Gaia R80.40 While installing a policy on a gateway I see 5 changes but no audit logs

[Denis_Ruzicka]

Hello, 

while installing policy I wanted to review changes but my audit log is empty. Are there changes which are excluded from audit log?

User account is super user and I am viewing the logs within specified time.

Is there any way to check differences from last revision.

Cheers

  

[PhoneBoy]

While most changes generate an audit log (e.g. to objects and rules), there are a few changes that do not.
Changes to Global Properties is the most common culprit here, but there may be a few others.

[the_rock]

I agree with Phoneboy. I know this as a fact actually, becaise I tested it in the lab and could not find any audit log. Any time I would do this in R80.20, R80.30, R80.40, R81.10 and R81.20, it was exact same behavior.

Best,

Andy

[the_rock]

@Denis_Ruzicka Ok, I take my statement back. Maybe thats not 100% true. I just tried on R81.20 Azure mgmt server and changed global property setting and it actually show in the audit log. What was the change you made?

Andy

 

[Denis_Ruzicka]

I will be honest I don't know.

I know I was hovering around objects and access rules at the end I was focused on VRRP addresses. But in the end of my session I chose to not touch them during production time. When I was closing the session I saw 5 changes which I though were some tiding changes like names of objects and so on. I published them with the plan to review changes upon installation (irresponsible, I am going to abandon the  practice ). 

And when I was about to install the policy I saw nothing in the audit log. 

My plan is to do backup and revert to revision before the last Publish.

[the_rock]

Thats fair. Do you remember EXACTLY what you had changed? If yes, can you please let us know, so I can test it in the lab.

Best,

Andy

[Denis_Ruzicka]

I am very grateful that you want to find what exactly isn't being logged in audit log. This is beneficiary for me and the community.

But that is my issue in this case I don't know what exactly I have changed. What I think might cause this is that I might have opened some properties renamed something but later in the session I changed it back... to original name therefore it might not be logged because there is no change between revision? That might be worth a try.

[the_rock]

Yes, no problem, always happy to help. Let me try that, I will change something random in global properties, save, then change it back. Will report if I see audit log about it.

Andy

[the_rock]

K, just changed random setting in global properties, saved, changed it back, saved and I see the audit logs for it

Andy

 

[Denis_Ruzicka]

Thank you. When I get this fixed I will try some changes related to the task I was doing and see if they create log.  Only now I will note what exactly I do. 

I will be reverting to previous revision this weekend. Do you have any recommendation if I should check something before reverting?

Thank you for your help it is appreciated.

Denis 

[the_rock]

Any time mate 🙂

[PhoneBoy]

It may be this is fixed in R81.20 (or some version past R80.40).

[the_rock]

Its weird, cause last time I did it in R81.20, definitely did not show any audit logs. Cant recall now exactly what I changed in glonal properties...

Andy

[Denis_Ruzicka]

Ok so in the end we created backups and then installed the new policy. Everything works and I haven't noticed anything.

Today I tested and found out that on R80.40 if you open Gateway Cluster Properties  -> Network Management -> double click network interface -> click "Ok" while changing nothing -> click "Ok" in Gateway Cluster Properties window.

The smart console freezes for a while then the properties window closes then it freezes again.

In that moment I see 3 changes in session. When install them I see in audit log  

The  change : "@Interface Index: '1', '2', '3', '4', '5', '6', '7', '8', '9', '10', '11', '12', '13', '14', '15', '16', '17', '18', '19', '20', '21', '22', '23', '24', '25', '26'...."

Which I presume is automatic Index updates which would happen if I were to change an interface (though I didn't)

I have tried few other things but I always generate some kind of update for given box or cluster I can see some audit logs.

[the_rock]

So all good now, you can see audit logs as expected?

Andy

[Denis_Ruzicka]

Yes everything works now and I can see audit logs. However, there are clearly actions which will cause changes but no audit logs. I just didn't find them.

[the_rock]

Sorry brother, wish I had R80.40 to test with, but I dont : - (

Andy

[Denis_Ruzicka]

Thanks for consultations. We will be upgrading to newer version hopefully I won't get into same situation in future.

[the_rock]

I am positive that in R81.20 you would never have this issue. I changed so many things as a test in last week and every time audit logs showed up.

Best,

Andy