Pending Review

Auditing remove note and persistent auditing.

JasonJCT 4 years ago updated by Simon 3 years ago 3

In the auditing section, I can use the session event type filter and choose Added Note. I would like to have removed note as well. 

But while looking for a way to see if a note was removed I found that Audit logs are not persistent. For example.
Add a note, query the audit log and see that X machine has added a note.  Remove that same note then query the audit log and the event is missing, like I never added the note. 

Note auditing needs to be improved as we are using it for account control for SSO 

Available in Version:

Hi JasonJCT, 

Sounds like you might be using an older version of the product. In a recent release, we now retain the AddedNote event, even if the note is deleted. If the note is deleted, we add EventAttributes: UserDeleted to the entry. 

Just upgraded to 20.2.27450.7387 from 19.6.26378.7317 and still have same issue. I will contact support for assistance.

At first, this feature was included in the release notes for v20.2, but when I upgraded my instance to v20.2 I saw that it wasn't in fact available.

So, I contacted support and I was told that it was included in the release notes by mistake, that it was now moved to v20.3.

Sure enough, when I upgraded to the preview version of v20.3 it was indeed available. I think the stable version will be released soon. I suggest you hold on just a while longer.