feat(audit): endpoints for generic audit log querying#1423
feat(audit): endpoints for generic audit log querying#1423andrewazores merged 9 commits intocryostatio:mainfrom
Conversation
|
/build_test |
|
Workflow started at 3/18/2026, 4:36:27 PM. View Actions Run. |
|
No GraphQL schema changes detected. |
|
No OpenAPI schema changes detected. |
|
No WebSocket notifications schema changes detected. |
|
CI build: Integration tests pass ✅ |
|
CI build: Unit tests pass ✅ |
andrewazores
force-pushed
the
audit-query
branch
from
964fd14 to
5db389b
Compare
jtolentino1
left a comment
jtolentino1
left a comment
There was a problem hiding this comment.
LGTM. Tested with creating/stopping/deleting/starting active recordings and same for automated rules. Was able to see the events under audit logs within the timeframe. Was able to also download the JSON and it matches what the audit logs says. Also changed the timeframe after running more events and was able to only see the new ones as expected.
Just need a rebase.
andrewazores
force-pushed
the
audit-query
branch
from
7dc44f9 to
2406b4e
Compare
|
/build_test |
|
Workflow started at 3/27/2026, 11:10:36 AM. View Actions Run. |
|
No GraphQL schema changes detected. |
|
No OpenAPI schema changes detected. |
|
No WebSocket notifications schema changes detected. |
|
CI build: Integration tests pass ✅ |
|
CI build: Unit tests pass ✅ |
andrewazores
force-pushed
the
audit-query
branch
from
2406b4e to
ed3e1b5
Compare
andrewazores
force-pushed
the
audit-query
branch
from
ed3e1b5 to
62de836
Compare
|
/build_test |
|
Workflow started at 3/31/2026, 3:07:11 PM. View Actions Run. |
|
No OpenAPI schema changes detected. |
|
No GraphQL schema changes detected. |
|
No WebSocket notifications schema changes detected. |
|
CI build: Integration tests pass ✅ |
|
CI build: Unit tests pass ✅ |
|
Tested again, everything worked great up until I found a bug specifically with creating / removing an automated rule. Not sure if it's intended but worth taking a look. How to recreate:
|
|
Hmm. That's definitely not intended. I don't see anything obvious (stack trace etc) in the logs, but querying the audit logs for deletions is a bit different than querying for still-live entities, so I've probably got something wrong there. I'll spend a bit of time trying to chase this down. |
|
/build_test |
|
Workflow started at 4/1/2026, 10:17:06 AM. View Actions Run. |
|
No GraphQL schema changes detected. |
|
No WebSocket notifications schema changes detected. |
|
No OpenAPI schema changes detected. |
|
CI build: Integration tests pass ✅ |
|
CI build: Unit tests pass ✅ |
|
@jtolentino1 should be fixed now. Deletion entries in the audit log should now display properly instead of producing a 404, although the revision is scant on details - it will just show you the revision ID, the deletion event type, and the ID of the entity that was deleted (no other fields ex. rule name, description). |
jtolentino1
left a comment
jtolentino1
left a comment
There was a problem hiding this comment.
Tested with new patch, bug is gone. LGTM
2 participants
Welcome to Cryostat! 👋
Before contributing, make sure you have:
mainbranch[chore, ci, docs, feat, fix, test]To recreate commits with GPG signature
git fetch upstream && git rebase --force --gpg-sign upstream/mainFixes #1299
Description of the change:
Adds generic audit log querying endpoints: one to query for audit revisions within a timeframe, a second to get details about what was changed by a given revision, and a third to produce a combined report of revisions and what they did within a timeframe.
The first and second endpoint are lighter-weight operations and used to power the cryostatio/cryostat-web#2156 Audit Log table UI. This is primarily to allow the user to preview what data is in the audit logs for a given period, so that they can then download the full report (which may take some time to retrieve) for a full offline audit analysis.
How to manually test:
./smoketest.bash -O -t quarkus-cryostat-agentto run backendyarn start:devin -web repo to run frontend