Returning resource type and/or ID in AuditEvents
# supportb
brendankeeler
09/07/2023, 6:25 PMCurrently in Medplum AuditEvent creation / logging, we see successful writes include the resource ID and type.
However, failed writes have little context to understand which originating request they correspond to:
Copy code
{
action
U
agent
[...]
meta
{
project
<UUID>
}
outcome
4
outcomeDesc
Too Many Requests
recorded
2023-09-07T17:53:44.339Z
resourceType
AuditEvent
service
flexpa_medplum
source
stdout
subtype
[
{
code
update
display
update
system
http://hl7.org/fhir/restful-interaction
}
]
timestamp
1694109224340
type
{
code
rest
display
Restful Operation
system
http://terminology.hl7.org/CodeSystem/audit-event-type
}
}r
rahul1
09/07/2023, 10:41 PM@brendankeeler I don't think your missing anything. I think this is a reasonable request, and we can take a look at it!
r
reshma
10/23/2023, 9:17 PM@brendankeeler - this should be fixed. Let us know if you bump into any related issues
j
joshua_kelly
10/31/2023, 3:17 AM@reshma can you confirm the issue / PR that fixed this? We last observed this on Oct 27 and have been running the
latestjoshua_kelly
10/31/2023, 3:17 AMI tried finding it in the Github search of course, but couldn't find a reasonable sounding matching issue
r
reshma
10/31/2023, 6:34 PMI assumed it would be this one... https://github.com/medplum/medplum/pull/2837 - but perhaps I'm mistaken?
j
jakxz
10/31/2023, 9:23 PMI can confirm we deployed v2.1.10 in the last 24h and are not seeing the resourceType or ID in the AuditEvent logs
jakxz
10/31/2023, 9:29 PMHere's a recent AuditEvent with an error we're trying to debug -
Copy code
{
"agent": [
{
"requestor": true,
"who": {
"reference": "ClientApplication/xxxx-a9f0d0448f1a",
"display": "flexpa-client"
}
}
],
"source": "stdout",
"type": {
"system": "http://terminology.hl7.org/CodeSystem/audit-event-type",
"code": "rest",
"display": "Restful Operation"
},
"recorded": "2023-10-31T18:29:10.270Z",
"subtype": [
{
"system": "http://hl7.org/fhir/restful-interaction",
"code": "update",
"display": "update"
}
],
"service": "flexpa_medplum",
"meta": {
"project": "xxxx-7db1d71a27ae"
},
"outcomeDesc": "Invalid additional property \"identifier\" (identifier)",
"action": "U",
"outcome": "4",
"timestamp": 1698776950271,
"resourceType": "AuditEvent"
}r
rahul1
10/31/2023, 10:56 PMHi guys, we mispoke earlier. The task was broken up into a few different GH issues.
The one that solves your request here: https://github.com/medplum/medplum/issues/2994
rahul1
10/31/2023, 10:58 PMIn that Issue, we also point to our guide on using AWS Athena to search the ELB logs. This can be a good tool to find the specific requests that throw 400 errors
j
joshua_kelly
11/01/2023, 12:55 AMIn this particular case, the AuditEvent is generated from a Batch Transaction @rahul1 - so the ELB logs won't help us to identify the exact operation (if I'm reading this correctly)
joshua_kelly
11/01/2023, 1:04 AMThough, looking closer - the AuditEvent is optionally expected to have an entity.what field with the resource: https://github.com/medplum/medplum/blob/main/packages/server/src/util/auditevent.ts#L184C1-L194C2
But in fhir/repo.ts the error case for each of the operations doesn't pass the resource: https://github.com/medplum/medplum/blob/main/packages/server/src/fhir/repo.ts#L443
I think it makes sense to do this though - I'll submit a PR and we can take feedback there
r
rahul1
11/01/2023, 1:10 AMThanks! That would be helpful
j
joshua_kelly
11/01/2023, 1:13 AMIt works in a couple of cases, and most importantly in the Update operation - because the function accepts a Resource as is
async updateResource<T extends Resource>(resource: T)this.logEvent(UpdateInteraction, AuditEventOutcome.MinorFailure, err, resource);joshua_kelly
11/01/2023, 1:19 AM178 Views