fix: handled audit log change

[Hardikl]

No description provided.

[Copilot]

Pull request overview

This PR updates SVM security/compliance ingestion and dashboard presentation to handle cases where the audit-log (and CIFS) enabled flags may be missing, ensuring consistent “false/disabled” behavior instead of empty/NaN-driven display artifacts.

Changes:

• Add LabelAgent.replace_regex defaults to coerce missing/empty audit_protocol_enabled and cifs_protocol_enabled labels to false in SVM collectors (ZAPI cdot 9.8.0, REST 9.9.0/9.10.0).
• Update the cMode security Grafana dashboard’s value mappings and column ordering to reflect the corrected audit-log field behavior and avoid misleading special-case mappings.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
grafana/dashboards/cmode/security.json	Updates table value mappings and reorganizes fields to align Audit Log display with corrected label behavior.
conf/zapi/cdot/9.8.0/svm.yaml	Adds regex-based defaults for missing/empty audit/CIFS protocol labels in the ZAPI SVM config.
conf/rest/9.9.0/svm.yaml	Adds regex-based defaults for missing/empty audit/CIFS protocol labels in the REST SVM config.
conf/rest/9.10.0/svm.yaml	Adds regex-based defaults for missing/empty audit/CIFS protocol labels in the REST SVM config.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (3)

grafana/dashboards/cmode/security.json:4260

• In the Cluster Compliance non-compliance expression (refId P / “Compliant” column), the Snapshot Autodelete condition now checks sum(...snapshot_autodelete="true") == 0. This will mark clusters with zero autodelete-enabled volumes as non-compliant, but the “Snapshot Autodelete” column mapping treats 0 as compliant ("No") and >0 as non-compliant ("❌ Yes"), and the panel description says compliance is when snapshot autodelete is disabled.

              "expr": "group by (datacenter, cluster) (\n                            support_labels{asup_enabled=\"true\",asup_https_configured!=\"https\",cluster=~\"$Cluster\",datacenter=~\"$Datacenter\"}\n                          or\n                            security_labels{cluster=~\"$Cluster\",datacenter=~\"$Datacenter\",telnet_enabled=\"true\"}\n                        or\n                          security_labels{cluster=~\"$Cluster\",datacenter=~\"$Datacenter\",rsh_enabled=\"true\"}\n                      or\n                          group by (datacenter, cluster) (\n                            security_account_labels{cluster=~\"$Cluster\",datacenter=~\"$Datacenter\",hash_algorithm=\"md5\"}\n                          )\n                        \u003e\n                          0\n                    or\n                      cluster_peer_labels{cluster=~\"$Cluster\",datacenter=~\"$Datacenter\",encryption_state=\"\"}\n                  or\n                    cluster_peer_labels{cluster=~\"$Cluster\",datacenter=~\"$Datacenter\",encryption_state=\"none\"}\n                or\n                    group by (datacenter, cluster) (\n                      security_account_labels{cluster=~\"$Cluster\",datacenter=~\"$Datacenter\",locked=\"false\"}\n                    )\n                  \u003e\n                    0\n              or\n                security_login_labels{banner=\"\",cluster=~\"$Cluster\",datacenter=~\"$Datacenter\",scope=\"cluster\"}\n            or\n              security_login_labels{cluster=~\"$Cluster\",datacenter=~\"$Datacenter\",svm=~\"$Cluster\"}\n          or\n            count by (datacenter, cluster) (ntpserver_labels{cluster=~\"$Cluster\",datacenter=~\"$Datacenter\"}) \u003c 1\n        or\n          security_audit_destination_status{cluster=~\"$Cluster\",datacenter=~\"$Datacenter\",protocol!=\"tcp_encrypted\"}\n      or\n        security_labels{cluster=~\"$Cluster\",datacenter=~\"$Datacenter\",fips_enabled=\"false\"}\n    or\n      svm_labels{ciphers=~\".*_cbc.*\",cluster=~\"$Cluster\",datacenter=~\"$Datacenter\",svm=~\"$SVM\",type=\"admin\"}\n  or\n    group by (datacenter, cluster) (\n                        (\n                            (\n                                svm_labels{cifs_protocol_enabled=\"true\",cluster=~\"$Cluster\",datacenter=~\"$Datacenter\",svm=~\"$SVM\"}\n                              or\n                                svm_labels{cluster=~\"$Cluster\",datacenter=~\"$Datacenter\",nfs_protocol_enabled=\"true\",svm=~\"$SVM\"}\n                            )\n                          and\n                            svm_labels{audit_protocol_enabled=\"false\",cluster=~\"$Cluster\",datacenter=~\"$Datacenter\",svm=~\"$SVM\"}\n                        )\n                      or\n                        security_ssh_labels{ciphers=~\".*_cbc.*\",cluster=~\"$Cluster\",datacenter=~\"$Datacenter\"}\n                    or\n                      security_login_labels{banner=\"\",cluster=~\"$Cluster\",datacenter=~\"$Datacenter\",scope=\"svm\"}\n                  or\n                    security_login_labels{cluster=~\"$Cluster\",datacenter=~\"$Datacenter\",svm=~\"$SVM\"}\n                or\n                    sum by (datacenter, cluster) (\n                      volume_labels{cluster=~\"$Cluster\",datacenter=~\"$Datacenter\",root_volume=\"No\",snapshot_policy=\"none\"}\n                    )\n                  \u003e\n                    0\n              or\n                  sum by (datacenter, cluster) (\n                    volume_labels{cluster=~\"$Cluster\",datacenter=~\"$Datacenter\",root_volume=\"No\",snapshot_autodelete=\"true\"}\n                  )\n                \u003d\u003d\n                  0\n            or\n                sum by (datacenter, cluster) (\n                  svm_labels{anti_ransomware_state=~\"|.*disabled\",cluster=~\"$Cluster\",datacenter=~\"$Datacenter\",svm=~\"$SVM\"}\n                )\n              \u003e\n                0\n          or\n              volume_arw_status{ArwStatus!=\"Active Mode\",cluster=~\"$Cluster\",datacenter=~\"$Datacenter\"}\n            * on (instance) group_left ()\n              metadata_collector_instances{collector=\"Rest\",datacenter=~\"$Datacenter\",object=\"Volume\"}\n        or\n            count by (datacenter, cluster) (\n              ems_destination_labels{cluster=~\"$Cluster\",datacenter=~\"$Datacenter\"}\n            )\n          \u003e\n            0\n      or\n        support_auto_update_labels{auto_update_enabled=\"false\",cluster=~\"$Cluster\",datacenter=~\"$Datacenter\"}\n    )\n)",

grafana/dashboards/cmode/security.json:4984

• This change removes the "❌" non-compliance indicator for NIS Authentication when it is enabled. The panel description explicitly states that "❌ means this attribute is non-compliant", and other boolean fields still use this convention.

                            "text": "Enabled"

grafana/dashboards/cmode/security.json:4743

• This change removes the "❌" indicator from the NTML Authentication special-case mapping for nan. In this panel, "❌" is used to indicate non-compliance; dropping it makes nan indistinguishable from a compliant "Disabled" state.

                            "text": "Disabled"

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

grafana/dashboards/cmode/security.json:4260

• In the Cluster Compliance non-compliance expression (refId "P"), the Snapshot Autodelete clause now uses == 0 for the count of volumes with snapshot_autodelete="true". Because the "Compliant" column is derived from presence of any non-compliance signal (value 1 => "❌ No", null => "Yes"), == 0 will incorrectly mark compliant clusters (no autodelete-enabled volumes) as non-compliant. This condition should flag when autodelete is enabled, i.e. when the count is > 0.

              "expr": "group by (datacenter, cluster) (\n                            support_labels{asup_enabled=\"true\",asup_https_configured!=\"https\",cluster=~\"$Cluster\",datacenter=~\"$Datacenter\"}\n                          or\n                            security_labels{cluster=~\"$Cluster\",datacenter=~\"$Datacenter\",telnet_enabled=\"true\"}\n                        or\n                          security_labels{cluster=~\"$Cluster\",datacenter=~\"$Datacenter\",rsh_enabled=\"true\"}\n                      or\n                          group by (datacenter, cluster) (\n                            security_account_labels{cluster=~\"$Cluster\",datacenter=~\"$Datacenter\",hash_algorithm=\"md5\"}\n                          )\n                        \u003e\n                          0\n                    or\n                      cluster_peer_labels{cluster=~\"$Cluster\",datacenter=~\"$Datacenter\",encryption_state=\"\"}\n                  or\n                    cluster_peer_labels{cluster=~\"$Cluster\",datacenter=~\"$Datacenter\",encryption_state=\"none\"}\n                or\n                    group by (datacenter, cluster) (\n                      security_account_labels{cluster=~\"$Cluster\",datacenter=~\"$Datacenter\",locked=\"false\",role_name=\"admin\",user_name=\"admin\"}\n                    )\n                  \u003e\n                    0\n              or\n                security_login_labels{banner=\"\",cluster=~\"$Cluster\",datacenter=~\"$Datacenter\",scope=\"cluster\"}\n            or\n              security_login_labels{banner=\"\",cluster=~\"$Cluster\",datacenter=~\"$Datacenter\",svm=~\"$Cluster\"}\n          or\n            count by (datacenter, cluster) (ntpserver_labels{cluster=~\"$Cluster\",datacenter=~\"$Datacenter\"}) \u003c 1\n        or\n          security_audit_destination_status{cluster=~\"$Cluster\",datacenter=~\"$Datacenter\",protocol!=\"tcp_encrypted\"}\n      or\n        security_labels{cluster=~\"$Cluster\",datacenter=~\"$Datacenter\",fips_enabled=\"false\"}\n    or\n      svm_labels{ciphers=~\".*_cbc.*\",cluster=~\"$Cluster\",datacenter=~\"$Datacenter\",svm=~\"$SVM\",type=\"admin\"}\n  or\n    group by (datacenter, cluster) (\n                      (\n                          (\n                              svm_labels{cifs_protocol_enabled=\"true\",cluster=~\"$Cluster\",datacenter=~\"$Datacenter\",svm=~\"$SVM\"}\n                            or\n                              svm_labels{cluster=~\"$Cluster\",datacenter=~\"$Datacenter\",nfs_protocol_enabled=\"true\",svm=~\"$SVM\"}\n                          )\n                        and\n                          svm_labels{audit_protocol_enabled=\"false\",cluster=~\"$Cluster\",datacenter=~\"$Datacenter\",svm=~\"$SVM\"}\n                      )\n                    or\n                      security_ssh_labels{ciphers=~\".*_cbc.*\",cluster=~\"$Cluster\",datacenter=~\"$Datacenter\"}\n                  or\n                    security_login_labels{banner=\"\",cluster=~\"$Cluster\",datacenter=~\"$Datacenter\",scope=\"svm\",svm=~\"$SVM\"}\n                or\n                    sum by (datacenter, cluster) (\n                      volume_labels{cluster=~\"$Cluster\",datacenter=~\"$Datacenter\",root_volume=\"No\",snapshot_policy=\"none\"}\n                    )\n                  \u003e\n                    0\n              or\n                  sum by (datacenter, cluster) (\n                    volume_labels{cluster=~\"$Cluster\",datacenter=~\"$Datacenter\",root_volume=\"No\",snapshot_autodelete=\"true\"}\n                  )\n                ==\n                  0\n            or\n                sum by (datacenter, cluster) (\n                  svm_labels{anti_ransomware_state=~\"|.*disabled\",cluster=~\"$Cluster\",datacenter=~\"$Datacenter\",svm=~\"$SVM\"}\n                )\n              \u003e\n                0\n          or\n              volume_arw_status{ArwStatus!=\"Active Mode\",cluster=~\"$Cluster\",datacenter=~\"$Datacenter\"}\n            * on (instance) group_left ()\n              metadata_collector_instances{collector=\"Rest\",datacenter=~\"$Datacenter\",object=\"Volume\"}\n        or\n            count by (datacenter, cluster) (\n              ems_destination_labels{cluster=~\"$Cluster\",datacenter=~\"$Datacenter\"}\n            )\n          \u003e\n            0\n      or\n        support_auto_update_labels{auto_update_enabled=\"false\",cluster=~\"$Cluster\",datacenter=~\"$Datacenter\"}\n    )\n)",

[Hardikl]

Summary of Fix:

• When audit & cifs protocol Rest/Zapi don't return record, Harvest skip to export audit_protocol_enabled, cifs_protocol_enabled label --> Fixed. Now, not existence would be treated as disabled protocol
• Cross cluster svms query --> Fixed. unless on (svm) changed to unless on (datacenter, cluster, svm)
• Cluster compliant when all volumes autodelete disabled --> Fixed. Doc and query updated accordingly.