Bug 1647781

Summary: Audits contain no data (Added foo to Missing(ID: x))
Product: Red Hat Satellite Reporter: Roman Plevka <rplevka>
Component: Audit LogAssignee: Kavita <kgaikwad>
Status: CLOSED ERRATA QA Contact: Roman Plevka <rplevka>
Severity: medium Docs Contact:
Priority: unspecified    
Version: 6.5.0CC: bkearney, ehelms, inecas, kgaikwad, mhulan, pcreech
Target Milestone: 6.8.0Keywords: Triaged
Target Release: Unused   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: foreman-1.24.0, katello-3.14.0,tfm-rubygem-katello-3.16.0.1-1 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2020-10-27 12:58:03 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
screen1
none
screen custom repo none

Description Roman Plevka 2018-11-08 10:49:13 UTC
Description of problem:
whenever user creates a repository, there are 2 audit records created:

```
Admin  added    KATELLO/ROOT REPOSITORY  foo_repo
Added foo_repo to N/A
```
and

```
Admin  updated  KATELLO/ROOT REPOSITORY  foo_repo
Content  N/A  Missing(ID: 1541672884013)
```

Version-Release number of selected component (if applicable):
6.5.0-2

How reproducible:
always

Actual results:
Content  N/A  Missing(ID: 1541672884013)

Expected results:
I would expect a single `create` audit with all the attributes of the repository in the record (with credentials and sensitive information masked)

Additional info:
2 records with no info in them

Comment 1 Roman Plevka 2018-11-08 10:54:42 UTC
update: this applies to all audits.

Comment 4 Marek Hulan 2018-11-13 08:26:25 UTC
Created redmine issue https://projects.theforeman.org/issues/25437 from this bug

Comment 5 Satellite Program 2018-11-13 11:07:17 UTC
Upstream bug assigned to mhulan

Comment 6 Satellite Program 2018-11-13 11:07:19 UTC
Upstream bug assigned to mhulan

Comment 8 Roman Plevka 2018-11-23 16:50:52 UTC
found one more occurrence of Missing(ID: 4) - In audit_Type: bookmark, if someone adds a bookmark, the field "owner" has Missing(ID: 4) value.

- btw, shall we publicly audit private bookmark actions?

Comment 9 Marek Hulan 2018-11-27 09:32:54 UTC
Just discussed together with Kavita and Roman, this is consistent with host ownership and permission system in general. So we'll keep the current behavior for bookmarks.

Comment 10 Roman Plevka 2018-12-10 13:58:36 UTC
okay, the audit now looks like this:

Affected Organizations
Affected Locations
Content    N/A    [empty]

Not sure what should be shown in the content - whether i put in the downstream url or not, the audit always shows [empty] for content.
Looks pretty useless for me. I'd rather see some useful info about newly created repo, like "content type", "url", etc.

Comment 11 Satellite Program 2018-12-10 15:08:50 UTC
Moving this bug to POST for triage into Satellite 6 since the upstream issue https://projects.theforeman.org/issues/25437 has been resolved.

Comment 12 Satellite Program 2018-12-10 17:09:01 UTC
Moving this bug to POST for triage into Satellite 6 since the upstream issue https://projects.theforeman.org/issues/25437 has been resolved.

Comment 13 Marek Hulan 2018-12-20 15:54:35 UTC
Do you know what the content attribute in this audit refers to? Thanks

Comment 18 Bryan Kearney 2019-03-01 07:06:06 UTC
Upstream bug assigned to kgaikwad

Comment 24 Bryan Kearney 2019-09-09 12:06:07 UTC
Upstream bug assigned to mhulan

Comment 25 Bryan Kearney 2019-09-09 14:06:09 UTC
Upstream bug assigned to kgaikwad

Comment 26 Bryan Kearney 2019-09-09 14:06:11 UTC
Upstream bug assigned to kgaikwad

Comment 27 Bryan Kearney 2019-09-12 14:05:50 UTC
Upstream bug assigned to mhulan

Comment 29 Roman Plevka 2020-02-06 10:08:43 UTC
testing this on sat6.7.0 snap#10

the "Missing (ID.." message is gone now, but there are still 2 audit records created:

The Create event (with all the info)
and an Update event with:
"Content   N/A   fooo"

- can we drop the latter one?

Comment 31 Kavita 2020-02-07 11:39:08 UTC
(In reply to Roman Plevka from comment #29)
> testing this on sat6.7.0 snap#10
> 
> the "Missing (ID.." message is gone now, but there are still 2 audit records
> created:
> 
> The Create event (with all the info)
> and an Update event with:
> "Content   N/A   fooo"
> 
> - can we drop the latter one?


Hello Roman,

Actually, on repository creation it creates three audit records i.e create actions for Root Repository & Repository and update action for Root Repository.
As per me, this audit record which shows content change in the root repository is not much informative.
so yes, it is possible to drop this audit record for update action.


But as Marek mentioned, it would be good to track it separately.
And which includes removal of code changes that are added to display content instead of missing id.

Thanks, 
Kavita

Comment 32 Bryan Kearney 2020-02-23 01:06:05 UTC
Upstream bug assigned to kgaikwad

Comment 34 Bryan Kearney 2020-03-11 22:06:05 UTC
Upstream bug assigned to mhulan

Comment 38 Marek Hulan 2020-03-25 09:14:23 UTC
Created attachment 1673341 [details]
screen1

Comment 39 Marek Hulan 2020-03-25 09:15:55 UTC
Created attachment 1673343 [details]
screen custom repo

Comment 40 Bryan Kearney 2020-03-30 16:09:24 UTC
Upstream bug assigned to kgaikwad

Comment 41 Bryan Kearney 2020-04-22 20:23:07 UTC
Upstream bug assigned to mhulan

Comment 42 Bryan Kearney 2020-05-27 20:02:25 UTC
Upstream bug assigned to kgaikwad

Comment 47 Roman Plevka 2020-09-09 08:18:04 UTC
VERIFIED
on sat6.8.0-14

there's just a single CREATE audit record for the action with the following fields/values:

Pulp             [empty]
Content view version    1
Relative path    Default_Organization/Library/custom/dogfood/sattools
Environment      Library
Root             sattools

Comment 50 errata-xmlrpc 2020-10-27 12:58:03 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Important: Satellite 6.8 release), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2020:4366