Bug 1703496 - Satellite audits cleanup
Summary: Satellite audits cleanup
Alias: None
Product: Red Hat Satellite
Classification: Red Hat
Component: Audit Log
Version: 6.4.2
Hardware: Unspecified
OS: Unspecified
medium vote
Target Milestone: 6.12.0
Assignee: satellite6-bugs
QA Contact: Sam Bible
Depends On:
TreeView+ depends on / blocked
Reported: 2019-04-26 15:14 UTC by sthirugn@redhat.com
Modified: 2022-09-20 15:42 UTC (History)
9 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Last Closed:
Target Upstream Version:

Attachments (Terms of Use)

System ID Private Priority Status Summary Last Updated
Foreman Issue Tracker 27024 0 High New Satellite audits cleanup 2021-02-02 17:43:53 UTC

Description sthirugn@redhat.com 2019-04-26 15:14:13 UTC
Description of problem:
Satellite audits cleanup

Version-Release number of selected component (if applicable):
Satellite 6.4.2

How reproducible:

Steps to Reproduce:
1.Some production Satellites have more than 5 million audit entries which degrades the performance of Satellite audit UI.  Need an automatic cleanup mechanism to remove old audit entries.

Actual results:
Production Satellites accumulate large of Audit data which are not purged.

# time curl -k -u admin https://satellite.example.com/api/audits > audit
Enter host password for user 'admin':
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100 13950    0 13950    0     0    817      0 --:--:--  0:00:17 --:--:--  3534

real	0m19.485s
user	0m0.047s
sys	0m0.066s

# head audit
  "total": 5136427,
  "subtotal": 5136427,
  "page": 1,
  "per_page": 30,
  "search": null,
  "sort": {
    "by": null,
    "order": null

Expected results:
Need an automated purge mechanism for audits.

Additional info:

Comment 3 sthirugn@redhat.com 2019-04-26 15:17:07 UTC
This should have customization so the user can pick and choose the settings that are desired.

Comment 4 sthirugn@redhat.com 2019-04-26 18:51:01 UTC
Use foreman rake task to cleanup audits.

To keep the last 2 years worth of data and delete anything older than that:

foreman-rake audits:expire days=730

Comment 7 Kavita 2019-06-12 11:24:34 UTC
Created redmine issue https://projects.theforeman.org/issues/27024 from this bug

Comment 9 Charles Slivkoff 2021-04-05 14:53:38 UTC
This should not be considered an enhancement but a bug.  

The tasks needed should be automated by-default.

Comment 11 Mike McCune 2021-07-13 21:54:48 UTC
Upon review of our valid but aging backlog the Satellite Team has concluded that this Bugzilla does not meet the criteria for a resolution in the near term, and are planning to close in a month. This message may be a repeat of a previous update and the bug is again being considered to be closed. If you have any concerns about this, please contact your Red Hat Account team.  Thank you.

Comment 12 Charles Slivkoff 2021-07-13 23:29:48 UTC
At very least, this cleanup step should be clearly explained in the upgrade documentation.

This was a real-world scenario and that had a measurable impact on productivity.

Comment 14 Marek Hulan 2021-09-10 08:11:07 UTC
Thanks for the comment, it has been re-evaluated and should be addressed.

Comment 15 Eric Helms 2021-11-04 13:15:38 UTC
Upstream bug assigned to dmatoule

Comment 16 Eric Helms 2021-11-04 13:15:40 UTC
Moving this bug to POST for triage into Satellite since the upstream issue https://projects.theforeman.org/issues/27024 has been resolved.

Comment 20 Sam Bible 2022-09-20 15:42:30 UTC
Version-Release number of selected component (if applicable):
Satellite 6.12.0 - 10

Steps to Reproduce:
1. Create some audit log entries by doing various actions on a Satellite
2. Go to Administer -> Settings and change the value of "Saved Audits Interval" to something other than blank

Expected Results:
After the specified time period, the audits get cleared.

Actual results:
After the specified time period, the audits get cleared.

Note You need to log in before you can comment on or make changes to this bug.