Exclude log messages based on configurable filter

[btrnka63]

Hello, I'd like to request enhancement of the module to provide the possibility to exclude certain user's activities (like "actions/reschedule-check" as having tons of it in the log).

I manage it temporary locally by adding following codes:

• library/Audit/ProvidedHook/AuditLog.php:

   ...
      $logConfig = Config::module('audit')->getSection('log');
  
      if (isset($logConfig->exclude) && preg_match('#'.$logConfig->exclude.'#', $message)) {
        $file = new File($logConfig->get('path', '/var/log/icingaweb2/audit.log') . '_exclude', 'a');
        $file->fwrite(date('c', $time) . ' - ' . $identity . ' - ' . $type . ' - ' . $message . PHP_EOL);
        $file->fflush();
        return;
      }
  
      if ($logConfig->type === 'file') {
   ...

• application/forms/Config/AuditLogConfigForm.php:

  ...
      );
  
      $this->addElement(
        'text',
        'log_exclude',
        [
            'label'         => $this->translate('Exclude'),
            'description'   => $this->translate('RegEx to exclude')
        ]
      );
  
      if (isset($formData['log_type']) && $formData['log_type'] === 'file') {
  ...

I hope it helps to understand the intention.

[nilmerg]

Hey,

my first question is, why do you have tons of these messages in the first place? I presume this is due some automatism, so isn't it more viable to exclude all activity of a certain user?

[btrnka63]

Hi, no, no automatism in this case ... just having huge landscape (30k+ servers) and a lot impatient users. Nevertheless, some activities (like "Check now") are not interesting for audit.

E.g., we activated the audit module to track who set/removed downtime, add/removed comment, acknowledgement, etc. Yes, "ADD" is visible also within the standard history, but there is no info about removal of DT, ACK or comment ... for this the Audit module is helpful.

[nilmerg]

I see, thanks

[nilmerg]

Oh, just saw #6 and #7

[nilmerg]

Duplicate of #6