Same for me.
Is there a way to filter out this message in the audit ? The "setting" button is non clickable unfortunatelly.

I wonder if you use puppet module to maintain you Foreman instance. I saw other users reporting that it runs "rake db:seed" with every run which might explain this.

I don't use puppet modules for managing my Foreman instance. However, when using foreman-rake, I'm still getting this output (and also have all the entries in the audit log.

root@sledge:~# foreman-rake config 
Successfully encrypted field for Setting::Auth oauth_consumer_key
Successfully decrypted field for Setting::Auth oauth_consumer_key
Successfully decrypted field for Setting::Auth oauth_consumer_key
Successfully encrypted field for Setting::Auth oauth_consumer_secret
Successfully decrypted field for Setting::Auth oauth_consumer_secret
Successfully decrypted field for Setting::Auth oauth_consumer_secret
[...]

Same for me, I don't manage foreman with puppet, althought the foreman server is managed by puppet, nothing relevant to Foreman is touched with Puppet.

The audit log entries related to this problem "updated Setting: oauth_consumer_secret" come regularly by block of 3-6 at the same time that could match the execution of Puppet agent on the node.

Michael, do you see new audits after running foreman-rake? I think these were different and harmless warnings.

Yvan, what are their times? Does each block start every e.g. 30 minutes? Could you check foreman production.log and see if there's some API call logged there for the same time?

I do see such entries in the audit log after a "foreman-rake config" or "foreman-rake console"

I don't see entries in foreman's production.log or cron.log when running puppet agent manually.

I don't see entries either when running foreman-rake config.

grep -i oauth *log | head
cron.log:Successfully encrypted field for Setting::Auth oauth_consumer_key
cron.log:Successfully decrypted field for Setting::Auth oauth_consumer_key
cron.log:Successfully decrypted field for Setting::Auth oauth_consumer_key
cron.log:Successfully decrypted field for Setting::Auth oauth_consumer_key
cron.log:Successfully encrypted field for Setting::Auth oauth_consumer_secret
cron.log:Successfully decrypted field for Setting::Auth oauth_consumer_secret

1. foreman-rake config
   Successfully encrypted field for Setting::Auth oauth_consumer_key
   Successfully decrypted field for Setting::Auth oauth_consumer_key
   Successfully decrypted field for Setting::Auth oauth_consumer_key
   Successfully decrypted field for Setting::Auth oauth_consumer_key
   Successfully encrypted field for Setting::Auth oauth_consumer_secret
   Successfully decrypted field for Setting::Auth oauth_consumer_secret
   Successfully decrypted field for Setting::Auth oauth_consumer_secret
   Successfully decrypted field for Setting::Auth oauth_consumer_secret
   access_unattended_without_build: false
   administrator: infrastructure@xxxx.yyyy
   always_show_configuration_status: false

Marek Hulán wrote:

I wonder if you use puppet module to maintain you Foreman instance. I saw other users reporting that it runs "rake db:seed" with every run which might explain this.

I'm one of these users - db:seed and db:migrate all over the place. Because of this, we've removed the module from our Foreman servers - we don't want to actually seed/migrate stuff every 30 minutes for every foreman server.

Also, this is/was in 1.12 too.

Chris, would you mind opening a separate issue for this? It seems this one is unrelated.

These messages are making our audit emails completely useless. Every day we get ~210 audits when nothing has been changed. All the audits are the encrypt/decrypt of oauth_consumer_key and oauth_consumer_secret.

We're using ldap auth and as per the recommendations in the documentation we use a cron job running

foreman-rake ldap:refresh_usergroups

to keep our ldap groups refreshed. This cron job results in these audit messages for oauth secret/key. Would be nice to not have them there!

seems to work fine in 1.14.3 for me, just in case anyone else wants to apply this to a production install

would we consider this to 1.15.z ? this is fairly annoying :-)