apache / apache/superset

User-Level Audit: Dashboard_id And Slice_id Not Populated In Logs

Open
#38,187 1 comment 3 reactions 0 assignees View on GitHub
api
Dominant language
Python
Stars
74.8k
Forks
18.3k
Avg merge
2d 5h
Merged PRs (30d)
685

Description

### Bug description

While querying user-level auditing using the logs table, we observed that dashboard_id and slice_id are NULL.

For REST API-based actions such as:

- DashboardRestApi.put
- DashboardRestApi.delete
- ChartRestApi.put
- ChartRestApi.post
- ChartRestApi.delete etc.,,

the corresponding object identifiers are not being populated in the logs table.

Although the action column correctly records the type of operation performed, the related object IDs remain NULL. As a result, it is not possible to determine which specific dashboard or chart was modified.

```
SELECT
l.id AS log_id,
u.username AS user,
l.action AS action_type,
l.dashboard_id,
l.slice_id,
l.dttm AS timestamp
FROM logs l
LEFT JOIN ab_user u ON l.user_id = u.id

```


**Database Connection Used**

- Metadata Database: PostgreSQL
- Purpose: Stores Superset metadata including dashboards, charts, users, roles, and logs
- Table Referenced: logs and ab_user
- Access Method: Direct SQL query against the Superset metadata database

Image


**Observed Behavior**

- User actions are logged correctly.
- dashboard_id and slice_id columns are NULL for dashboard/chart modification actions.
- There is no alternative structured reference in the logs table to identify the affected object.


**Expected Behavior**

- dashboard_id should be populated for dashboard-related changes.
- slice_id should be populated for chart-related changes.
- Alternatively, object identifiers should be logged in a structured format to support audit reporting.

Image


**Impact**

This limits the ability to implement proper:
- User-level audit tracking
- Compliance reporting
- Change history tracking
- Governance and traceability controls

### Screenshots/recordings

_No response_

### Superset version

master / latest-dev

### Python version

3.9

### Node version

16

### Browser

Chrome

### Additional context

_No response_

### Checklist

- [ ] I have searched Superset docs and Slack and didn't find a solution to my problem.
- [ ] I have searched the GitHub issue tracker and didn't find a similar bug report.
- [ ] I have checked Superset's logs for errors and if I found a relevant Python stacktrace, I included it here as text in the "additional context" section.

Contributor guide

Open the contributing guide

Research direction

Start by tracing audit-log handling for DashboardRestApi.put/delete and ChartRestApi.put/post/delete, then inspect how the logs table receives dashboard_id and slice_id. Done means dashboard changes populate dashboard_id and chart changes populate slice_id, verified with the provided SQL query.

Written by the indexing model from the issue text.

Assessment

Tech stack
postgresql, python
Domain
api, backend, databases
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.