Compared to 8.1.17 I am seeing new behavior that every tag change made by the system (not by the user) is being sent to the audit log in 8.1.18. I noticed this in our Kafka stream after the tag gateway was updated to 8.1.18:
It looks like 8.1.18 saw the addition of audit events from tag write calls within Perspective sessions. It also seems that a regression was introduced here that also brought in events from any gateway scope (tag event scripts, etc) instead of just Perspective sessions. This might account for some of the increased activity in the audit. This shows to be resolved with 8.1.19.
The way we have it setup is whatever goes to DB is also sent to Kafka so we could only control the Kafka route and whatever happens when an audit record is logged to our MSSQL DB is largely out of our control other than turning it on or off.
I do expect there to be more audit events occurring with 8.1.18+, but hopefully the new ones you’re observing are indeed from Perspective sessions (with the fix from 8.1.19 reducing the unintended additions)?
Looking at the events themselves, they originate from the front end gateway so this does point to them coming from perspective sessions.
However, the volume of audit events is still too much and we do not want to see an audit event for every single tag change that happens due to a perspective session. While we can manage with the retention period on the audit profile, the concern we have is excessive storage consumption without a need for the data.
For users like us that do not want to see all of these events, it seems like there should be an option to shut them off.
I think I mentioned before, but we split the audit events to MSSQL and Kafka so while Kafka is not really a concern for memory, MSSQL always is.