From dd9938114c7e21c85a1ba06593bad20ca396df6e Mon Sep 17 00:00:00 2001
From: JianBo He <heeejianbo@gmail.com>
Date: Wed, 27 Sep 2023 20:10:30 +0800
Subject: [PATCH] chore(audit): add from field

---
 apps/emqx/include/logger.hrl                      | 6 ++++--
 apps/emqx/src/emqx_trace/emqx_trace.erl           | 9 +++++++--
 apps/emqx_ctl/src/emqx_ctl.erl                    | 2 +-
 apps/emqx_dashboard/src/emqx_dashboard_audit.erl  | 2 +-
 apps/emqx_machine/src/emqx_machine_boot.erl       | 2 +-
 apps/emqx_machine/src/emqx_machine_terminator.erl | 4 ++--
 apps/emqx_machine/src/emqx_restricted_shell.erl   | 2 +-
 7 files changed, 17 insertions(+), 10 deletions(-)

diff --git a/apps/emqx/include/logger.hrl b/apps/emqx/include/logger.hrl
index 9bff4b293..7ec18420c 100644
--- a/apps/emqx/include/logger.hrl
+++ b/apps/emqx/include/logger.hrl
@@ -61,7 +61,9 @@
     )
 end).
 
--define(AUDIT(_Level_, _Msg_, _Meta_), begin
+-define(AUDIT(_Level_, _From_, _Meta_), ?AUDIT(_Level_, _From_, undefined, _Meta_)).
+
+-define(AUDIT(_Level_, _From_, _Msg_, _Meta_), begin
     case emqx_config:get([log, audit], #{enable => false}) of
         #{enable := false} ->
             ok;
@@ -72,7 +74,7 @@ end).
                         _Level_,
                         [{emqx_audit, fun(L, _) -> L end, undefined, undefined}],
                         {report, _Msg_},
-                        _Meta_
+                        _Meta_#{from => _From_}
                     );
                 gt ->
                     ok
diff --git a/apps/emqx/src/emqx_trace/emqx_trace.erl b/apps/emqx/src/emqx_trace/emqx_trace.erl
index 99bbcc5f9..37b9d4ab5 100644
--- a/apps/emqx/src/emqx_trace/emqx_trace.erl
+++ b/apps/emqx/src/emqx_trace/emqx_trace.erl
@@ -87,8 +87,13 @@ log(List, Msg, Meta) ->
     log(debug, List, Msg, Meta).
 
 log(Level, List, Msg, Meta) ->
-    Log = #{level => Level, meta => enrich_meta(Meta), msg => Msg},
-    log_filter(List, Log).
+    Log = #{level => Level, meta => enrich_meta(Meta)},
+    Log1 =
+        case Msg of
+            undefined -> Log;
+            _ -> maps:put(msg, Msg, Log)
+        end,
+    log_filter(List, Log1).
 
 enrich_meta(Meta) ->
     case logger:get_process_metadata() of
diff --git a/apps/emqx_ctl/src/emqx_ctl.erl b/apps/emqx_ctl/src/emqx_ctl.erl
index 8b3eb8058..ad51de837 100644
--- a/apps/emqx_ctl/src/emqx_ctl.erl
+++ b/apps/emqx_ctl/src/emqx_ctl.erl
@@ -145,7 +145,7 @@ run_command(Cmd, Args) when is_atom(Cmd) ->
 
     audit_log(
         audit_level(Result, Duration),
-        "from_cli",
+        cli,
         #{duration_ms => Duration, cmd => Cmd, args => Args, node => node()}
     ),
     Result.
diff --git a/apps/emqx_dashboard/src/emqx_dashboard_audit.erl b/apps/emqx_dashboard/src/emqx_dashboard_audit.erl
index 5fdc68f70..443c62e7c 100644
--- a/apps/emqx_dashboard/src/emqx_dashboard_audit.erl
+++ b/apps/emqx_dashboard/src/emqx_dashboard_audit.erl
@@ -30,7 +30,7 @@ log(Meta0) ->
     Meta = emqx_utils:redact(Meta2),
     ?AUDIT(
         Level,
-        "from_api",
+        rest_api,
         Meta#{
             from => from(maps:get(auth_type, Meta0, "")),
             username => binary_to_list(Username),
diff --git a/apps/emqx_machine/src/emqx_machine_boot.erl b/apps/emqx_machine/src/emqx_machine_boot.erl
index 610931ce0..05caf8742 100644
--- a/apps/emqx_machine/src/emqx_machine_boot.erl
+++ b/apps/emqx_machine/src/emqx_machine_boot.erl
@@ -47,7 +47,7 @@ post_boot() ->
     ok = ensure_apps_started(),
     ok = print_vsn(),
     ok = start_autocluster(),
-    ?AUDIT(alert, "from_cli", #{time => logger:timestamp(), event => "emqx_start"}),
+    ?AUDIT(alert, cli, #{time => logger:timestamp(), event => "emqx_start"}),
     ignore.
 
 -ifdef(TEST).
diff --git a/apps/emqx_machine/src/emqx_machine_terminator.erl b/apps/emqx_machine/src/emqx_machine_terminator.erl
index 54452ef41..fe857ff36 100644
--- a/apps/emqx_machine/src/emqx_machine_terminator.erl
+++ b/apps/emqx_machine/src/emqx_machine_terminator.erl
@@ -67,8 +67,8 @@ graceful() ->
 
 %% @doc Shutdown the Erlang VM and wait indefinitely.
 graceful_wait() ->
-    ?AUDIT(alert, "from_cli", #{
-        time => logger:timestamp(), msg => "run_emqx_stop_to_grace_shutdown"
+    ?AUDIT(alert, cli, run_emqx_stop_to_grace_shutdown, #{
+        time => logger:timestamp()
     }),
     ok = graceful(),
     exit_loop().
diff --git a/apps/emqx_machine/src/emqx_restricted_shell.erl b/apps/emqx_machine/src/emqx_restricted_shell.erl
index 115fa478f..77806aa85 100644
--- a/apps/emqx_machine/src/emqx_restricted_shell.erl
+++ b/apps/emqx_machine/src/emqx_restricted_shell.erl
@@ -112,7 +112,7 @@ max_heap_size_warning(MF, Args) ->
 log(_, {?MODULE, prompt_func}, [[{history, _}]]) ->
     ok;
 log(IsAllow, MF, Args) ->
-    ?AUDIT(warning, "from_remote_console", #{
+    ?AUDIT(warning, remote_console, #{
         time => logger:timestamp(),
         function => MF,
         args => pp_args(Args),