (Media t... Specification change (Sub-task) Closed Andrejs Griščenko  
ZBXNEXT-6887 Implement audit for frontend (Schedul... Specification change (Sub-task) Closed Andrejs Griščenko  
ZBXNEXT-6889 Implement audit for frontend (Proxy) Specification change (Sub-task) Closed Alexander Vladishev  
ZBXNEXT-6890 Implement audit for frontend (Mainten... Specification change (Sub-task) Closed Vladimirs Maksimovs  
ZBXNEXT-6901 Implement audit for frontend (Modules) Specification change (Sub-task) Closed Andrejs Griščenko  
ZBXNEXT-6909 Implement audit for frontend (Setting... Specification change (Sub-task) Closed Andrejs Griščenko  
ZBXNEXT-6910 Implement audit for frontend (Dashboa... Specification change (Sub-task) Closed Roberts Lataria  
ZBXNEXT-6914 Implement audit for frontend (Iconmap... Specification change (Sub-task) Closed Roberts Lataria  
ZBXNEXT-6917 Implement audit for frontend (Global ... Specification change (Sub-task) Closed Roberts Lataria  
ZBXNEXT-6918 Implement audit for frontend (Script) Specification change (Sub-task) Closed Roberts Lataria  
ZBXNEXT-6920 Implement audit for Action (API) Specification change (Sub-task) Closed Andrejs Griščenko  
ZBXNEXT-6929 Implement audit for frontend (Correla... Specification change (Sub-task) Closed Roberts Lataria  
ZBXNEXT-6951 Implement audit for frontend (Services) Specification change (Sub-task) Closed Andrejs Verza  
ZBXNEXT-6959 Implement audit for frontend (Host pr... Specification change (Sub-task) Closed Vladimirs Maksimovs  
ZBXNEXT-6960 Implement audit for frontend (Web sce... Specification change (Sub-task) READY TO DEVELOP Vladimirs Maksimovs  
ZBXNEXT-6980 Implement audit log for item Change Request (Sub-task) Closed Vladimirs Maksimovs  
ZBXNEXT-6981 Implement audit log for item prototype Change Request (Sub-task) Closed Zabbix Development Team  
ZBXNEXT-6982 Implement audit for trigger Change Request (Sub-task) Resolved Vladimirs Maksimovs  
ZBXNEXT-6983 Implement audit for trigger prototype Change Request (Sub-task) Resolved Vladimirs Maksimovs  
ZBXNEXT-6984 Implement audit for graph Change Request (Sub-task) Fix for Manual Testing Janis Freibergs  
ZBXNEXT-6985 Implement audit for graph prototype Change Request (Sub-task) Closed Zabbix Development Team  
ZBXNEXT-6986 Implement audit for LLD rules Change Request (Sub-task) Closed Vladimirs Maksimovs  
ZBXNEXT-6987 Implement audit for map Change Request (Sub-task) READY TO DEVELOP Janis Freibergs  
ZBXNEXT-6988 Implement audit for task Change Request (Sub-task) READY TO DEVELOP Vladimirs Maksimovs  
ZBXNEXT-6989 Implement audit for host interfaces Change Request (Sub-task) Closed Gregory Chalenko  
ZBXNEXT-6990 Implement audit for valuemap Change Request (Sub-task) READY TO DEVELOP Vladimirs Maksimovs  
ZBXNEXT-6998 Implement audit for API host Change Request (Sub-task) READY TO DEVELOP Janis Freibergs  
ZBXNEXT-7123 Implement audit for User roles (API) Change Request (Sub-task) READY TO DEVELOP Vladimirs Maksimovs  
ZBXNEXT-8351 Implement audit for frontend (Discove... Specification change (Sub-task) Ready for QA Vladimirs Maksimovs  
Team: Team C
Sprint: Sprint 72 (Jan 2021), Sprint 73 (Feb 2021), Sprint 74 (Mar 2021), Sprint 75 (Apr 2021), Sprint 76 (May 2021), Sprint 77 (Jun 2021), Sprint 78 (Jul 2021), Sprint 79 (Aug 2021), Sprint 80 (Sep 2021), Sprint 81 (Oct 2021), Sprint 82 (Nov 2021), Sprint 83 (Dec 2021), Sprint 84 (Jan 2022), Sprint 85 (Feb 2022), Sprint 86 (Mar 2022), Sprint 87 (Apr 2022), Sprint 88 (May 2022), Sprint 89 (Jun 2022), Sprint 90 (Jul 2022), Sprint 91 (Aug 2022), Sprint 92 (Sep 2022), Sprint 93 (Oct 2022), Sprint 94 (Nov 2022), Sprint 95 (Dec 2022), Sprint 96 (Jan 2023), Sprint 97 (Feb 2023), Sprint 98 (Mar 2023), Sprint 99 (Apr 2023), Sprint 100 (May 2023), Sprint 101 (Jun 2023), Sprint 102 (Jul 2023), Sprint 103 (Aug 2023), Sprint 104 (Sep 2023), Sprint 105 (Oct 2023), Sprint 106 (Nov 2023), Sprint 107 (Dec 2023), S2401, S24-W6/7, S24-W8/9, Prev.Sprint, S24-W14/15, S24-W16/17, S24-W18/19, S24-W20/21, S24-W22/23, S24-W24/25, S24-W26/27, S24-W28/29, S24-W30/31, S24-W32/33, S24-W34/35, S24-W36/37, S24-W38/39, S24-W40/41, S24-W42/43, S24-W48/49, S24-W50/51/52/1, S25-W4/5, S25-W6/7, S25-W8/9, S25-W10/11
Story Points: 10

 Description   

Review and refactor audit log functionality to improve:

  1. missing records in frontend, API
  2. performance for 200k+ devices
    1. mass updates
  3. search for log records
  4. permissions to log records

 

 Comments   
Comment by Dimitri Bellini [ 2022 May 06 ]

Hi DevTeam,
during my test of Zabbix 6.2beta1 I checked the "audit" records for an "host create" but I can see only few information like:

  • Host Create record -> no details of template association or macros modification
  • Host Group record

Is the correct behaviour?
Thanks so much

Comment by Vladimirs Maksimovs [ 2022 May 09 ]

Hi dimitri.bellini!

Yes, currently some Zabbix audit objects are still work in progress, and Hosts is the one of them. It takes a lot of efforts to add the full audit log for the fundamental Zabbix objects like hosts, items, triggers, etc. The complete audit log for Hosts will be implemented in scope of ZBXNEXT-6998. Complete audit for items is coming soon. Then we are adding full support for triggers. Full host details are coming once items and triggers are ready.

Comment by Dimitri Bellini [ 2022 May 09 ]

@Vladimirs thanks so much for your detailed explanation.

Comment by Jack Valko [ 2022 May 19 ]

Hi Vladimirs,

Is it possible the fix in ZBXNEXT-6867 broke template imports with host prototypes with SNMP interfaces?  If so, is this intentional?  Thanks,

Jack

ZBX-20699

Meraki Template Import Discussion

Comment by Vladimirs Maksimovs [ 2022 May 30 ]

Hi jackvalko!

The problem appeared after ZBXNEXT-6959. Yes, this is a bug. We already work on it in ZBX-20699.

Kind regards,
Vladimirs

Comment by Alexey [ 2023 May 31 ]

Hi DevTeam!

On Zabbix 6.0.18 I added an item to the template or to the host, but there is no record in the Audit log about this.
Similarly, when I updated the item.
But when I deleted the item, there is a record in the Audit log.

Adding, updating, and removing an item by Discovery by the System are displayed in the Audit log.

Also attaching and detaching templates are not displayed in the Audit log.

 

Comment by Vladimirs Maksimovs [ 2023 Jun 01 ]

Hi, anyqov! It took quite a lot of efforts to implement the audit logging of the items at all. Finally was decided to release the audit logging of the new entities only to the latest version of zabbix (only to master branch). The reason is during the development of the newer versions of Zabbix (in current case 6.2 and 6.4) there appears a lot of complex conflicts.

To find out the Zabbix version from which the entity became completely audit logged, you are able to open the appropriate Jira sub-task and find the smallest version in "Fixed versions" of this ticket. For example, the ticket to audit log implementation for items is ZBXNEXT-6980 and the smallest fixed version is 6.4.0beta3.

Kind regards,
Vladimirs

Generated at Sat Apr 19 04:04:04 EEST 2025 using Jira 9.12.4#9120004-sha1:625303b708afdb767e17cb2838290c41888e9ff0.