Handy Tips #27: Tracking changes with the improved Zabbix Audit log

Anonymous Anonymous

Zabbix Certified Expert & Trainer

April 14, 2022

Track the creation of new entities, updates to the existing configuration, and potential intrusion attempts with Zabbix audit log. If your monitoring environment is managed by more than a single administrator, it can become hard to track the implemented changes and additions. Having a detailed audit log can help you analyze any potentially unwanted changes […]

Track the creation of new entities, updates to the existing configuration, and potential intrusion attempts with Zabbix audit log.

If your monitoring environment is managed by more than a single administrator, it can become hard to track the implemented changes and additions. Having a detailed audit log can help you analyze any potentially unwanted changes and detect potential intrusion attempts.

Use Zabbix audit log to track changes in your environment:

Track configuration changes and updates
Audit log displays information about Zabbix server and frontend operations

Identify potential intrusion attempts and their source
Filter the audit log by action and resource types

Check out the video to learn how to track changes in Zabbix audit log.

How to track changes in Zabbix audit log:

Navigate to Administration → General → Audit log
Enable and configure your Zabbix audit log settings
Perform a failed login attempt
Check the related entries under Reports → Audit log
Navigate to Configuration → Hosts
Import hosts or templates from a YAML file
Check the related entries under Reports → Audit log
Filter the entries by the Recordset ID
Navigate to Configuration → Hosts
Find a host with a low-level discovery rule on it
Execute the low-level discovery rule
Check the related entries under Reports → Audit log

Tips and best practices

Audit logging should be enabled in the Administration settings to collect audit records
Audit log entry storage period can be defined under Administration → General → Audit log
Each audit log entry belongs to a Recordset ID which is shared by entries created as a result of the same operation
auditlog.get API method can be used to obtain audit log entries via the Zabbix API