Audit Web Services - Revision history

Mnelson: /* Overview */

2023-09-29T09:07:34Z

‎Overview

Mnelson: /* Search Audits */

2022-11-01T11:57:42Z

‎Search Audits

Mnelson: /* Search Audits */

2022-11-01T10:21:55Z

‎Search Audits

Mnelson: /* Search Transaction */

2022-02-17T08:22:07Z

‎Search Transaction

Mnelson: /* Overview */

2022-02-17T08:19:51Z

‎Overview

Mnelson: /* Audit Details */

2022-02-17T08:12:11Z

‎Audit Details

Mnelson: /* Response */

2022-02-17T08:07:49Z

‎Response

Mnelson: /* Search Audits */

2022-02-17T08:06:53Z

‎Search Audits

Mnelson: /* Audited System Events */

2022-02-17T08:02:48Z

‎Audited System Events

Mnelson: /* Search Audits */

2022-02-17T07:48:03Z

‎Search Audits

@@ Line 108: / Line 108: @@
 A single event (for example a Portal Sync) is likely to consist of a chain of audited events, where one process and event pair PORTAL.MANUAL_SYNC and likely to call other services which capture their own audits, such as SEND_API_REQUEST.GET which captures the information about the HTTP Get Request from a web service.  This chaining of events enables users to search for specific events (find all audits which call a web service) or search for a chain of events (find a PORTAL.MANUAL_SYNC and include all children).  If an event is found in a chain, for example a specific web service call event, it is possible to request the parent event that led to that call, or all the ancestors - or for the full chain, the ancestors and children events.
-Each audit event captures the same high level information (unique id, process id, event type, username, thread, start time, duration, status, machine identification, and software version), when a specific event is retrieved by its unique identification any event specific properties will also be retrieved.  An example of event specific property is a for a REST GET event, which may include the HTTP Request and response Headers as well as the URL called.  Properties are also returned if child or parent/ancestors are included on a query for a specific audit.
+Each audit event captures the same high level information (unique id, process id, event type, username, thread, start time, duration, status, machine identification, and software version), when a specific event is retrieved by its unique identification any event specific properties will also be retrieved.  An example of event specific property is a for a REST GET event, which may include the HTTP Request and response Headers as well as the URL called.
 == Search Audits ==

@@ Line 153: / Line 153: @@
 |-
 | status|| no ||  the response status for the event
 |}

← Older revision		Revision as of 10:21, 1 November 2022
Line 177:		Line 177:
	]		]

		+
		+	=== Search Structure Queries ===
		+	Set process_id to SDMX_GET and event_type to structure
		+	ws/secure/audit/?process_id=SDMX_GET&event_type=structure
		+
		+	=== Search Data Queries ===
		+	Set process_id to SDMX_GET and event_type to data
		+	ws/secure/audit/?process_id=SDMX_GET&event_type=data

	== Audit Details ==		== Audit Details ==

@@ Line 14: / Line 14: @@
 {| class="wikitable"
 |-
-|style="background-color:#eaecf0"|<b>Entry Point</b>|| <b> /ws/registry/tx/searchTransactions</b>
+|style="background-color:#eaecf0"|<b>Entry Point</b>|| <b> /ws/registry/tx/searchAudits</b>
 |-
 |style="background-color:#eaecf0"|<b>Access</b>|| <span style='color:red'><b>Restricted to '''Audit Manager, Structure Manager, Portal Manager'''</b></span>

@@ Line 104: / Line 104: @@
 == Overview ==
-Audited system events are categorised by the process id (which process initiated the event) and the event type for that process.  For example a process id of STRUCTURE may have a sub-event of SAVE to declare it is a save request, or AFTER_COMMIT to declare it is a process which is initiated after a save event.
+Audited system events are categorised by the process id (which process initiated the event) and the event type for that process.  For example a process id of STRUCTURE may have a sub-event of SAVE to declare it is a save request, or AFTER_COMMIT to declare it is a process which is initiated after a save event.  Each audit event is uniquely identified by its UID, and can be retrieved by this UID.
 A single event (for example a Portal Sync) is likely to consist of a chain of audited events, where one process and event pair PORTAL.MANUAL_SYNC and likely to call other services which capture their own audits, such as SEND_API_REQUEST.GET which captures the information about the HTTP Get Request from a web service.  This chaining of events enables users to search for specific events (find all audits which call a web service) or search for a chain of events (find a PORTAL.MANUAL_SYNC and include all children).  If an event is found in a chain, for example a specific web service call event, it is possible to request the parent event that led to that call, or all the ancestors - or for the full chain, the ancestors and children events.

@@ Line 225: / Line 225: @@
           '''"sun.jnu.encoding": "Cp1252", ....'''
+       }
      },...
+   ]

@@ Line 220: / Line 220: @@
        "software_version": "11.0.0.13",
        "properties": {
-          '''"MEM_FREE_START": "8.468993E9",
+          '''"MEM_FREE_START": "8.468993E9",'''
-          "java.specification.version": "16",
+          '''"java.specification.version": "16",'''
-          "sun.cpu.isalist": "amd64",
+          '''"sun.cpu.isalist": "amd64",'''
-          "sun.jnu.encoding": "Cp1252", ....'''
+          '''"sun.jnu.encoding": "Cp1252", ....'''
+       }
      },...
+   ]

@@ Line 174: / Line 174: @@
        "software_version": "11.0.0.13",
        "properties": {}
      },...
+   ]

@@ Line 102: / Line 102: @@
 = Audited System Events =
 == Search Audits ==
 Search all system audits
@@ Line 146: / Line 154: @@
 | status|| no ||  the response status for the event
 |}

@@ Line 126: / Line 126: @@
 | event_type || no ||  desc
 |-
-| ancestors || no ||  true/false to include ancestor audit events
+| ancestors || no ||  true/false to include ancestor audit events (parent events, and their parents, and so on)
 |-
-| children || no ||  true/false to include child audit events
+| children || no ||  true/false to include child audit events (includes all decendants)
 |-
 | limit || no ||  maximum number of results
@@ Line 136: / Line 134: @@
 | offset || no ||  used to page the results, the offset skips an [offset] number of results before writing
 |-
-| parent || no ||
+| parent || no ||  retrieve any parent audit events of this event
 |-
 | process_id || no ||  filter by the audited process