#AuditLog / ChangeLog plugins not working

1 messages · Page 1 of 1 (latest)

lament ridge
#

I've enabled both plugins as stated here:

But for some reason, I still have no data available ... does this require extra changes, because this is an year old? 🙂

I'm using ZAPI Collector.

/etc/nabox/harvest/user/zapi # ls -la

total 28
drwxr-xr-x. 6 root root 4096 Mar 30 21:37 .
drwxr-xr-x. 4 root root 4096 Mar 30 21:37 ..
drwxr-xr-x. 2 root root 4096 Mar 30 21:37 9.10.0
drwxr-xr-x. 2 root root 4096 Mar 30 21:37 9.12.0
drwxr-xr-x. 2 root root 4096 Mar 30 21:37 9.14.0
drwxr-xr-x. 2 root root 4096 Mar 30 21:37 9.9.0
-rw-r--r--. 1 root root 124 Mar 30 21:37 custom.yaml

/etc/nabox/harvest/user/zapi # cat custom.yaml

objects:
AuditLog: audit_log.yaml
Volume: custom_volume.yaml
SVM: custom_svm.yaml
Node: custom_node.yaml

lament ridge
#

Changing to REST does not make any difference 🤔

earnest light
lament ridge
#

my uploaded filename: nabox-logs-2026-03-31_064408.tgz

earnest light
#

Thanks checking

lament ridge
#

Oh, I see them now after some hours 🙂

#

But only AuditLog is working
Not ChangeLog

earnest light
#

Once enabled only events post enable will show up.

#

Ok I'll check related to ChangeLog

lament ridge
#

I've deleted vols and 1 svm yesterday.

#

OT Question: is it possible to let NAbox/Harvest collect everything that is possible via REST by default and only disable what I really dont need? basically reverse config 🙂

earnest light
#

It is not possible. It is driven via templates.

#

As per logs, I see your custom templates are not loaded at all. Only default ones.

lament ridge
#

Doing this for first time and I simply followed the guides with provided links ... do i have to enable it somewhere else something?

earnest light
#

Your last restart was at Mar 30 22:08:50
Have you made changelog changes after that?

lament ridge
#

yes.

earnest light
#

Ok. Please restart once more and then try

#

If it still doesn't work then share updated logs

lament ridge
#

Sure.

#

I have enabled these config also in default.yaml ... Guess I can remove it from here?

earnest light
#

Yes that is not needed

lament ridge
#

But my custom.yaml and its content is correct, right?

earnest light
#

Yes that looks correct

lament ridge
#

Just restarted again, restored defaults.yaml how it was; so only custom.yaml is active (should be) 🙂

#

I guess simple test would be creating a volume and deleting it?

earnest light
#

Create a volume and delete it after 5 mins

lament ridge
#

alright, just created one, will confirm when I see the volume in dashboard

earnest light
#

Changelog plugin runs every 3 minutes, so if a volume created and deleted in between these 3 mins, it wouldn’t detect it. However, the audit log should capture it.

You can share the support bundle after 10–15 minutes to the same location, and I can check whether the custom.yaml templates were loaded correctly.

lament ridge
#

I should see this somewhere in Dashboards if templates are loaded?

earnest light
#

You can try deleting after 5 mins for changelog to capture it.

earnest light
lament ridge
#

Where is the logfile path?

earnest light
#

It will be in container logs

#

You can download support bundle and search for lines like below

cat containers.log| grep -i best | grep -i rest:volume\ 
#

That should tell you the path loaded for Volume object template.

lament ridge
#

Can't see "create" in AuditLog either in Dashboard.

earnest light
#

It may take 4-5 mins before it to appear in dashboard

lament ridge
#

Shared my support bundle again: nabox-logs-2026-03-31_064408.tgz

#

just in case.

earnest light
lament ridge
#

should be new one?

earnest light
#

Ok. Name is same as the old one.

lament ridge
#

Oh no, sorry

#

nabox-logs-2026-03-31_072537.tgz

earnest light
#

I see it

#

Still same issue.

Mar 31 07:16:56 vie6-infr-nabox1 dc[1676]: havrest           | time=2026-03-31T07:16:56.528Z level=INFO source=helpers.go:113 msg="best-fit template" Poller=xxxx collector=Rest:Volume path=/harvest/conf/rest/9.14.0/volume.yaml v=9.16.1 jitter=none
#

It's not loading from your custom one

lament ridge
#

Is there something else that need to be configured to tell "use custom" also?

earnest light
#

@ionic solstice Any idea if something has changed in NABox?

lament ridge
#

This means my AuditLog is actually was showing because I've enabled in "default.yaml" before 🙂

earnest light
#

I see it enabled in latest logs

Mar 31 07:13:01 vie6-infr-nabox1 dc[1662]: havrest           | time=2026-03-31T07:13:01.751Z level=INFO source=helpers.go:113 msg="best-fit template" Poller=x collector=Rest:AuditLog path=/harvest/conf/rest/9.12.0/audit_log.yaml v=9.16.1 jitter=none
lament ridge
#

I can see my testvolume is in grafana visibile, but no AuditLog or ChangeLog :/

earnest light
#

Do you have AuditLog still enabled in default.yaml?

lament ridge
#

no

#

cat default.yaml | grep AuditLog

AuditLog: audit_log.yaml

earnest light
#

ok, As per logs it is loaded

lament ridge
#

its disabled but here it shows wrong due to format style.

earnest light
#

My NABox is down to check locally.

#

How have you created volume? via Rest API?

lament ridge
#

Its fine, not so urgent ... maybe @ionic solstice knows something if something has changed.
My setup is done fresh; not an upgrade or something 🙂

#

I created test volume via CLI on Storage directly.

earnest light
#

Could you share the CLI, You have used to create volume. I can check locally

lament ridge
#

Its a simple command 😄
vol create -vserver netapp-proxmox -volume test_nabox -state online -size 1GB -space-guarantee none -aggregate aggr1

earnest light
#

Let me check in my dev setup

lament ridge
#

Wait, do I need to enable these also in my custom files?
plugins:

  • ChangeLog:
    • track:
      • node
      • volume
      • svm
      • style
      • type
      • aggr
      • state
      • status
      • junction_path
      • size_total
earnest light
#

Not needed. They are if you want to customize ChangeLog plugin itself

#

We are at a stage where default itself isn't working 🙂

lament ridge
#

I hope my folderpath is correct? I dont need that "cdot" subfolder like zapi?
/etc/nabox/harvest/user/rest/9.14.0

vs when using zapi its
/etc/nabox/harvest/user/zapi/cdot/9.8.0

earnest light
#

Worked fine for me in my dev box. I got below metric

audit_log{datacenter="u2",cluster="umeng-aff300-01-02",application="ssh",location="10.136.197.221",user="admin",op="create",object="volume",volume="test_nabox",svm="osc"} 1774943081

lament ridge
#

can you share folderpath with custom.yaml content once?

#

sometimes .yaml is very strict with lint also when parsing configurations 🙂

earnest light
#

Your audit log is loaded so not a yaml issue.

lament ridge
#

Then I should see my test vol creation 🤔 but I'm not.

earnest light
#

What time did you create this volume?
I have logs till time

Mar 31 07:16:02 xxx dc[1662]: havrest | time=2026-03-31T07:16:02.477Z level=INFO source=collector.go:620 msg=Collected Poller=xxxx collector=Rest:AuditLog apiMs=28 bytesRx=517 calcMs=0 exportMs=0 instances=1 instancesExported=0 metrics=2 metricsExported=0 numCalls=3 parseMs=0 pluginInstances=0 pluginMs=79 pollMs=107 renderedBytes=0 zBegin=1774941362370

lament ridge
#

at this time; i created it.

#

its been almost 40min now.

earnest light
#

okay support bundle latest logs time is Mar 31 07:16:02
so that should have it?

lament ridge
#

I can create later one; can wait for some time 🙂

earnest light
#

From older time, It did collect something

time=2026-03-30T22:17:55.234Z level=INFO source=collector.go:620 msg=Collected Poller=xxx collector=Rest:AuditLog apiMs=17 bytesRx=947 calcMs=0 exportMs=0 instances=1 instancesExported=1 metrics=2 metricsExported=1 numCalls=3 parseMs=0 pluginInstances=0 pluginMs=69 pollMs=86 renderedBytes=200 zBegin=1774909075148
time=2026-03-30T22:47:55.414Z level=INFO source=collector.go:620 msg=Collected Poller=xxx collector=Rest:AuditLog apiMs=30 bytesRx=5325 calcMs=0 exportMs=0 instances=1 instancesExported=11 metrics=2 **metricsExported=11 **numCalls=3 parseMs=0 pluginInstances=0 pluginMs=90 pollMs=121 renderedBytes=2283 zBegin=1774910875293

lament ridge
#

only AuditLog or also ChangeLog?

earnest light
#

ChangeLog is never active so far in logs

lament ridge
#

which is weird, because its all setup by the guide 😄

earnest light
#

@ionic solstice says he'll look into this. There may be a file system issue in setup.

lament ridge
#

and it uses same custom.yaml file.

earnest light
#

He expects an active folder also in support bundle which is missing.

#

The AuditLog template is loading. From the logs, I only see two collections after the restart. It’s possible that you created the volume some time after this restart. Could you upload a fresh support bundle?

lament ridge
#

nabox-logs-2026-03-31_080307.tgz

at this stage, it should have detected a volume offline/delete of that one test-volume I've created 🙂

earnest light
#

OK, there have been a couple of restarts since the last logs, and I can see that AuditLog isn’t loaded at all, so it makes sense that we don’t have the data. The issue is that our custom changes aren’t being applied for either Changelog or AuditLog.

#

@ionic solstice can help at this stage to check on NABox side.

lament ridge
#

Thanks for checking! Will wait for a response then.

ionic solstice
#

So, it seems you don't have a /etc/nabox/harvest/nabox folder ?

#

please create that directory mkdir /etc/nabox/harvest/nabox and restart harvest dc restart havrest

lament ridge
#

there is no folder, true

#

done.

#

Its a full scratch setup in Proxmox Environment using your Guide 🙂
just a suggestion, update documentation where to write the network config and need to set hostname and update /etc/hosts ... will be very helpful for beginners 😉

#

I know this from past, but for new comers who never worked with networkd will be a pain.

#

Now, I see my changes 🥳

#

Thank you very much! I wonder why that folder was not created with installation?

earnest light
#

Nice!! Thanks @ionic solstice

lament ridge
#

Is there a way to see all changes in AuditLog not only volume related? 🙂 just curious.

earnest light
#

Currently only support is for volume. Please open an issue if you like us to monitor other objects via this plugin.