topic Gaia R80.40 While installing a policy on a gateway I see 5 changes but no audit logs in Firewall and Security Management

Gaia R80.40 While installing a policy on a gateway I see 5 changes but no audit logs

Denis_Ruzicka — Wed, 07 Feb 2024 08:50:19 GMT

Hello,

while installing policy I wanted to review changes but my audit log is empty. Are there changes which are excluded from audit log?

User account is super user and I am viewing the logs within specified time.

Is there any way to check differences from last revision.

Cheers

Re: Gaia R80.40 While installing a policy on a gateway I see 5 changes but no audit logs

PhoneBoy — Wed, 07 Feb 2024 13:43:47 GMT

While most changes generate an audit log (e.g. to objects and rules), there are a few changes that do not.
Changes to Global Properties is the most common culprit here, but there may be a few others.

Re: Gaia R80.40 While installing a policy on a gateway I see 5 changes but no audit logs

the_rock — Wed, 07 Feb 2024 13:46:27 GMT

I agree with Phoneboy. I know this as a fact actually, becaise I tested it in the lab and could not find any audit log. Any time I would do this in R80.20, R80.30, R80.40, R81.10 and R81.20, it was exact same behavior.

Best,

Andy

Re: Gaia R80.40 While installing a policy on a gateway I see 5 changes but no audit logs

the_rock — Wed, 07 Feb 2024 15:08:22 GMT

@Denis_Ruzicka Ok, I take my statement back. Maybe thats not 100% true. I just tried on R81.20 Azure mgmt server and changed global property setting and it actually show in the audit log. What was the change you made?

Andy

Re: Gaia R80.40 While installing a policy on a gateway I see 5 changes but no audit logs

Denis_Ruzicka — Wed, 07 Feb 2024 15:27:51 GMT

I will be honest I don't know.

I know I was hovering around objects and access rules at the end I was focused on VRRP addresses. But in the end of my session I chose to not touch them during production time. When I was closing the session I saw 5 changes which I though were some tiding changes like names of objects and so on. I published them with the plan to review changes upon installation (irresponsible, I am going to abandon the practice ).

And when I was about to install the policy I saw nothing in the audit log.

My plan is to do backup and revert to revision before the last Publish.

Re: Gaia R80.40 While installing a policy on a gateway I see 5 changes but no audit logs

PhoneBoy — Wed, 07 Feb 2024 16:57:58 GMT

It may be this is fixed in R81.20 (or some version past R80.40).

Re: Gaia R80.40 While installing a policy on a gateway I see 5 changes but no audit logs

the_rock — Wed, 07 Feb 2024 17:25:25 GMT

Its weird, cause last time I did it in R81.20, definitely did not show any audit logs. Cant recall now exactly what I changed in glonal properties...

Andy

Re: Gaia R80.40 While installing a policy on a gateway I see 5 changes but no audit logs

the_rock — Wed, 07 Feb 2024 17:26:17 GMT

Thats fair. Do you remember EXACTLY what you had changed? If yes, can you please let us know, so I can test it in the lab.

Best,

Andy

Re: Gaia R80.40 While installing a policy on a gateway I see 5 changes but no audit logs

Denis_Ruzicka — Wed, 07 Feb 2024 17:41:05 GMT

I am very grateful that you want to find what exactly isn't being logged in audit log. This is beneficiary for me and the community.

But that is my issue in this case I don't know what exactly I have changed. What I think might cause this is that I might have opened some properties renamed something but later in the session I changed it back... to original name therefore it might not be logged because there is no change between revision? That might be worth a try.

Re: Gaia R80.40 While installing a policy on a gateway I see 5 changes but no audit logs

the_rock — Wed, 07 Feb 2024 21:40:17 GMT

Yes, no problem, always happy to help. Let me try that, I will change something random in global properties, save, then change it back. Will report if I see audit log about it.

Andy

Re: Gaia R80.40 While installing a policy on a gateway I see 5 changes but no audit logs

the_rock — Wed, 07 Feb 2024 22:33:22 GMT

K, just changed random setting in global properties, saved, changed it back, saved and I see the audit logs for it

Andy

Re: Gaia R80.40 While installing a policy on a gateway I see 5 changes but no audit logs

Denis_Ruzicka — Thu, 08 Feb 2024 14:23:12 GMT

Thank you. When I get this fixed I will try some changes related to the task I was doing and see if they create log. Only now I will note what exactly I do.

I will be reverting to previous revision this weekend. Do you have any recommendation if I should check something before reverting?

Thank you for your help it is appreciated.

Denis

Re: Gaia R80.40 While installing a policy on a gateway I see 5 changes but no audit logs

the_rock — Thu, 08 Feb 2024 14:24:36 GMT

Any time mate 🙂

Re: Gaia R80.40 While installing a policy on a gateway I see 5 changes but no audit logs

Denis_Ruzicka — Wed, 14 Feb 2024 15:52:02 GMT

Ok so in the end we created backups and then installed the new policy. Everything works and I haven't noticed anything.

Today I tested and found out that on R80.40 if you open Gateway Cluster Properties -> Network Management -> double click network interface -> click "Ok" while changing nothing -> click "Ok" in Gateway Cluster Properties window.

The smart console freezes for a while then the properties window closes then it freezes again.

In that moment I see 3 changes in session. When install them I see in audit log

The change : "@Interface Index: '1', '2', '3', '4', '5', '6', '7', '8', '9', '10', '11', '12', '13', '14', '15', '16', '17', '18', '19', '20', '21', '22', '23', '24', '25', '26'...."

Which I presume is automatic Index updates which would happen if I were to change an interface (though I didn't)

I have tried few other things but I always generate some kind of update for given box or cluster I can see some audit logs.

Re: Gaia R80.40 While installing a policy on a gateway I see 5 changes but no audit logs

the_rock — Wed, 14 Feb 2024 16:10:31 GMT

So all good now, you can see audit logs as expected?

Andy

Re: Gaia R80.40 While installing a policy on a gateway I see 5 changes but no audit logs

Denis_Ruzicka — Wed, 14 Feb 2024 17:04:15 GMT

Yes everything works now and I can see audit logs. However, there are clearly actions which will cause changes but no audit logs. I just didn't find them.

Re: Gaia R80.40 While installing a policy on a gateway I see 5 changes but no audit logs

Denis_Ruzicka — Wed, 14 Feb 2024 17:06:52 GMT

Thanks for consultations. We will be upgrading to newer version hopefully I won't get into same situation in future.

Re: Gaia R80.40 While installing a policy on a gateway I see 5 changes but no audit logs

the_rock — Wed, 14 Feb 2024 17:07:50 GMT

Sorry brother, wish I had R80.40 to test with, but I dont : - (

Andy

Re: Gaia R80.40 While installing a policy on a gateway I see 5 changes but no audit logs

the_rock — Wed, 14 Feb 2024 17:10:15 GMT

I am positive that in R81.20 you would never have this issue. I changed so many things as a test in last week and every time audit logs showed up.

Best,

Andy