Feature Request: Exclusion Capability in Audit Report

[gingerdazza]

Ticket rasied with support: #02082964

There seems to be a huge flaw in the Infrastructure Changes Audit Report - if you want to exclude a single account, it doesn't JUST exclude that account, it then ticks all the other accounts to have in the report. But, if a new user account uses vSphere later it doesn't get automatically ticked. Ideally we'd like the ability to JUST exclude an account, or use wildcards to include/exclude. In its current form we see now choice but to report on all accounts, which means the report is huge and cumbersome.

Objective: Run an audit report, but exclude account Account1 from the audit report as it is very “noisey” – it runs all backups.
So…
Set Infrastructure Changes Audit report interval to “1 Day”
Now, in “Changed by” section deselect just Account1
The problem is, this doesn’t just exclude this account… what it does, it now makes it a report based only on the ticked accounts. So, if I another user starts using vcenter (perhaps jbloggs.adm) they will not be in the report! This means this report cannot simply exclude specified accounts.
I can demonstrate this by now changing the Interval to 1 Week, and suddenly a few other users appear in there unticked

[Shestakov]

Hello,
Could you clarify the case a bit? Am I correct that if you clear checkbox in the report option excluding a user in "Changed by" the report works fine, but if you schedule it, starting from the second run the user`s event are unexpectedly shown in the report?
Thanks!

[Vitaliy S.]

I guess Dazza is saying that the exclusion list in this report works as inclusion list, so every new account is automatically missed from the report. This should be changed, I agree.

[gingerdazza]

I guess Dazza is saying that the exclusion list in this report works as inclusion list, so every new account is automatically missed from the report. This should be changed, I agree.

Exactly, yes

[Shestakov]

Thanks for the clarification.
I doubt it should be changed though. In opposite case when you schedule a report for 1 user and every new user is to be included to the report automatically it will not be consider as an expected behavior.

[gingerdazza]

Thanks for the clarification.
I doubt it should be changed though. In opposite case when you schedule a report for 1 user and every new user is to be included to the report automatically it will not be consider as an expected behavior.

These two requirements do not need to be mutually exclusive - it seems perfectly viable to me (and desirable) to have the ability to run an audit report for a specified account, whilst also having the ability to exclude a particular account from a report. Just because you want the ability to do one, doesn't mean the facility for the other isn't achievable. It's a simple code change to provide this function. It's going to be a common use case where customers want to run an audit report but exclude very "noisey" accounts such as those used to execute the Veeam work (veeam service account) no?

[Shestakov]

You are right, we will try to make both use cases feasible via UI.
Thanks for the feedback!

[gingerdazza]

Hi Shestakov, was this capability ever rolled into Veeam ONE U3 or v10?

[Shestakov]

Hi, it's not in u3, but still in the roadmap for future releases.
We don't promise features until they are done, but hopefully this one is to be in v10
Thanks

[mbroaders]

Hi did ability to exclude users ever get rolled out? I have similar issues trying to create VMWare Infrastructure Changes Audit reports but have some noisy accounts i need excluded otherwise the reports are too large to have any use.

[RomanK]

Hello Martin,

Currently, "Automatic selection" would include all new users, while manual selection applies only to selected.
Sophisticated report filters are still planned.

Thanks.

[mbroaders]

Thanks RomanK. This is a shame as i can't even select a group so there is no way to dynamically include users or to exclude users.

[RomanK]

Hello Martin,

Understand. May I ask you a question?
How often do you need to reconfigure the report and remove these noisy accounts?

Thanks

[mbroaders]

Thanks RomanK. As it stands the report is unusable to us as we would need to manually select users to audit changes for. This runs a risk of missing users if it is not picked up on when new members join the support department.

When Automatic Selection is used is picks all users in the environment which creates a report so large it tends to crash MS Word on opening.

Solutions here would be to either allow for group selection rather than just user selection and/or allow the ability to exclude users from Automatic selection.

[RomanK]

Hello Martin,

Group selection in such reports seems like an interesting idea. However, audit reports are event-based, in other words, we filter a huge table with events. There is no actual information from AD about users or user groups at all.
Having that, including and excluding lists seems a proper way to resolve the task at the moment.

In any case, I will discuss with our teams the possibility to operate with user groups.
Thanks for the feedback.