Identify when and by who a collection has been deleted.

[ivory sluice]

Hello, what are the ways of identifying, when and by who, a collection has been deleted ?

[dawn field]

Hi, when it is created/updated, you can see it in activity tab of collection.

[ivory sluice]

Thank you, but how about deleted ?

[dawn field]

Hmm not sure about deleted Let me confirm once and get back to you

[ivory sluice]

Thankies

[ivory sluice]

[cunning rock]

Hello @ivory sluice , you can use appwrite events and trigger some function.
databases.*.collections.*.delete

if it is a specific collection:
databases.*.collections.my-collection.delete
here is a list of all events:
https://appwrite.io/docs/events

@ivory sluice if you can write a little more about your use case, we can come up with a pretty cool solution

[ivory sluice]

In the meantime I connected to mariaDb underlying container, and found some info in the audit table. Does that incorporate all events ? Of type collection delete ?

[cunning rock]

I can't tell you how the internals of appwrite work, I'll leave it to someone with more experience

[hollow basin]

unfortunately, the audit data is also deleted when the collection is deleted. You could create a feature request to somehow retain the audit data, though.

[hollow basin]

nice! but that probably doesn't tell you who did it, right? 🧐

[hollow basin]

you could also see if there's any HTTP Access logs that might give you some info too. if it's not enabled, you could try to enable them (on traefik)

[ivory sluice]

@hollow basin , I did manage to track that down, but the process was painful. And I don't feel is right, the reason I managed was based on time event logs from docker, annexed with ip. But not provided by appwrite structure.

[hollow basin]

nice!

[ivory sluice]

Also collection.delete is saved in audit table. Going trough the process seams to stay there, should it get deleted ?

[ivory sluice]

Are there some better logs on the roadmap ?

[hollow basin]

it's not something worked on at the moment, if you want to see better audit logs for deleted collections, please make sure to create an issue

[ivory sluice]

@hollow basin Yes sir, will crate a issue, this is how I found events of sort. But not the friendliest approach. Thankies

[hollow basin]

that's interesting...that should have been deleted 😅 This is the _<number>_audit table, right?

[ivory sluice]

Right