Changes
Audit & Report~5 min
The journal of the operations ProxMenux performs on the host and, where it was captured, the state before and after each one.
From the script that ran to the change it made
A long function may change only two lines. The journal keeps each concrete operation with the script, function and version responsible, the resource affected, the difference and whether it can be undone.
Script
function + version
Capture
content before
Operation
file · package · service
Journal
attribution + difference
The capture is taken when the operation runs and is consolidated when the Monitor reads the journal.
Kinds of entry
The filter at the top separates the entries by kind.
| Kind | What it records |
|---|---|
| Configuration | ProxMenux wrote, edited or removed a file, changed a setting or altered a service. |
| Installations | ProxMenux added a package or component, and the packages that actually appeared are recorded. |
| Executions | ProxMenux ran a command; what it changed is up to the command itself. |
| Applied | A function was applied before the journal existed; the state before it was not captured. |
How the view is organised
| Section | Contents |
|---|---|
| Post-install optimizations | Grouped by the post-install option the user selected. |
| ProxMenux scripts | GPU, Coral, network, storage, security, utilities and the other instrumented scripts, including the ProxMenux installer and ProxMenux Monitor. |
| Installed packages and utilities | Software ProxMenux installed on the host. |
Within each section, By function groups the entries under the function that made them.
What each entry shows
- The script, function and version responsible.
- The date and the affected resource.
- The known state before and after the change.
- The lines added and removed.
- The packages that were actually added.
- The state transition of a service.
- Undoing this: Restores exactly what was there, Deletes the file (there was none before), The package can be uninstalled, a partial undo, or Cannot be undone from the journal.
What the state before means
The state before can be captured content, a file created for the first time or an unknown state. Changes made before the journal existed cannot be reconstructed; running the function again captures first the state found at that moment.
Scope of the journal
- Manual changes and changes made by other software are not recorded.
- Only operations that go through the ProxMenux audit primitives are covered.
- Recording never blocks the operation it describes: if the entry cannot be written, the operation goes on.
- Successive changes to one resource are shown as the known origin against the current state.
Stored evidence
| Element | Behaviour |
|---|---|
| Entries | They are kept on the host; nothing is removed from the journal automatically. |
| Captured content | A captured object is kept while an entry refers to it. |
| Size of a capture | Content above 1 MiB is not stored whole; the entry records that the capture was skipped because of its size. |
| Reading | The Monitor does not load stored objects above 2 MiB. |
| Difference | At most 400 lines are shown, and a longer difference is marked as truncated. |
| Listing | The API returns 200 entries per request by default and up to 1000. |
Kept content is not an automatic undo
The content before a change can be inspected and restored by hand, but the Changes view does not revert operations. An execution entry records the command without knowing every effect of the tool it ran.