Bug 1406175 - audits API can't search on some types
Summary: audits API can't search on some types
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Satellite 6
Classification: Red Hat
Component: Audit Log
Version: 6.2.4
Hardware: All
OS: All
high
medium vote
Target Milestone: Unspecified
Assignee: Shlomi Zadok
QA Contact: Peter Ondrejka
URL: http://projects.theforeman.org/issues...
Whiteboard:
Depends On:
Blocks: 1417121
TreeView+ depends on / blocked
 
Reported: 2016-12-19 22:03 UTC by Josh Foots
Modified: 2019-08-12 16:34 UTC (History)
12 users (show)

Fixed In Version: foreman-1.11.0.66-2
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
: 1417121 (view as bug list)
Environment:
Last Closed: 2017-03-06 08:36:29 UTC
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2017:0447 normal SHIPPED_LIVE Satellite 6.2.8 Async Bug Release 2017-03-06 13:23:41 UTC
Foreman Issue Tracker 17813 None None None 2016-12-21 11:03:57 UTC
Red Hat Bugzilla 1426742 None CLOSED Cannot query most auditable_types in API 2018-12-24 02:27:19 UTC

Internal Links: 1426742

Description Josh Foots 2016-12-19 22:03:02 UTC
Description of problem:

When a user modifies a matcher in a smart param, this is logged as an audit event with auditable_type = LookupValue:

{
  "user_id": 3,
  "user_type": null,
  "user_name": "admin",
  "version": 4,
  "comment": null,
  "associated_id": 168,
  "associated_type": "LookupKey",
  "remote_address": "192.168.0.0",
  "associated_name": "cs_puppet_config_csl31::naming_services_0001::nameservers",
  "created_at": "2016-12-14 00:17:44 UTC",
  "id": 15285,
  "auditable_id": 53,
  "auditable_name": "hostgroup=ORGANIZATION/CH/TESTING",
  "auditable_type": "LookupValue",
  "action": "update",
  "audited_changes": {
    "value": [
      [
        "192.168.0.0",
        "192.168.0.0"
      ],
      [
        "192.168.0.0"
      ]
    ]
  }
}

But I can't query these reports directly:

Doing this:

https://satellite.example.com/api/v2/audits?search=type=LookupValue

Returns this:

{
  "error": {
    "message": "'auditable_type' should be one of 'host, parameter, architecture, puppetclass, os, hostgroup, template', but the query was 'LookupValue'",
    "class": "ScopedSearch::QueryNotSupported"
  }
}


Version-Release number of selected component (if applicable):


How reproducible:

Very

Steps to Reproduce:
1. use https://satellite.example.com/api/v2/audits?search=type=LookupValue
2.
3.

Actual results:


{
  "error": {
    "message": "'auditable_type' should be one of 'host, parameter, architecture, puppetclass, os, hostgroup, template', but the query was 'LookupValue'",
    "class": "ScopedSearch::QueryNotSupported"
  }
}

Expected results:

for it to return the correct data.

Additional info:

Comment 2 Shlomi Zadok 2016-12-21 10:01:39 UTC
Created redmine issue http://projects.theforeman.org/issues/17813 from this bug

Comment 3 Bryan Kearney 2016-12-21 13:08:32 UTC
Upstream bug assigned to szadok@redhat.com

Comment 4 Bryan Kearney 2016-12-21 13:08:37 UTC
Upstream bug assigned to szadok@redhat.com

Comment 5 Bryan Kearney 2016-12-21 17:08:32 UTC
Moving this bug to POST for triage into Satellite 6 since the upstream issue http://projects.theforeman.org/issues/17813 has been resolved.

Comment 8 Peter Ondrejka 2017-02-15 12:47:46 UTC
Verified in Satellite 6.2.8 snap 2, the lookupvalue has been added as a valid type for api audit search:


https://<hostname>/api/v2/audits?search=type=lookupvalue

{

    "total": 153,
    "subtotal": 1,
    "page": 1,
    "per_page": 20,
    "search": "type=lookupvalue",
    "sort": {
        "by": null,
        "order": null
    },
    "results": [
        {
            "user_id": 3,
            "user_type": null,
            "user_name": "admin",
            "version": 1,
            "comment": null,
            "associated_id": 15,
            "associated_type": "LookupKey",
            "remote_address": "10.34.130.122",
            "associated_name": "foreman_scap_client::port",
            "created_at": "2017-02-15 12:44:48 UTC",
            "id": 153,
            "auditable_id": 1,
            "auditable_name": "os=rhel",
            "auditable_type": "LookupValue",
            "action": "create",
            "audited_changes": {
                "match": "os=rhel",
                "value": "2222",
                "lookup_key_id": 15,
                "use_puppet_default": false
            }
        }
    ]

}

Comment 10 errata-xmlrpc 2017-03-06 08:36:29 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2017:0447

Comment 11 Sagar Lutade 2018-09-05 18:00:18 UTC
Hi,

On Satellite 6.3.2 it's not working and seems to be a regression.

https://satellite63.example.com/api/v2/audits?search=type=lookupvalue

{
  "error": {"message":"'auditable_type' should be one of 'architecture, auth_source, bookmark, compute_attribute, compute_profile, compute_resource, config_group, domain, host, hostgroup, image, location, medium, os, organization, override_value, partition_table, parameter, puppetclass, realm, role, setting, ssh_key, smart_proxy, subnet, user, usergroup, template, provisioning_template, ptable', but the query was 'lookupvalue'","class":"ScopedSearch::QueryNotSupported"}
}

Can someone please check this and confirm.


Note You need to log in before you can comment on or make changes to this bug.