Audit & Snapshots

Overview

coreX Manager tracks every configuration mutation as an audit event and creates config snapshots on each apply. This provides a complete change history with the ability to revert to any previous configuration.

Audit Events

Every POST, PUT, DELETE, and PATCH on /api/v1/* is logged as an audit event. GET requests and health checks are not logged.

Event Properties

Property	Description
action	Semantic label (e.g. create_backend, update_listener)
method	HTTP method
path	Request path
resource_type	Type of resource affected
resource_id	ID of the resource
payload	Request body (truncated, secrets redacted)
snapshot_id	Config snapshot this event was bundled into
user_id	ID of the user who made the change
username	Username of the user
ip_address	Source IP of the request
status_code	Response status code
created_at	Timestamp

Action Derivation

Actions are auto-derived from the method and path:

• POST -> create_<resource>
• PUT -> update_<resource>
• DELETE -> delete_<resource>
• Special-case mappings for auth, config lifecycle, cert operations, WAF imports, and feed refreshes

Payload Handling

• Auth paths (login, etc.) are never captured
• POST /certificates (contains private keys) is never captured
• Non-JSON content types are not captured
• Payloads are truncated to 16KB (configurable via AUDIT_PAYLOAD_MAX_BYTES)

Config Snapshots

When you click Apply Changes, coreX Manager:

1. Generates the full HAProxy configuration
2. Validates it
3. Saves a ConfigSnapshot with the complete configuration
4. Stamps all pending (un-applied) audit events with the snapshot ID
5. Applies the configuration to HAProxy

This links every audit event to the snapshot it was included in, showing which changes were bundled together.

Snapshot Properties

Property	Description
id	Unique snapshot ID
config	Full configuration at the time of apply
comment	Optional description
created_at	Timestamp
created_by	User who applied

Revert

You can revert to any previous snapshot:

1. Navigate to Management > Snapshots
2. Select a snapshot
3. Click Revert
4. Confirm the revert

Reverting restores the full configuration from that snapshot and creates a new snapshot for the revert action. This means reverts are themselves audited and can be reverted.

Audit Log Frontend

The audit logs page shows:

• Pending changes (un-applied) at the top with an amber badge
• Applied changes grouped by snapshot below, with expandable groups
• Each event row has an expandable payload JSON viewer
• Filters: username, action, resource, IP address, date range, status (all/pending/applied)

Export

Audit events can be exported as CSV via GET /audit-events/export.

Step-by-Step: Review Pending Changes

1. Navigate to Observability > Audit Logs
2. Pending (un-applied) changes appear at the top with an amber badge
3. Review each pending change:
   • Click a row to expand the payload
   • Check the action, resource, and user
4. Decide whether to apply or revert individual changes before applying

Step-by-Step: Apply and Snapshot

1. Make configuration changes (e.g. add a listener, update a backend)
2. Navigate to the Dashboard
3. Review pending changes in the audit log
4. Click Apply Changes
5. Optionally enter a comment for the snapshot
6. coreX Manager generates, validates, and applies the config
7. A new snapshot is created and all pending events are linked to it

Step-by-Step: Revert to a Previous Config

1. Navigate to Management > Snapshots
2. Browse the list of snapshots (most recent first)
3. Click a snapshot to view its contents
4. Review the configuration to confirm it’s the state you want
5. Click Revert
6. Confirm the revert
7. A new snapshot is created for the revert action
8. HAProxy is reloaded with the reverted configuration

Step-by-Step: Export Audit Events

1. Navigate to Observability > Audit Logs
2. Apply filters (optional): username, action, date range, etc.
3. Click Export CSV
4. The file downloads with all matching events

Verification

1. Make a change and check the audit log:

   # Create a backend (via API or UI)
   curl -k -X POST https://localhost/api/v1/backends -H "Content-Type: application/json" -d '{"name":"test"}'

   Then check the audit logs page — the create_backend event should appear as pending.

2. Apply and verify snapshot:

   • Click Apply Changes
   • Check that the event is now linked to a snapshot
   • Verify the snapshot appears in the snapshots list

3. Revert and verify:

   • Revert to the previous snapshot
   • Verify the backend no longer exists
   • Check that a revert event appears in the audit log

Next Steps

• Users & Settings — Manage users and global settings
• Metrics & Logging — Monitor traffic and access logs
• Quick Start — Get started with coreX Manager