Red Hat Bugzilla – Bug 1406175
audits API can't search on some types
Last modified: 2018-10-11 03:08:48 EDT
Description of problem: When a user modifies a matcher in a smart param, this is logged as an audit event with auditable_type = LookupValue: { "user_id": 3, "user_type": null, "user_name": "admin", "version": 4, "comment": null, "associated_id": 168, "associated_type": "LookupKey", "remote_address": "192.168.0.0", "associated_name": "cs_puppet_config_csl31::naming_services_0001::nameservers", "created_at": "2016-12-14 00:17:44 UTC", "id": 15285, "auditable_id": 53, "auditable_name": "hostgroup=ORGANIZATION/CH/TESTING", "auditable_type": "LookupValue", "action": "update", "audited_changes": { "value": [ [ "192.168.0.0", "192.168.0.0" ], [ "192.168.0.0" ] ] } } But I can't query these reports directly: Doing this: https://satellite.example.com/api/v2/audits?search=type=LookupValue Returns this: { "error": { "message": "'auditable_type' should be one of 'host, parameter, architecture, puppetclass, os, hostgroup, template', but the query was 'LookupValue'", "class": "ScopedSearch::QueryNotSupported" } } Version-Release number of selected component (if applicable): How reproducible: Very Steps to Reproduce: 1. use https://satellite.example.com/api/v2/audits?search=type=LookupValue 2. 3. Actual results: { "error": { "message": "'auditable_type' should be one of 'host, parameter, architecture, puppetclass, os, hostgroup, template', but the query was 'LookupValue'", "class": "ScopedSearch::QueryNotSupported" } } Expected results: for it to return the correct data. Additional info:
Created redmine issue http://projects.theforeman.org/issues/17813 from this bug
Upstream bug assigned to szadok@redhat.com
Moving this bug to POST for triage into Satellite 6 since the upstream issue http://projects.theforeman.org/issues/17813 has been resolved.
Verified in Satellite 6.2.8 snap 2, the lookupvalue has been added as a valid type for api audit search: https://<hostname>/api/v2/audits?search=type=lookupvalue { "total": 153, "subtotal": 1, "page": 1, "per_page": 20, "search": "type=lookupvalue", "sort": { "by": null, "order": null }, "results": [ { "user_id": 3, "user_type": null, "user_name": "admin", "version": 1, "comment": null, "associated_id": 15, "associated_type": "LookupKey", "remote_address": "10.34.130.122", "associated_name": "foreman_scap_client::port", "created_at": "2017-02-15 12:44:48 UTC", "id": 153, "auditable_id": 1, "auditable_name": "os=rhel", "auditable_type": "LookupValue", "action": "create", "audited_changes": { "match": "os=rhel", "value": "2222", "lookup_key_id": 15, "use_puppet_default": false } } ] }
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2017:0447
Hi, On Satellite 6.3.2 it's not working and seems to be a regression. https://satellite63.example.com/api/v2/audits?search=type=lookupvalue { "error": {"message":"'auditable_type' should be one of 'architecture, auth_source, bookmark, compute_attribute, compute_profile, compute_resource, config_group, domain, host, hostgroup, image, location, medium, os, organization, override_value, partition_table, parameter, puppetclass, realm, role, setting, ssh_key, smart_proxy, subnet, user, usergroup, template, provisioning_template, ptable', but the query was 'lookupvalue'","class":"ScopedSearch::QueryNotSupported"} } Can someone please check this and confirm.