Audit trails¶

The audit trails service records the events that could have changed the system. It includes the committed configurations, the called RPCs, and the connections to the device.

By default, this functionality is disabled.

To activate it, run the following command:

vsr running config# / system audit-trail enabled true
vsr running alarm# commit
Configuration committed.

The audit trails can then be displayed with the following command:

vsr running config# show audit-trails
type    date                                         user  resources                                     commit id error
====    ====                                         ====  =========                                     ========= =====
rpc     2025-02-04 16:46:50.592809+01:00             admin /vrouter-alarm:purge-alarm(alarm-clearance-st
                                                           atus=any)
commit  2025-02-04 16:45:45.846511+01:00             admin physinterface                                 61
session 2025-02-04 16:45:11+01:00 -                  admin
commit  2025-02-04 16:43:48.628037+01:00             admin audit-trail                                   57
session 2025-02-04 16:42:25+01:00 - 2025-02-04       admin
        16:42:25+01:00

Note

For performance reasons, the list of resources in a commit record will contain all the services present in the configuration when the commit affects many leaves.
The commit ID field has been added after the first implementation of the audit-trail. So, for records created before this update, the field will be set to unknown.