........S. [ZBXNEXT-6830] Update from branch 'feature/ZBXNEXT-6817-5.5' of https://git.zabbix.com/scm/zbx/zabbix into feature/ZBXNEXT-6830-5.5-test

1 files changed, 313 insertions, 59 deletions

diff --git a/src/libs/zbxaudit/audit_item.c b/src/libs/zbxaudit/audit_item.c
index 5d332bace4a..e2d59753fad 100644
--- a/src/libs/zbxaudit/audit_item.c
+++ b/src/libs/zbxaudit/audit_item.c
@@ -78,7 +78,7 @@ PREPARE_AUDIT_ITEM_CREATE(item, AUDIT_RESOURCE_ITEM)
 #define ONLY_ITEM_PROTOTYPE (AUDIT_RESOURCE_ITEM_PROTOTYPE == resource_type)
 #define ONLY_LLD_RULE (AUDIT_RESOURCE_DISCOVERY_RULE == resource_type)
 
-void	zbx_audit_item_add_data(zbx_uint64_t itemid, const zbx_template_item_t *item, zbx_uint64_t hostid)
+void	zbx_audit_item_update_json_add_data(zbx_uint64_t itemid, const zbx_template_item_t *item, zbx_uint64_t hostid)
 {
 	int	resource_type;
 
@@ -88,12 +88,14 @@ void	zbx_audit_item_add_data(zbx_uint64_t itemid, const zbx_template_item_t *ite
 
 #define ONLY_ITEM_AND_ITEM_PROTOTYPE (AUDIT_RESOURCE_ITEM == resource_type || \
 		AUDIT_RESOURCE_ITEM_PROTOTYPE == resource_type)
-#define IT_OR_ITP(s) ONLY_ITEM ? "item."#s : (ONLY_ITEM_PROTOTYPE ? "itemprototype."#s : "discoveryrule."#s)
-#define ADD_JSON_S(x)	zbx_audit_update_json_append_string(itemid, AUDIT_DETAILS_ACTION_ADD, IT_OR_ITP(x), item->x)
-#define ADD_JSON_UI(x)	zbx_audit_update_json_append_uint64(itemid, AUDIT_DETAILS_ACTION_ADD, IT_OR_ITP(x), item->x)
-	zbx_audit_update_json_append_uint64(itemid, AUDIT_DETAILS_ACTION_ADD, IT_OR_ITP(itemid), itemid);
+#define IT_OR_ITP_OR_DR(s) ONLY_ITEM ? "item."#s : (ONLY_ITEM_PROTOTYPE ? "itemprototype."#s : "discoveryrule."#s)
+#define ADD_JSON_S(x)	zbx_audit_update_json_append_string(itemid, AUDIT_DETAILS_ACTION_ADD, IT_OR_ITP_OR_DR(x),\
+		item->x)
+#define ADD_JSON_UI(x)	zbx_audit_update_json_append_uint64(itemid, AUDIT_DETAILS_ACTION_ADD, IT_OR_ITP_OR_DR(x),\
+		item->x)
+	zbx_audit_update_json_append_uint64(itemid, AUDIT_DETAILS_ACTION_ADD, IT_OR_ITP_OR_DR(itemid), itemid);
 	ADD_JSON_S(delay);
-	zbx_audit_update_json_append_uint64(itemid, AUDIT_DETAILS_ACTION_ADD, IT_OR_ITP(hostid), hostid);
+	zbx_audit_update_json_append_uint64(itemid, AUDIT_DETAILS_ACTION_ADD, IT_OR_ITP_OR_DR(hostid), hostid);
 	/* ruleid is REQUIRED for item prototype */
 	ADD_JSON_UI(interfaceid);
 	ADD_JSON_S(key); // API HAS 'key_' , but SQL 'key'
@@ -147,24 +149,26 @@ void	zbx_audit_item_add_data(zbx_uint64_t itemid, const zbx_template_item_t *ite
 	if ONLY_ITEM_AND_ITEM_PROTOTYPE ADD_JSON_UI(valuemapid);
 	ADD_JSON_UI(verify_host);
 	ADD_JSON_UI(verify_peer);
-	/* discover - only for item */
 	/* ITEM API FINISHED */
 
 	/* application - handled later
 	preprocessing - handled later */
 
+	if ONLY_ITEM_PROTOTYPE ADD_JSON_UI(discover);
+
 	if ONLY_LLD_RULE
 	{
-		ADD_JSON_S(formula);
-		ADD_JSON_UI(evaltype);
-		ADD_JSON_UI(discover);
+		zbx_audit_update_json_append_string(itemid, AUDIT_DETAILS_ACTION_ADD,
+				IT_OR_ITP_OR_DR("filter.formula"), item->formula);
+		zbx_audit_update_json_append_uint64(itemid, AUDIT_DETAILS_ACTION_ADD,
+				IT_OR_ITP_OR_DR("filter.evaltype"), item->evaltype);
 	}
 #undef ADD_JSON_UI
 #undef ADD_JSON_S
 #undef IT_OR_ITP
 }
 
-void	zbx_audit_item_add_lld_data(zbx_uint64_t itemid, const zbx_lld_item_full_t *item,
+void	zbx_audit_item_update_json_add_lld_data(zbx_uint64_t itemid, const zbx_lld_item_full_t *item,
 		const zbx_lld_item_prototype_t *item_prototype, zbx_uint64_t hostid)
 {
 	RETURN_IF_AUDIT_OFF();
@@ -299,14 +303,70 @@ PREPARE_AUDIT_ITEM_UPDATE(key,			const char*,	string)
 #undef ONLY_LLD_RULE
 #undef IT_OR_ITP
 
+static void	zbx_audit_item_create_entry_for_delete(zbx_uint64_t id, char *name, int resource_type)
+{
+	zbx_audit_entry_t	local_audit_item_entry, **found_audit_item_entry;
+	zbx_audit_entry_t	*local_audit_item_entry_x = &local_audit_item_entry;
+
+	RETURN_IF_AUDIT_OFF();
+
+	local_audit_item_entry.id = id;
+
+	found_audit_item_entry = (zbx_audit_entry_t**)zbx_hashset_search(zbx_get_audit_hashset(),
+			&(local_audit_item_entry_x));
+	if (NULL == found_audit_item_entry)
+	{
+		zbx_audit_entry_t	*local_audit_item_entry_insert;
+
+		local_audit_item_entry_insert = (zbx_audit_entry_t*)zbx_malloc(NULL, sizeof(zbx_audit_entry_t));
+		local_audit_item_entry_insert->id = id;
+		local_audit_item_entry_insert->name = zbx_strdup(NULL, name);
+		local_audit_item_entry_insert->audit_action = AUDIT_ACTION_DELETE;
+		local_audit_item_entry_insert->resource_type = resource_type;
+
+		zbx_json_init(&(local_audit_item_entry_insert->details_json), ZBX_JSON_STAT_BUF_LEN);
+		zbx_hashset_insert(zbx_get_audit_hashset(), &local_audit_item_entry_insert,
+				sizeof(local_audit_item_entry_insert));
+	}
+}
+
+/******************************************************************************
+ *                                                                            *
+ * Function: DBselect_for_item                                                *
+ *                                                                            *
+ * Parameters: sql - [IN] sql statement                                       *
+ *             ids - [OUT] sorted list of selected uint64 values              *
+ *                                                                            *
+ ******************************************************************************/
+void	DBselect_delete_for_item(const char *sql, zbx_vector_uint64_t *ids)
+{
+	DB_RESULT	result;
+	DB_ROW		row;
+	zbx_uint64_t	id;
+
+	result = DBselect("%s", sql);
+
+	while (NULL != (row = DBfetch(result)))
+	{
+		ZBX_STR2UINT64(id, row[0]);
+		zbx_vector_uint64_append(ids, id);
+		zbx_audit_item_create_entry_for_delete(id, row[1], item_flag_to_resource_type(atoi(row[2])));
+	}
+	DBfree_result(result);
+
+	zbx_vector_uint64_sort(ids, ZBX_DEFAULT_UINT64_COMPARE_FUNC);
+}
+
 void	zbx_audit_discovery_rule_update_json_add_overrides_conditions(zbx_uint64_t itemid,
 		zbx_uint64_t item_conditionid, zbx_uint64_t op, const char *macro, const char *value)
 {
-	char	audit_key_operator[AUDIT_DETAILS_KEY_LEN], audit_key_macro[AUDIT_DETAILS_KEY_LEN],
-		audit_key_value[AUDIT_DETAILS_KEY_LEN];
+	char	audit_key[AUDIT_DETAILS_KEY_LEN], audit_key_operator[AUDIT_DETAILS_KEY_LEN],
+		audit_key_macro[AUDIT_DETAILS_KEY_LEN], audit_key_value[AUDIT_DETAILS_KEY_LEN];
 
 	RETURN_IF_AUDIT_OFF();
 
+	zbx_snprintf(audit_key, sizeof(audit_key),
+			"discoveryrule.overrides[" ZBX_FS_UI64 "].filter.conditions", item_conditionid);
 	zbx_snprintf(audit_key_operator, sizeof(audit_key_operator),
 			"discoveryrule.overrides[" ZBX_FS_UI64 "].filter.conditions.operator", item_conditionid);
 	zbx_snprintf(audit_key_macro, sizeof(audit_key_macro),
@@ -314,13 +374,27 @@ void	zbx_audit_discovery_rule_update_json_add_overrides_conditions(zbx_uint64_t
 	zbx_snprintf(audit_key_value, sizeof(audit_key_value),
 			"discoveryrule.overrides[" ZBX_FS_UI64 "].filter.conditions.value", item_conditionid);
 
+	zbx_audit_update_json_append_no_value(itemid, AUDIT_DETAILS_ACTION_ADD, audit_key);
 	zbx_audit_update_json_append_uint64(itemid, AUDIT_DETAILS_ACTION_ADD, audit_key_operator, op);
 	zbx_audit_update_json_append_string(itemid, AUDIT_DETAILS_ACTION_ADD, audit_key_macro, macro);
 	zbx_audit_update_json_append_string(itemid, AUDIT_DETAILS_ACTION_ADD, audit_key_value, value);
 }
 
+void	zbx_audit_discovery_rule_update_json_update_filter_conditions_create_entry(zbx_uint64_t itemid,
+		zbx_uint64_t item_conditionid)
+{
+	char	audit_key[AUDIT_DETAILS_KEY_LEN];
+
+	RETURN_IF_AUDIT_OFF();
+
+	zbx_snprintf(audit_key, sizeof(audit_key),
+			"discoveryrule.overrides[" ZBX_FS_UI64 "].filter.conditions", item_conditionid);
+
+	zbx_audit_update_json_append_no_value(itemid, AUDIT_DETAILS_ACTION_UPDATE, audit_key);
+}
+
 #define PREPARE_AUDIT_DISCOVERY_RULE_UPDATE(resource, type1, type2)						\
-void	zbx_audit_discovery_rule_update_json_update_##resource(zbx_uint64_t itemid,				\
+void	zbx_audit_discovery_rule_update_json_update_filter_conditions_##resource(zbx_uint64_t itemid,		\
 		zbx_uint64_t item_conditionid, type1 resource##_old, type1 resource##_new)			\
 {														\
 	char	audit_key_##resource[AUDIT_DETAILS_KEY_LEN];							\
@@ -345,33 +419,50 @@ void	zbx_audit_discovery_rule_update_json_delete_overrides_conditions(zbx_uint64
 
 	RETURN_IF_AUDIT_OFF();
 
-	zbx_snprintf(buf, sizeof(buf),
-			"discoveryrule.overrides[" ZBX_FS_UI64 "]", item_conditionid);
+	zbx_snprintf(buf, sizeof(buf), "discoveryrule.overrides[" ZBX_FS_UI64 "]", item_conditionid);
 
 	zbx_audit_update_json_delete(itemid, AUDIT_DETAILS_ACTION_DELETE, buf);
 }
 
-void	zbx_audit_discovery_rule_update_json_add_discovery_rule_preproc(zbx_uint64_t itemid,
-		zbx_uint64_t item_preprocid, int step, int type, const char *params, int error_handler,
-		const char *error_handler_params)
+#define ITEM_RESOURCE_KEY_RESOLVE_PREPROC(resource, nested)							\
+	if (AUDIT_RESOURCE_ITEM == resource_type)								\
+	{													\
+		zbx_snprintf(audit_key_##resource, sizeof(audit_key_##resource), "item.preprocessing[" ZBX_FS_UI64 \
+				"]"#nested#resource, preprocid);						\
+	}													\
+	else if (AUDIT_RESOURCE_ITEM_PROTOTYPE == resource_type)						\
+	{													\
+		zbx_snprintf(audit_key_##resource, sizeof(audit_key_##resource), "itemprototype.preprocessing["	\
+				ZBX_FS_UI64 "]"#nested#resource, preprocid);				\
+	}													\
+	else if (AUDIT_RESOURCE_DISCOVERY_RULE == resource_type)						\
+	{													\
+		zbx_snprintf(audit_key_##resource, sizeof(audit_key_##resource), "discoveryrule.preprocessing["	\
+				ZBX_FS_UI64 "]"#resource, preprocid);					\
+	}													\
+	else													\
+		THIS_SHOULD_NEVER_HAPPEN;
+
+void	zbx_audit_item_update_json_add_item_preproc(zbx_uint64_t itemid, zbx_uint64_t preprocid, int item_flags,
+		int step, int type, const char *params, int error_handler, const char *error_handler_params)
 {
-	char	audit_key_step[AUDIT_DETAILS_KEY_LEN], audit_key_type[AUDIT_DETAILS_KEY_LEN],
-		audit_key_params[AUDIT_DETAILS_KEY_LEN], audit_key_error_handler[AUDIT_DETAILS_KEY_LEN],
-		audit_key_error_handler_params[AUDIT_DETAILS_KEY_LEN];
+	int	resource_type;
+	char	audit_key_[AUDIT_DETAILS_KEY_LEN], audit_key_step[AUDIT_DETAILS_KEY_LEN],
+		audit_key_type[AUDIT_DETAILS_KEY_LEN], audit_key_params[AUDIT_DETAILS_KEY_LEN],
+		audit_key_error_handler[AUDIT_DETAILS_KEY_LEN], audit_key_error_handler_params[AUDIT_DETAILS_KEY_LEN];
 
 	RETURN_IF_AUDIT_OFF();
 
-	zbx_snprintf(audit_key_step, sizeof(audit_key_step),
-			"discoveryrule.preprocessing[" ZBX_FS_UI64 "].step", item_preprocid);
-	zbx_snprintf(audit_key_type, sizeof(audit_key_type),
-			"discoveryrule.preprocessing[" ZBX_FS_UI64 "].type", item_preprocid);
-	zbx_snprintf(audit_key_params, sizeof(audit_key_params),
-			"discoveryrule.preprocessing[" ZBX_FS_UI64 "].params", item_preprocid);
-	zbx_snprintf(audit_key_error_handler, sizeof(audit_key_error_handler),
-			"discoveryrule.preprocessing[" ZBX_FS_UI64 "].error_handler", item_preprocid);
-	zbx_snprintf(audit_key_error_handler_params, sizeof(audit_key_error_handler_params),
-			"discoveryrule.preprocessing[" ZBX_FS_UI64 "].error_handler_params", item_preprocid);
+	resource_type = item_flag_to_resource_type(item_flags);
+
+	ITEM_RESOURCE_KEY_RESOLVE_PREPROC(,)
+	ITEM_RESOURCE_KEY_RESOLVE_PREPROC(step, .)
+	ITEM_RESOURCE_KEY_RESOLVE_PREPROC(type, .)
+	ITEM_RESOURCE_KEY_RESOLVE_PREPROC(params, .)
+	ITEM_RESOURCE_KEY_RESOLVE_PREPROC(error_handler, .)
+	ITEM_RESOURCE_KEY_RESOLVE_PREPROC(error_handler_params, .)
 
+	zbx_audit_update_json_append_no_value(itemid, AUDIT_DETAILS_ACTION_ADD, audit_key_);
 	zbx_audit_update_json_append_int(itemid, AUDIT_DETAILS_ACTION_ADD, audit_key_step, step);
 	zbx_audit_update_json_append_int(itemid, AUDIT_DETAILS_ACTION_ADD, audit_key_type, type);
 	zbx_audit_update_json_append_string(itemid, AUDIT_DETAILS_ACTION_ADD, audit_key_params, params);
@@ -379,24 +470,140 @@ void	zbx_audit_discovery_rule_update_json_add_discovery_rule_preproc(zbx_uint64_
 	zbx_audit_update_json_append_string(itemid, AUDIT_DETAILS_ACTION_ADD, audit_key_step, error_handler_params);
 }
 
-#define PREPARE_AUDIT_DISCOVERY_RULE_UPDATE_PREPROC(resource, type1, type2)					\
-void	zbx_audit_discovery_rule_update_json_update_discovery_rule_preproc_##resource(zbx_uint64_t itemid,	\
+void	zbx_audit_item_update_json_update_item_preproc_create_entry(zbx_uint64_t itemid, int item_flags,
+		zbx_uint64_t preprocid)
+{
+	int	resource_type;
+	char	audit_key_[AUDIT_DETAILS_KEY_LEN];
+
+	RETURN_IF_AUDIT_OFF();
+
+	resource_type = item_flag_to_resource_type(item_flags);
+
+	ITEM_RESOURCE_KEY_RESOLVE_PREPROC(,)
+
+	zbx_audit_update_json_append_no_value(itemid, AUDIT_DETAILS_ACTION_UPDATE, audit_key_);
+}
+
+#define PREPARE_AUDIT_ITEM_UPDATE_PREPROC(resource, type1, type2)						\
+void	zbx_audit_item_update_json_update_item_preproc_##resource(zbx_uint64_t itemid, int item_flags,		\
 		zbx_uint64_t preprocid, type1 resource##_old, type1 resource##_new)				\
 {														\
+	int	resource_type;											\
 	char	audit_key_##resource[AUDIT_DETAILS_KEY_LEN];							\
 														\
 	RETURN_IF_AUDIT_OFF();											\
+	resource_type = item_flag_to_resource_type(item_flags);							\
 														\
-	zbx_snprintf(audit_key_##resource, sizeof(audit_key_##resource),					\
-			"discoveryrule.preprocessing[" ZBX_FS_UI64 "]."#resource, preprocid);			\
+	ITEM_RESOURCE_KEY_RESOLVE_PREPROC(resource,.)							\
 														\
 	zbx_audit_update_json_update_##type2(itemid, audit_key_##resource, resource##_old, resource##_new);	\
 }
-PREPARE_AUDIT_DISCOVERY_RULE_UPDATE_PREPROC(type, int, int)
-PREPARE_AUDIT_DISCOVERY_RULE_UPDATE_PREPROC(params, const char*, string)
-PREPARE_AUDIT_DISCOVERY_RULE_UPDATE_PREPROC(error_handler, int, int)
-PREPARE_AUDIT_DISCOVERY_RULE_UPDATE_PREPROC(error_handler_params, const char*, string)
-#undef PREPARE_AUDIT_DISCOVERY_RULE_UPDATE_PREPROC
+PREPARE_AUDIT_ITEM_UPDATE_PREPROC(type, int, int)
+PREPARE_AUDIT_ITEM_UPDATE_PREPROC(params, const char*, string)
+PREPARE_AUDIT_ITEM_UPDATE_PREPROC(error_handler, int, int)
+PREPARE_AUDIT_ITEM_UPDATE_PREPROC(error_handler_params, const char*, string)
+#undef PREPARE_AUDIT_ITEM_UPDATE_PREPROC
+
+void	zbx_audit_item_delete_preproc(zbx_uint64_t itemid, int item_flags, zbx_uint64_t preprocid)
+{
+	int	resource_type;
+	char	audit_key_[AUDIT_DETAILS_KEY_LEN];
+
+	RETURN_IF_AUDIT_OFF();
+
+	resource_type = item_flag_to_resource_type(item_flags);
+
+	ITEM_RESOURCE_KEY_RESOLVE_PREPROC(,)
+
+	zbx_audit_update_json_delete(itemid, AUDIT_DETAILS_ACTION_DELETE, audit_key_);
+}
+
+#define ITEM_RESOURCE_KEY_RESOLVE_TAG(resource, nested)								\
+	if (AUDIT_RESOURCE_ITEM == resource_type)								\
+	{													\
+		zbx_snprintf(audit_key_##resource, sizeof(audit_key_##resource), "item.tag[" ZBX_FS_UI64	 \
+				"]"#nested#resource, tagid);						\
+	}													\
+	else if (AUDIT_RESOURCE_ITEM_PROTOTYPE == resource_type)						\
+	{													\
+		zbx_snprintf(audit_key_##resource, sizeof(audit_key_##resource), "itemprototype.tag["		\
+				ZBX_FS_UI64 "]"#nested#resource, tagid);					\
+	}													\
+	else if (AUDIT_RESOURCE_DISCOVERY_RULE == resource_type)						\
+	{													\
+		zbx_snprintf(audit_key_##resource, sizeof(audit_key_##resource), "discoveryrule.tag["		\
+				ZBX_FS_UI64 "]"#resource, tagid);						\
+	}													\
+	else													\
+		THIS_SHOULD_NEVER_HAPPEN;
+
+void	zbx_audit_item_update_json_add_item_tag(zbx_uint64_t itemid, zbx_uint64_t tagid, int item_flags,
+		const char *tag, const char *value)
+{
+	int	resource_type;
+	char	audit_key_[AUDIT_DETAILS_KEY_LEN], audit_key_tag[AUDIT_DETAILS_KEY_LEN],
+		audit_key_value[AUDIT_DETAILS_KEY_LEN];
+
+	RETURN_IF_AUDIT_OFF();
+
+	resource_type = item_flag_to_resource_type(item_flags);
+
+	ITEM_RESOURCE_KEY_RESOLVE_TAG(,)
+	ITEM_RESOURCE_KEY_RESOLVE_TAG(tag, .)
+	ITEM_RESOURCE_KEY_RESOLVE_TAG(value, .)
+
+	zbx_audit_update_json_append_no_value(itemid, AUDIT_DETAILS_ACTION_ADD, audit_key_);
+	zbx_audit_update_json_append_string(itemid, AUDIT_DETAILS_ACTION_ADD, audit_key_tag, tag);
+	zbx_audit_update_json_append_string(itemid, AUDIT_DETAILS_ACTION_ADD, audit_key_value, value);
+}
+
+void	zbx_audit_item_update_json_update_item_tag_create_entry(zbx_uint64_t itemid, int item_flags,
+		zbx_uint64_t tagid)
+{
+	int	resource_type;
+	char	audit_key_[AUDIT_DETAILS_KEY_LEN];
+
+	RETURN_IF_AUDIT_OFF();
+
+	resource_type = item_flag_to_resource_type(item_flags);
+
+	ITEM_RESOURCE_KEY_RESOLVE_TAG(,)
+
+	zbx_audit_update_json_append_no_value(itemid, AUDIT_DETAILS_ACTION_UPDATE, audit_key_);
+}
+
+#define PREPARE_AUDIT_ITEM_UPDATE_TAG(resource, type1, type2)							\
+void	zbx_audit_item_update_json_update_item_tag_##resource(zbx_uint64_t itemid, int item_flags,		\
+		zbx_uint64_t tagid, type1 resource##_old, type1 resource##_new)					\
+{														\
+	int	resource_type;											\
+	char	audit_key_##resource[AUDIT_DETAILS_KEY_LEN];							\
+														\
+	RETURN_IF_AUDIT_OFF();											\
+	resource_type = item_flag_to_resource_type(item_flags);							\
+														\
+	ITEM_RESOURCE_KEY_RESOLVE_TAG(resource,.)								\
+														\
+	zbx_audit_update_json_update_##type2(itemid, audit_key_##resource, resource##_old, resource##_new);	\
+}
+PREPARE_AUDIT_ITEM_UPDATE_TAG(tag, const char*, string)
+PREPARE_AUDIT_ITEM_UPDATE_TAG(value, const char*, string)
+#undef PREPARE_AUDIT_ITEM_UPDATE_TAG
+
+void	zbx_audit_item_delete_tag(zbx_uint64_t itemid, int item_flags, zbx_uint64_t tagid)
+{
+	int	resource_type;
+	char	audit_key_[AUDIT_DETAILS_KEY_LEN];
+
+	RETURN_IF_AUDIT_OFF();
+
+	resource_type = item_flag_to_resource_type(item_flags);
+
+	ITEM_RESOURCE_KEY_RESOLVE_TAG(,)
+
+	zbx_audit_update_json_delete(itemid, AUDIT_DETAILS_ACTION_DELETE, audit_key_);
+}
 
 #define ITEM_RESOURCE_KEY_RESOLVE(resource, nested)								\
 	if (AUDIT_RESOURCE_ITEM == resource_type)								\
@@ -426,8 +633,8 @@ void	zbx_audit_item_update_json_add_params(zbx_uint64_t itemid, int item_flags,
 	RETURN_IF_AUDIT_OFF();
 	resource_type = item_flag_to_resource_type(item_flags);
 
-	ITEM_RESOURCE_KEY_RESOLVE(name, ".")
-	ITEM_RESOURCE_KEY_RESOLVE(value, ".")
+	ITEM_RESOURCE_KEY_RESOLVE(name, .)
+	ITEM_RESOURCE_KEY_RESOLVE(value, .)
 
 	zbx_audit_update_json_append_string(itemid, AUDIT_DETAILS_ACTION_ADD, audit_key_name, name);
 	zbx_audit_update_json_append_string(itemid, AUDIT_DETAILS_ACTION_ADD, audit_key_value, value);
@@ -443,7 +650,7 @@ void	zbx_audit_item_update_json_update_params_##resource(zbx_uint64_t itemid, in
 	RETURN_IF_AUDIT_OFF();											\
 														\
 	resource_type = item_flag_to_resource_type(item_flags);							\
-	ITEM_RESOURCE_KEY_RESOLVE(resource, ".")								\
+	ITEM_RESOURCE_KEY_RESOLVE(resource, .)								\
 														\
 	zbx_audit_update_json_update_string(itemid, audit_key_##resource, resource##_orig, resource);		\
 }
@@ -468,19 +675,35 @@ void	zbx_audit_item_delete_params(zbx_uint64_t itemid, int item_flags, zbx_uint6
 void	zbx_audit_discovery_rule_update_json_add_lld_macro_path(zbx_uint64_t itemid,
 		zbx_uint64_t lld_macro_pathid, const char *lld_macro, const char *path)
 {
-	char	audit_key_lld_macro[AUDIT_DETAILS_KEY_LEN], audit_key_path[AUDIT_DETAILS_KEY_LEN];
+	char	audit_key[AUDIT_DETAILS_KEY_LEN], audit_key_lld_macro[AUDIT_DETAILS_KEY_LEN],
+		audit_key_path[AUDIT_DETAILS_KEY_LEN];
 
 	RETURN_IF_AUDIT_OFF();
 
+	zbx_snprintf(audit_key, sizeof(audit_key),
+			"discoveryrule.lld_macro_paths[" ZBX_FS_UI64 "]", lld_macro_pathid);
 	zbx_snprintf(audit_key_lld_macro, sizeof(audit_key_lld_macro),
 			"discoveryrule.lld_macro_paths[" ZBX_FS_UI64 "].lld_macro", lld_macro_pathid);
 	zbx_snprintf(audit_key_path, sizeof(audit_key_lld_macro),
 			"discoveryrule.lld_macro_paths[" ZBX_FS_UI64 "].path", lld_macro_pathid);
 
+	zbx_audit_update_json_append_no_value(itemid, AUDIT_DETAILS_ACTION_ADD, audit_key);
 	zbx_audit_update_json_append_string(itemid, AUDIT_DETAILS_ACTION_ADD, audit_key_lld_macro, lld_macro);
 	zbx_audit_update_json_append_string(itemid, AUDIT_DETAILS_ACTION_ADD, audit_key_path, path);
 }
 
+void	zbx_audit_discovery_rule_update_json_lld_macro_path_create_update_entry(zbx_uint64_t itemid,
+		zbx_uint64_t lld_macro_pathid)
+{
+	char	buf[AUDIT_DETAILS_KEY_LEN];
+
+	RETURN_IF_AUDIT_OFF();
+
+	zbx_snprintf(buf, sizeof(buf), "discoveryrule.lld_macro_paths[" ZBX_FS_UI64 "]", lld_macro_pathid);
+
+	zbx_audit_update_json_append_no_value(itemid, AUDIT_DETAILS_ACTION_UPDATE, buf);
+}
+
 #define PREPARE_AUDIT_DISCOVERY_RULE_UPDATE_LLD_MACRO_PATH(resource)						\
 void	zbx_audit_discovery_rule_update_json_update_lld_macro_path_##resource(zbx_uint64_t itemid,		\
 		zbx_uint64_t lld_macro_pathid, const char *resource##_old, const char *resource##_new)		\
@@ -513,20 +736,20 @@ void	zbx_audit_discovery_rule_update_json_delete_lld_macro_path(zbx_uint64_t ite
 void zbx_audit_discovery_rule_update_json_add_lld_override(zbx_uint64_t itemid, zbx_uint64_t overrideid,
 		const char *name, int step, int stop)
 {
-	char	audit_key_name[AUDIT_DETAILS_KEY_LEN], audit_key_step[AUDIT_DETAILS_KEY_LEN],
-		audit_key_stop[AUDIT_DETAILS_KEY_LEN];
+	char	audit_key[AUDIT_DETAILS_KEY_LEN], audit_key_name[AUDIT_DETAILS_KEY_LEN],
+		audit_key_step[AUDIT_DETAILS_KEY_LEN], audit_key_stop[AUDIT_DETAILS_KEY_LEN];
 
 	RETURN_IF_AUDIT_OFF();
 
+	zbx_snprintf(audit_key, sizeof(audit_key), "discoveryrule.overrides[" ZBX_FS_UI64 "]", overrideid);
 	zbx_snprintf(audit_key_name, sizeof(audit_key_name), "discoveryrule.overrides[" ZBX_FS_UI64 "].name",
 			overrideid);
-
 	zbx_snprintf(audit_key_step, sizeof(audit_key_step), "discoveryrule.overrides[" ZBX_FS_UI64 "].step",
 			overrideid);
-
 	zbx_snprintf(audit_key_stop, sizeof(audit_key_stop), "discoveryrule.overrides[" ZBX_FS_UI64 "].stop",
 			overrideid);
 
+	zbx_audit_update_json_append_no_value(itemid, AUDIT_DETAILS_ACTION_ADD, audit_key);
 	zbx_audit_update_json_append_string(itemid, AUDIT_DETAILS_ACTION_ADD, audit_key_name, name);
 	zbx_audit_update_json_append_int(itemid, AUDIT_DETAILS_ACTION_ADD, audit_key_step, step);
 	zbx_audit_update_json_append_int(itemid, AUDIT_DETAILS_ACTION_ADD, audit_key_stop, stop);
@@ -535,16 +758,20 @@ void zbx_audit_discovery_rule_update_json_add_lld_override(zbx_uint64_t itemid,
 void zbx_audit_discovery_rule_update_json_add_lld_override_filter(zbx_uint64_t itemid, zbx_uint64_t overrideid,
 		int evaltype, const char *formula)
 {
-	char	audit_key_evaltype[AUDIT_DETAILS_KEY_LEN], audit_key_formula[AUDIT_DETAILS_KEY_LEN];
+	char	audit_key[AUDIT_DETAILS_KEY_LEN], audit_key_evaltype[AUDIT_DETAILS_KEY_LEN],
+		audit_key_formula[AUDIT_DETAILS_KEY_LEN];
 
 	RETURN_IF_AUDIT_OFF();
 
+	zbx_snprintf(audit_key, sizeof(audit_key), "discoveryrule.overrides[" ZBX_FS_UI64 "].filter", overrideid);
+
 	zbx_snprintf(audit_key_evaltype, sizeof(audit_key_evaltype), "discoveryrule.overrides[" ZBX_FS_UI64
 			"].filter.evaltype", overrideid);
 
 	zbx_snprintf(audit_key_formula, sizeof(audit_key_formula), "discoveryrule.overrides[" ZBX_FS_UI64
 			"].filter.formula", overrideid);
 
+	zbx_audit_update_json_append_no_value(itemid, AUDIT_DETAILS_ACTION_ADD, audit_key);
 	zbx_audit_update_json_append_int(itemid, AUDIT_DETAILS_ACTION_ADD, audit_key_evaltype, evaltype);
 	zbx_audit_update_json_append_string(itemid, AUDIT_DETAILS_ACTION_ADD, audit_key_formula, formula);
 }
@@ -552,25 +779,46 @@ void zbx_audit_discovery_rule_update_json_add_lld_override_filter(zbx_uint64_t i
 void zbx_audit_discovery_rule_update_json_add_lld_override_condition(zbx_uint64_t itemid, zbx_uint64_t overrideid,
 		zbx_uint64_t override_conditionid, int operator, const char *macro, const char *value)
 {
-	char	audit_key_operator[AUDIT_DETAILS_KEY_LEN], audit_key_macro[AUDIT_DETAILS_KEY_LEN],
-		audit_key_value[AUDIT_DETAILS_KEY_LEN];
+	char	audit_key[AUDIT_DETAILS_KEY_LEN], audit_key_operator[AUDIT_DETAILS_KEY_LEN],
+		audit_key_macro[AUDIT_DETAILS_KEY_LEN], audit_key_value[AUDIT_DETAILS_KEY_LEN];
 
 	RETURN_IF_AUDIT_OFF();
 
+	zbx_snprintf(audit_key, sizeof(audit_key), "discoveryrule.overrides[" ZBX_FS_UI64
+			"].conditions[" ZBX_FS_UI64 "]", overrideid, override_conditionid);
 	zbx_snprintf(audit_key_operator, sizeof(audit_key_operator), "discoveryrule.overrides[" ZBX_FS_UI64
 		"].conditions[" ZBX_FS_UI64 "].operator", overrideid, override_conditionid);
-
 	zbx_snprintf(audit_key_macro, sizeof(audit_key_macro), "discoveryrule.overrides[" ZBX_FS_UI64 "].conditions["
 			ZBX_FS_UI64 "].macro", overrideid, override_conditionid);
-
 	zbx_snprintf(audit_key_value, sizeof(audit_key_value), "discoveryrule.overrides[" ZBX_FS_UI64 "].conditions["
 			ZBX_FS_UI64 "].value", overrideid, override_conditionid);
 
+	zbx_audit_update_json_append_no_value(itemid, AUDIT_DETAILS_ACTION_ADD, audit_key);
 	zbx_audit_update_json_append_int(itemid, AUDIT_DETAILS_ACTION_ADD, audit_key_operator, operator);
 	zbx_audit_update_json_append_string(itemid, AUDIT_DETAILS_ACTION_ADD, audit_key_macro, macro);
 	zbx_audit_update_json_append_string(itemid, AUDIT_DETAILS_ACTION_ADD, audit_key_value, value);
 }
 
+void	zbx_audit_discovery_rule_update_json_add_lld_override_operation(zbx_uint64_t itemid, zbx_uint64_t overrideid,
+		zbx_uint64_t override_operationid, int operator, const char *value)
+{
+	char	audit_key[AUDIT_DETAILS_KEY_LEN], audit_key_operator[AUDIT_DETAILS_KEY_LEN],
+		audit_key_value[AUDIT_DETAILS_KEY_LEN];
+
+	RETURN_IF_AUDIT_OFF();
+
+	zbx_snprintf(audit_key, sizeof(audit_key), "discoveryrule.overrides[" ZBX_FS_UI64 "].operations[" ZBX_FS_UI64
+		"]", overrideid, override_operationid);
+	zbx_snprintf(audit_key_operator, sizeof(audit_key_operator), "discoveryrule.overrides[" ZBX_FS_UI64
+		"].operations[" ZBX_FS_UI64 "].operator", overrideid, override_operationid);
+	zbx_snprintf(audit_key_value, sizeof(audit_key_value), "discoveryrule.overrides[" ZBX_FS_UI64 "].operations["
+			ZBX_FS_UI64 "].value", overrideid, override_operationid);
+
+	zbx_audit_update_json_append_no_value(itemid, AUDIT_DETAILS_ACTION_ADD, audit_key);
+	zbx_audit_update_json_append_int(itemid, AUDIT_DETAILS_ACTION_ADD, audit_key_operator, operator);
+	zbx_audit_update_json_append_string(itemid, AUDIT_DETAILS_ACTION_ADD, audit_key_value, value);
+}
+
 #define PREPARE_AUDIT_DISCOVERY_RULE_OVERRIDE_ADD(resource, type, type2)					\
 void	zbx_audit_discovery_rule_update_json_add_lld_override_##resource(zbx_uint64_t itemid,			\
 		zbx_uint64_t overrideid, zbx_uint64_t resource##_id, type resource)				\
@@ -596,16 +844,19 @@ PREPARE_AUDIT_DISCOVERY_RULE_OVERRIDE_ADD(opinventory, int, int)
 void	zbx_audit_discovery_rule_update_json_add_lld_override_optag(zbx_uint64_t itemid, zbx_uint64_t overrideid,
 		zbx_uint64_t lld_override_optagid, const char *tag, const char *value)
 {
-	char	audit_key_tag[AUDIT_DETAILS_KEY_LEN], audit_key_value[AUDIT_DETAILS_KEY_LEN];
+	char	audit_key[AUDIT_DETAILS_KEY_LEN], audit_key_tag[AUDIT_DETAILS_KEY_LEN],
+		audit_key_value[AUDIT_DETAILS_KEY_LEN];
 
 	RETURN_IF_AUDIT_OFF();
 
+	zbx_snprintf(audit_key, sizeof(audit_key), "discoveryrule.overrides[" ZBX_FS_UI64
+			"].optag[" ZBX_FS_UI64 "]", overrideid, lld_override_optagid);
 	zbx_snprintf(audit_key_tag, sizeof(audit_key_tag), "discoveryrule.overrides[" ZBX_FS_UI64
 			"].optag[" ZBX_FS_UI64 "].tag", overrideid, lld_override_optagid);
-
 	zbx_snprintf(audit_key_value, sizeof(audit_key_value), "discoveryrule.overrides[" ZBX_FS_UI64
 			"].optag[" ZBX_FS_UI64 "].value", overrideid, lld_override_optagid);
 
+	zbx_audit_update_json_append_no_value(itemid, AUDIT_DETAILS_ACTION_ADD, audit_key);
 	zbx_audit_update_json_append_string(itemid, AUDIT_DETAILS_ACTION_ADD, audit_key_tag, tag);
 	zbx_audit_update_json_append_string(itemid, AUDIT_DETAILS_ACTION_ADD, audit_key_value, value);
 }
@@ -613,12 +864,15 @@ void	zbx_audit_discovery_rule_update_json_add_lld_override_optag(zbx_uint64_t it
 void	zbx_audit_discovery_rule_update_json_add_lld_override_optemplate(zbx_uint64_t itemid, zbx_uint64_t overrideid,
 		zbx_uint64_t lld_override_optemplateid, zbx_uint64_t templateid)
 {
-	char	buf[AUDIT_DETAILS_KEY_LEN];
+	char	audit_key[AUDIT_DETAILS_KEY_LEN], audit_key_templateid[AUDIT_DETAILS_KEY_LEN];
 
 	RETURN_IF_AUDIT_OFF();
 
-	zbx_snprintf(buf, sizeof(buf), "discoveryrule.overrides[" ZBX_FS_UI64
+	zbx_snprintf(audit_key, sizeof(audit_key), "discoveryrule.overrides[" ZBX_FS_UI64 "].optemplateid[" ZBX_FS_UI64
+			"]", overrideid, lld_override_optemplateid);
+	zbx_snprintf(audit_key_templateid, sizeof(audit_key_templateid), "discoveryrule.overrides[" ZBX_FS_UI64
 			"].optemplateid[" ZBX_FS_UI64 "].templateid", overrideid, lld_override_optemplateid);
 
-	zbx_audit_update_json_append_uint64(itemid, AUDIT_DETAILS_ACTION_ADD, buf, templateid);
+	zbx_audit_update_json_append_no_value(itemid, AUDIT_DETAILS_ACTION_ADD, audit_key);
+	zbx_audit_update_json_append_uint64(itemid, AUDIT_DETAILS_ACTION_ADD, audit_key_templateid, templateid);
 }