Rule based logging of Queries based on conditions - #464
Draft
kofrezo wants to merge 3 commits into
Draft
Conversation
There was no way to record what a serveradmin query looked for, how long it took, or who ran it - only transient log lines, nothing persisted. Adds an off-by-default, admin-configurable audit log for serveradmin.api.views.dataset_query and serveradmin.servershell.views.get_results. QueryLoggingRule scopes logging to an Application and/or User with its own expiry (enabled_until); a matching, active rule causes a QueryLog row (query text, filters, duration, result count) to be written. Both are managed and viewable in Django Admin.
Application/user targeting alone is often too coarse for debugging one specific issue. Adds an optional trigger_query condition to QueryLoggingRule, reusing the existing query DSL (parse_query, same mechanism as AccessControlGroup.query) so a rule can require the actual query's filters to match specific attribute/value conditions before it gets logged. attr=All() triggers on mere attribute presence regardless of value, reusing the filter library's own destiny() mechanism. Blank (the default) preserves today's unrestricted behavior.
Adds a second, independent optional condition to QueryLoggingRule: a multi-select of attributes (real serverdb attributes plus the hostname/ servertype/object_id/intern_ip specials) that triggers logging when the query's restrict list requests any of them. ANDed with trigger_query when both are set; empty (the default) preserves current behavior. Uses a JSONField (matching QueryLog's existing filters/restrict/order_by convention) plus a custom admin form field with Django's own FilteredSelectMultiple widget, since a plain ManyToManyField(Attribute) can't represent the special attributes.
kofrezo
force-pushed
the
dk_conditional_query_log
branch
from
September 4, 2026 14:24
0724561 to
351ec04
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This change allows to define rules with that contain one or more conditions to log some queries.
If, for example, one wants to log all queries of an application that query attribute X one can do so now.