Operation logs
The operation log, under Records, answers questions such as who added this asset, who widened that permission, and who stopped a session. Every call to Casvisor's API is a candidate, from the web UI or from a script.
What each entry holds
| Field | Meaning |
|---|---|
| Created time | When the call was made |
| Organization, User | Who made it |
| Client IP, User agent | From where and with what |
| Method, Request URI | The HTTP call, such as POST /api/update-permission |
| Action | The API action, such as update-permission or stop-session |
| Object | The request body: the asset, permission or session as sent |
| Response | Whether it succeeded, and the error if not |
Passwords sent in an asset are part of the request body, so the log can contain them. Restrict who can read the database accordingly.
What is logged
With logPostOnly = true, the default, only POST calls are logged, which are the ones that change something: adding, updating and deleting assets and permissions, starting and stopping sessions, signing in and out. Set it to false to log reads too, which makes the log far larger. Calls on the log itself are never logged.
Entries are kept until you delete them. There is no retention setting yet; trim the record table from the database if it grows too large.
Sessions
Every connection through Casvisor is a session: who opened it, to which asset, over which protocol, from which address and browser, and for how long. Administrators see live and past sessions and can stop a live one.
Configuration
Every key of Casvisor's conf/app.conf: the HTTP port, the MySQL connection, guacd, the Casdoor application, sessions in Redis and the operation log.