How to Audit Dashboard and Alert Changes

This article applies to:

  • Process/Audit
  • Feature Category: Alerts, Dashboards, Version History

Symptoms

  • A dashboard or alert was saved with incorrect changes and the previous configuration isn't known.
  • A dashboard or alert was changed and an audit is needed for when it was updated and by whom.
  • A dashboard or alert was deleted and an audit is needed for when it was deleted and by whom.

Resolution

Version History

Dashboards and alerts have version history that allow for tracking changes. Additionally, revert or clone from a specific version options are available as needed. 

Dashboard History

To see dashboard history use the dashboard browser, click the ellipsis of the dashboard in question, and click Versions. Alternatively, while viewing the dashboard click the top right ellipsis and then click Version History.

dashboard_browser.png dashboard_directly.png

Dashboard history will include the version, the user, time, and a description of what changes were saved. To clone or revert to a specific version, click the ellipsis by the version number:

2021-01-19_13-02.png

 

Alert History

To see alert history navigate to the alert browser, click the ellipsis of the alert in question, and then click Versions.

alert_browser.png

 

Alert history will include the version, the user, time, and a description of what changes were saved. You can clone or revert to a specific version via the ellipsis by the version number:

alert_history.png

 

Deletion History

When dashboards or alerts are deleted, the deletion audit trail is in the form of events as the version history page, /history, is no longer accessible. These events are viewable via the Browse > Events or via a chart using an events() query. 

Events Browser

Use the Events Browser to search for the deleted alert or event. To filter for the event:

Search: dashboard-deleted + <dashboard name>

event_browser_dashboard.png

Search: alert-deleted + <alert name>event_browser_alert.png

Note: if your Tanzu Observability tenant has a large amount of events and the deletion event time window is unknown, use the below method to narrow a time window down. There are search limits in place for the event browser. 

Chart Query

To query alert or dashboard deletion events in a chart, use the below applicable events() query. Replace <alert name> or <dashboard name> with the alert or dashboard name. This method allows for searching large time windows so one can narrow down an events browser search. However, it does not return the details of the user who deleted the alert or dashboard.

Alert

events(type=alert-deleted and name="Alert Deleted: <alert name>")

Dashboard

events(type=dashboard-deleted and name="Dashboard Deleted: <dashboard name>")

This method does not give the user ID that deleted the dashboard or alert. Use the Events Browser method with the applicable search criteria and narrowed down time window to find the deleted by user ID. 

mceclip0.png

See Also

How to Recover an Inaccessible Dashboard

View Dashboard History

View Alert History

Was this article helpful?
0 out of 0 found this helpful
Have more questions? Submit a request

Comments

Powered by Zendesk