auditlog.get

Description

integer/array auditlog.get(object **parameters**)

The method allows to retrieve audit log records according to the given parameters.

Parameters

(object) Parameters defining the desired output.

The method supports the following parameters.

ParameterTypeDescription
auditidsstring/arrayReturn only audit log with the given IDs.
useridsstring/arrayReturn only audit log that were created by the given users.
time_fromtimestampReturns only audit log entries that have been created after or at the given time.
time_tilltimestampReturns only audit log entries that have been created before or at the given time.
selectDetailsqueryReturns audit log entries with per field changes as details property.

Available only for entries with action “1 - Update”, for actions of other types returns empty array.
sortfieldstring/arraySort the result by the given properties.

Possible values are: auditid, userid, clock.
filterobjectReturn only results that exactly match the given filter.

Accepts an array, where the keys are property names, and the values are either a single value or an array of values to match against.

Additionally supports filtering by details property fields: table_name, field_name.
searchobjectCase insensitive sub-string search in content of fields: note, ip, resourcename, oldvalue, newvalue.
countOutputbooleanThese parameters being common for all get methods are described in the reference commentary.
excludeSearchboolean
limitinteger
outputquery
preservekeysboolean
searchByAnyboolean
searchWildcardsEnabledboolean
sortorderstring/array
startSearchboolean

Return values

(integer/array) Returns either:

  • an array of objects;

  • the count of retrieved objects, if the countOutput parameter has been used.

Examples

Retrieve audit log

Retrieve two latest audit log records.

Request:

  1. {
  2.     "jsonrpc": "2.0",
  3.     "method": "auditlog.get",
  4.     "params": {
  5.         "output": "extend",
  6.         "sortfield": "clock",
  7.         "sortorder": "DESC",
  8.         "limit": 2
  9.     },
  10.     "auth": "038e1d7b1735c6a5436ee9eae095879e",
  11.     "id": 1
  12. }

Response:

  1. {
  2.     "jsonrpc": "2.0",
  3.     "result": [
  4.         {
  5.             "auditid": "189",
  6.             "userid": "1",
  7.             "clock": "1580913141",
  8.             "action": "3",
  9.             "resourcetype": "0",
  10.             "note": "",
  11.             "ip": "127.0.0.1",
  12.             "resourceid": "0",
  13.             "resourcename": ""
  14.         },
  15.         {
  16.             "auditid": "188",
  17.             "userid": "1",
  18.             "clock": "1580903029",
  19.             "action": "3",
  20.             "resourcetype": "0",
  21.             "note": "",
  22.             "ip": "127.0.0.1",
  23.             "resourceid": "0",
  24.             "resourcename": ""
  25.         }
  26.     ],
  27.     "id": 2
  28. }

Retrieve audit log records having substring “test” in oldvalue field.

Request:

  1. {
  2.     "jsonrpc": "2.0",
  3.     "method": "auditlog.get",
  4.     "params": {
  5.         "output": ["auditid", "resourcename"],
  6.         "search": {
  7.             "newvalue": "test"
  8.         },
  9.         "selectDetails": "extend"
  10.     },
  11.     "auth": "038e1d7b1735c6a5436ee9eae095879e",
  12.     "id": 1
  13. }

Response:

  1. {
  2.     "jsonrpc": "2.0",
  3.     "result": [
  4.         {
  5.             "auditid": "5",
  6.             "resourcename": "Mattermost2",
  7.             "details": [
  8.                 {
  9.                     "table_name": "media_type",
  10.                     "field_name": "event_menu_url",
  11.                     "oldvalue": "http://test",
  12.                     "newvalue": "http://test{EVENT.TAGS.__test}"
  13.                 }
  14.             ]
  15.         },
  16.         {
  17.             "auditid": "7",
  18.             "resourcename": "Email",
  19.             "details": [
  20.                 {
  21.                     "table_name": "media_type",
  22.                     "field_name": "name",
  23.                     "oldvalue": "Email",
  24.                     "newvalue": "Email test"
  25.                 }
  26.             ]
  27.         }
  28.     ],
  29.     "id": 20
  30. }

See also

Source

CAuditLog::get() in ui/include/classes/api/services/CAuditLog.php.