This article applies to:
- Process/Audit
- Feature Category: Alerts, Dashboards, Version History
Symptoms
- A dashboard or alert was saved with incorrect changes and the previous configuration isn't known.
- A dashboard or alert was changed and an audit is needed for when it was updated and by whom.
- A dashboard or alert was deleted and an audit is needed for when it was deleted and by whom.
Resolution
Version History
Dashboards and alerts have version history that allow for tracking changes. Additionally, revert or clone from a specific version options are available as needed.
Dashboard History
To see dashboard history use the dashboard browser, click the ellipsis of the dashboard in question, and click Versions. Alternatively, while viewing the dashboard click the top right ellipsis and then click Version History.
 |
 |
Dashboard history will include the version, the user, time, and a description of what changes were saved. To clone or revert to a specific version, click the ellipsis by the version number:
Alert History
To see alert history navigate to the alert browser, click the ellipsis of the alert in question, and then click Versions.
Alert history will include the version, the user, time, and a description of what changes were saved. You can clone or revert to a specific version via the ellipsis by the version number:
Deletion History
When dashboards or alerts are deleted, the deletion audit trail is in the form of events as the version history page, /history, is no longer accessible. These events are viewable via the Browse > Events or via a chart using an events() query.
Events Browser
Use the Events Browser to search for the deleted alert or event. To filter for the event:
Search: dashboard-deleted + <dashboard name>
Search: alert-deleted + <alert name>
Note: if your Tanzu Observability tenant has a large amount of events and the deletion event time window is unknown, use the below method to narrow a time window down. There are search limits in place for the event browser.
Chart Query
To query alert or dashboard deletion events in a chart, use the below applicable events() query. Replace <alert name> or <dashboard name> with the alert or dashboard name. This method allows for searching large time windows so one can narrow down an events browser search. However, it does not return the details of the user who deleted the alert or dashboard.
Alert
events(type=alert-deleted and name="Alert Deleted: <alert name>")
Dashboard
events(type=dashboard-deleted and name="Dashboard Deleted: <dashboard name>")
This method does not give the user ID that deleted the dashboard or alert. Use the Events Browser method with the applicable search criteria and narrowed down time window to find the deleted by user ID.
Comments