Implementing audit logging to database - issues with capturing certain logs

[aq94]

Hi there,

Our team has recently upgraded from EIA 2.3 to EIA 2.4.1 in one of our dev environments and following this we have followed the steps outlined in the links below to implement and configure audit logging (to database).

https://github.com/IBM-i2/analyze/blob/master/documentation/Preparing-to-use-IBM-i2-Analyze-Developer-Essentials.md https://github.com/IBM-i2/analyze/blob/master/documentation/Configuring-the-audit-logging-to-database-example-project.md

We have completed these steps and now have an I2AUDIT schema and the four tables (EXPAND, QUICK_SEARCH, RECORD_RETRIEVAL and VISUAL_QUERY). Note that instead of creating a new AUDIT database, we have created the schema and tables within our dev environment ISTORE. We have also not performed step 7 in the second link relating to 'Debugging Developer Essentials in Eclipse'

The tables are capturing some log activity with some issues. Please see below for a summary:

I2AUDIT.EXPAND

• Not capturing expands performed via i2 Notebook
• Capturing successfully for expands performed via ANB

I2AUDIT.QUICK_SEARCH

• Capturing for quick searches performed via i2 Notebook and ANB, however are being captured twice (please see excel sheet attached, note that EVENT_TIME has two records with a few milliseconds apart)

I2AUDIT.RECORD_RETRIEVAL

• Not capturing record retrievals performed via i2 Notebook
• Capturing successfully for record retrievals performed via ANB

I2AUDIT.VISUAL_QUERY

• Capturing successfully for visual queries performed via i2 Notebook
• Capturing successfully for visual queries performed via ANB

Are there any known fixes for the issues discussed above? Let me know if there are any other details required from our side.

Thanks

GitHub Ticket Issues.xlsx

[jssregor]

aq64

Thanks for raising this issue and the detailed description.

Gaps in audit coverage between i2:Notebook and i2:ANBP would not be anticipated. I will spin up a test suite and validate the behaviour and plan next steps from here.

Steve

[jssregor]

aq94

A brief update. The test harness has similar outcomes. Discussing further tomorrow.

Steve

[aq94]

Thanks Steve, will keep an ear out and double check from our end to see if there are any other discrepancies to note.

Cheers

[Colvin-Cowie-i2]

Seeing as there haven't been any updates on this issue I'm closing it for now, but feel free to re-open with any new information.

[Anthony-Johnson-i2]

Thanks Colvin this was resolved via Cases/L3 escalation APARS etc.