Retrieve the contents of a package audit

[alejeune]

Hello everyone,

I propose a query that will allow you to obtain a list of audit logs for a WAPT package by user who recently logged into the machine. In my example, the target package is 'alj-firefox-esr', which you should replace with your own package.

Code: Select all

SELECT hosts.computer_name,hosts.host_metrics->'last_logged_on_user' as user,
    hostpackagesstatus.last_audit_output,
    hostpackagesstatus.last_audit_status
FROM hostpackagesstatus
LEFT JOIN hosts on hosts.uuid = hostpackagesstatus.host_id
WHERE hostpackagesstatus.last_audit_output ILIKE '%%uninstall%%' AND hostpackagesstatus.package = 'alj-firefox-esr'

A few brief explanations:
The first line allows us to search for our values: the job name, the last logged-in user, the audit statuses.
We are joining the tables hosts And hostpackagesstatus on the UUID of the position.
Finally, we look for a specific term; in the example

Code: Select all

'%%uninstall%%'  

but it can be whatever you want and on which package name you want to retrieve the information.


Have a good rest of the day everyone!

[Gaetan]

Hello,

thank you, the Emocheck package is super helpful:

https://wapt.tranquil.it/store/tis-emocheck