Skip to content

fix(audit): timestamp field to first in log #31437

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 4 commits into
base: main
Choose a base branch
from
+4 −1
Open

fix(audit): timestamp field to first in log #31437

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
1d967ff
fix(audit): timestamp field to first in log
saipranav Aug 6, 2025
8c80554
chore: adding changelog
saipranav Aug 6, 2025
ed0dc6b
Merge branch 'hashicorp:main' into main
saipranav Sep 3, 2025
805f0c4
chore: updating changelog from bug to change
saipranav Sep 3, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion audit/types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,13 +10,13 @@ import (
// entry represents an audit entry.
// It could be an entry for a request or response.
type entry struct {
Time string `json:"time,omitempty"`
Auth *auth `json:"auth,omitempty"`
Error string `json:"error,omitempty"`
Forwarded bool `json:"forwarded,omitempty"`
ForwardedFrom string `json:"forwarded_from,omitempty"` // Populated in Enterprise when a request is forwarded
Request *request `json:"request,omitempty"`
Response *response `json:"response,omitempty"`
Time string `json:"time,omitempty"`
Type string `json:"type,omitempty"`
}

Expand Down
3 changes: 3 additions & 0 deletions changelog/31437.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
```release-note:bug
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
```release-note:bug
```release-note:improvement

Is it better to say it is an improvement?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this would need to be called out as a change, since this might have breaking impact for some customers

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That's a good point!

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I am actually wondering how other customers and even enterprise customers are not affected before by this audit log change?
Most of customers should have been using default settings in log parsers, this change was probably introduced in 1.16.x for audit logging refactor.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I assume, change can be merged even for minor releases and not just for major releases. Is my assumption correct?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If we did want to merge this (I'm not yet sure if we do, due to breakage considerations), then this would have to be a major release. We don't release breaking changes in minor releases

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Understood. It is just that we need this badly for upgrading our enterprise servers and we prefer to do it quickly.

Nice idea : if feasible if you can ask enterprise customers if they are affected by the previous change and log parse of event timestamps.

I would call this one a fix or improvement, but I will leave it to you as you all know the system better.

audit: Log entry has time as first field. Useful for log parsers, forwarders for accurate timestamps of events.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
audit: Log entry has time as first field. Useful for log parsers, forwarders for accurate timestamps of events.
audit: Log entry fields are reorganized so time is the first field, which is useful for log parsers and forwarders for accurate timestamps of events.

```