.......... [DEV-2133] updated to latest master

35 files changed, 168 insertions, 861 deletions

diff --git a/src/go/pkg/tls/tls.go b/src/go/pkg/tls/tls.go
index 698e3a0fe02..4514eb8ec3c 100644
--- a/src/go/pkg/tls/tls.go
+++ b/src/go/pkg/tls/tls.go
@@ -282,9 +282,18 @@ static unsigned int tls_psk_server_cb(SSL *ssl, const char *identity, unsigned c
 
 static int	zbx_set_ecdhe_parameters(SSL_CTX *ctx)
 {
-	EC_KEY	*ecdh;
 	long	res;
 	int	ret = 0;
+#if defined(OPENSSL_VERSION_MAJOR) && OPENSSL_VERSION_NUMBER >= 3	// OpenSSL 3.0.0 or newer
+#define ARRSIZE(a)	(sizeof(a) / sizeof(*a))
+
+	int	grp_list[1] = { NID_X9_62_prime256v1 };	// use curve secp256r1/prime256v1/NIST P-256
+
+	if (1 != (res = SSL_CTX_set1_groups(ctx, grp_list, ARRSIZE(grp_list))))
+		ret = -1;
+#undef ARRSIZE
+#else
+	EC_KEY	*ecdh;
 
 	// use curve secp256r1/prime256v1/NIST P-256
 
@@ -297,7 +306,7 @@ static int	zbx_set_ecdhe_parameters(SSL_CTX *ctx)
 		ret = -1;
 
 	EC_KEY_free(ecdh);
-
+#endif
 	return ret;
 }
 
diff --git a/src/libs/zbxaudit/Makefile.am b/src/libs/zbxaudit/Makefile.am
index e35b096aafe..bdbcaeb0b39 100644
--- a/src/libs/zbxaudit/Makefile.am
+++ b/src/libs/zbxaudit/Makefile.am
@@ -3,19 +3,12 @@
 noinst_LIBRARIES = libzbxaudit.a
 
 libzbxaudit_a_SOURCES = \
-	audit.c \
 	audit.h \
+	audit.c \
 	audit_host.c \
-	audit_host.h \
 	audit_httptest.c \
-	audit_httptest.h \
 	audit_item.c \
-	audit_item.h \
 	audit_trigger.c \
-	audit_trigger.h \
 	audit_graph.c \
-	audit_graph.h \
 	audit_ha.c \
-	audit_ha.h \
-	audit_settings.c \
-	audit_settings.h
+	audit_settings.c
diff --git a/src/libs/zbxaudit/audit.c b/src/libs/zbxaudit/audit.c
index 9568ddb2847..468d3daa238 100644
--- a/src/libs/zbxaudit/audit.c
+++ b/src/libs/zbxaudit/audit.c
@@ -18,6 +18,7 @@
 **/
 
 #include "audit.h"
+#include "audit/zbxaudit.h"
 
 #include "log.h"
 #include "zbxjson.h"
@@ -223,7 +224,7 @@ int	zbx_auditlog_global_script(unsigned char script_type, unsigned char script_e
 	if (ZBX_DB_OK > DBexecute("insert into auditlog (auditid,userid,username,clock,action,ip,resourceid,"
 			"resourcename,resourcetype,recordsetid,details) values ('%s'," ZBX_FS_UI64 ",'%s',%d,'%d','%s',"
 			ZBX_FS_UI64 ",'%s',%d,'%s','%s')", auditid_cuid, userid, username, (int)time(NULL),
-			AUDIT_ACTION_EXECUTE, clientip, hostid, hostname, AUDIT_RESOURCE_SCRIPT, auditid_cuid,
+			ZBX_AUDIT_ACTION_EXECUTE, clientip, hostid, hostname, AUDIT_RESOURCE_SCRIPT, auditid_cuid,
 			details_esc))
 	{
 		ret = FAIL;
@@ -308,7 +309,7 @@ void	zbx_audit_flush(void)
 
 	while (NULL != (audit_entry = (zbx_audit_entry_t **)zbx_hashset_iter_next(&iter)))
 	{
-		if (AUDIT_ACTION_DELETE == (*audit_entry)->audit_action ||
+		if (ZBX_AUDIT_ACTION_DELETE == (*audit_entry)->audit_action ||
 				0 != strcmp((*audit_entry)->details_json.buffer, "{}"))
 		{
 			char	*details_esc;
@@ -347,7 +348,7 @@ int	zbx_audit_flush_once(void)
 		char	id[ZBX_MAX_UINT64_LEN + 1], *pvalue, *name_esc, *details_esc;
 		const char	*pfield;
 
-		if (AUDIT_ACTION_DELETE != (*audit_entry)->audit_action &&
+		if (ZBX_AUDIT_ACTION_DELETE != (*audit_entry)->audit_action &&
 				0 == strcmp((*audit_entry)->details_json.buffer, "{}"))
 		{
 			continue;
@@ -625,10 +626,10 @@ void	zbx_audit_entry_append_int(zbx_audit_entry_t *entry, int audit_op, const ch
 
 	switch (audit_op)
 	{
-		case AUDIT_ACTION_ADD:
+		case ZBX_AUDIT_ACTION_ADD:
 			append_int_json(&entry->details_json, AUDIT_DETAILS_ACTION_ADD, key, value1);
 			break;
-		case AUDIT_ACTION_UPDATE:
+		case ZBX_AUDIT_ACTION_UPDATE:
 			value2 = va_arg(args, int);
 			update_int_json(&entry->details_json, key, value1, value2);
 			break;
@@ -650,10 +651,10 @@ void	zbx_audit_entry_append_string(zbx_audit_entry_t *entry, int audit_op, const
 
 	switch (audit_op)
 	{
-		case AUDIT_ACTION_ADD:
+		case ZBX_AUDIT_ACTION_ADD:
 			append_str_json(&entry->details_json, AUDIT_DETAILS_ACTION_ADD, key, value1);
 			break;
-		case AUDIT_ACTION_UPDATE:
+		case ZBX_AUDIT_ACTION_UPDATE:
 			value2 = va_arg(args, const char *);
 			update_str_json(&entry->details_json, key, value1, value2);
 			break;
diff --git a/src/libs/zbxaudit/audit.h b/src/libs/zbxaudit/audit.h
index 84c7af67cea..2f00c5cec83 100644
--- a/src/libs/zbxaudit/audit.h
+++ b/src/libs/zbxaudit/audit.h
@@ -23,11 +23,6 @@
 #include "zbxalgo.h"
 #include "zbxjson.h"
 
-#define AUDIT_ACTION_ADD		0
-#define AUDIT_ACTION_UPDATE		1
-#define AUDIT_ACTION_DELETE		2
-#define AUDIT_ACTION_EXECUTE		7
-
 #define AUDIT_DETAILS_ACTION_ADD	"add"
 #define AUDIT_DETAILS_ACTION_UPDATE	"update"
 #define AUDIT_DETAILS_ACTION_DELETE	"delete"
@@ -42,14 +37,11 @@
 #define AUDIT_RESOURCE_SCENARIO			22
 #define AUDIT_RESOURCE_DISCOVERY_RULE		23
 #define AUDIT_RESOURCE_SCRIPT			25
-
 #define AUDIT_RESOURCE_TRIGGER_PROTOTYPE	31
 #define AUDIT_RESOURCE_GRAPH_PROTOTYPE		35
 #define AUDIT_RESOURCE_ITEM_PROTOTYPE		36
 #define AUDIT_RESOURCE_HOST_PROTOTYPE		37
-
 #define AUDIT_RESOURCE_SETTINGS			40
-
 #define AUDIT_RESOURCE_HA_NODE			47
 
 #define AUDIT_HOST_ID		1
@@ -61,13 +53,13 @@
 #define AUDIT_HA_NODE_ID	7
 #define AUDIT_CONFIG_ID		8
 
+int		zbx_get_audit_mode(void);
+zbx_hashset_t	*zbx_get_audit_hashset(void);
+
 #define RETURN_IF_AUDIT_OFF()					\
 	if (ZBX_AUDITLOG_ENABLED != zbx_get_audit_mode())	\
 		return						\
 
-int		zbx_get_audit_mode(void);
-zbx_hashset_t	*zbx_get_audit_hashset(void);
-
 typedef struct zbx_audit_entry
 {
 	zbx_uint64_t	id;
@@ -86,15 +78,6 @@ zbx_audit_entry_t	*zbx_audit_entry_init(zbx_uint64_t id, const int id_table, con
 zbx_audit_entry_t	*zbx_audit_entry_init_cuid(const char *cuid, const int id_table,const char *name,
 		int audit_action, int resource_type);
 
-int	zbx_auditlog_global_script(unsigned char script_type, unsigned char script_execute_on,
-		const char *script_command_orig, zbx_uint64_t hostid, const char *hostname, zbx_uint64_t eventid,
-		zbx_uint64_t proxy_hostid, zbx_uint64_t userid, const char *username, const char *clientip,
-		const char *output, const char *error);
-
-void	zbx_audit_init(int audit_mode_set);
-void	zbx_audit_clean(void);
-void	zbx_audit_flush(void);
-int	zbx_audit_flush_once(void);
 void	zbx_audit_update_json_append_string(const zbx_uint64_t id, const int id_table, const char *audit_op,
 		const char *key, const char *value, const char *table, const char *field);
 void	zbx_audit_update_json_append_string_secret(const zbx_uint64_t id, const int id_table, const char *audit_op,
diff --git a/src/libs/zbxaudit/audit_graph.c b/src/libs/zbxaudit/audit_graph.c
index d3f092d2eb1..ffea54158bd 100644
--- a/src/libs/zbxaudit/audit_graph.c
+++ b/src/libs/zbxaudit/audit_graph.c
@@ -17,8 +17,9 @@
 ** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
 **/
 
-#include "audit_graph.h"
+#include "audit/zbxaudit_graph.h"
 
+#include "audit/zbxaudit.h"
 #include "log.h"
 #include "db.h"
 #include "audit.h"
@@ -69,7 +70,7 @@ void	zbx_audit_graph_create_entry(int audit_action, zbx_uint64_t graphid, const
 		zbx_hashset_insert(zbx_get_audit_hashset(), &local_audit_graph_entry_insert,
 				sizeof(local_audit_graph_entry_insert));
 
-		if (AUDIT_ACTION_ADD == audit_action)
+		if (ZBX_AUDIT_ACTION_ADD == audit_action)
 		{
 			zbx_audit_update_json_append_uint64(graphid, AUDIT_GRAPH_ID, AUDIT_DETAILS_ACTION_ADD,
 					GR_OR_GRP(graphid), graphid, "graphs", "graphid");
@@ -316,7 +317,7 @@ void	zbx_audit_DBselect_delete_for_graph(const char *sql, zbx_vector_uint64_t *i
 		zbx_vector_uint64_append(ids, id);
 		flags = atoi(row[2]);
 
-		zbx_audit_graph_create_entry(AUDIT_ACTION_DELETE, id, row[1], flags);
+		zbx_audit_graph_create_entry(ZBX_AUDIT_ACTION_DELETE, id, row[1], flags);
 	}
 
 	DBfree_result(result);
diff --git a/src/libs/zbxaudit/audit_graph.h b/src/libs/zbxaudit/audit_graph.h
deleted file mode 100644
index 5b9cb73d7d9..00000000000
--- a/src/libs/zbxaudit/audit_graph.h
+++ /dev/null
@@ -1,78 +0,0 @@
-/*
-** Zabbix
-** Copyright (C) 2001-2022 Zabbix SIA
-**
-** This program is free software; you can redistribute it and/or modify
-** it under the terms of the GNU General Public License as published by
-** the Free Software Foundation; either version 2 of the License, or
-** (at your option) any later version.
-**
-** This program is distributed in the hope that it will be useful,
-** but WITHOUT ANY WARRANTY; without even the implied warranty of
-** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-** GNU General Public License for more details.
-**
-** You should have received a copy of the GNU General Public License
-** along with this program; if not, write to the Free Software
-** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
-**/
-
-#ifndef ZABBIX_AUDIT_GRAPH_H
-#define ZABBIX_AUDIT_GRAPH_H
-
-#include "common.h"
-#include "zbxalgo.h"
-
-void	zbx_audit_graph_create_entry(int audit_action, zbx_uint64_t graphid, const char *name, int flags);
-
-void	zbx_audit_graph_update_json_add_data(zbx_uint64_t graphid, const char *name, int width, int height,
-		double yaxismin, double yaxismax, zbx_uint64_t templateid, int show_work_period, int show_triggers,
-		int graphtype, int show_legend, int show_3d, double percent_left, double percent_right, int ymin_type,
-		int ymax_type, zbx_uint64_t ymin_itemid, zbx_uint64_t ymax_itemid, int flags, int discover);
-
-void	zbx_audit_graph_update_json_add_gitems(zbx_uint64_t graphid, int flags, zbx_uint64_t gitemid, int drawtype,
-		int sortorder, const char *color, int yaxisside, int calc_fnc, int type, zbx_uint64_t itemid);
-
-#define PREPARE_AUDIT_GRAPH_UPDATE(resource, type1)								\
-void	zbx_audit_graph_update_json_update_##resource(zbx_uint64_t graphid, int flags,				\
-		type1 resource##_old, type1 resource##_new);							\
-
-PREPARE_AUDIT_GRAPH_UPDATE(name, const char*)
-PREPARE_AUDIT_GRAPH_UPDATE(width, int)
-PREPARE_AUDIT_GRAPH_UPDATE(height, int)
-PREPARE_AUDIT_GRAPH_UPDATE(yaxismin, double)
-PREPARE_AUDIT_GRAPH_UPDATE(yaxismax, double)
-PREPARE_AUDIT_GRAPH_UPDATE(show_work_period, int)
-PREPARE_AUDIT_GRAPH_UPDATE(show_triggers, int)
-PREPARE_AUDIT_GRAPH_UPDATE(graphtype, int)
-PREPARE_AUDIT_GRAPH_UPDATE(show_legend, int)
-PREPARE_AUDIT_GRAPH_UPDATE(show_3d, int)
-PREPARE_AUDIT_GRAPH_UPDATE(percent_left, double)
-PREPARE_AUDIT_GRAPH_UPDATE(percent_right, double)
-PREPARE_AUDIT_GRAPH_UPDATE(ymin_type, int)
-PREPARE_AUDIT_GRAPH_UPDATE(ymax_type, int)
-PREPARE_AUDIT_GRAPH_UPDATE(ymin_itemid, zbx_uint64_t)
-PREPARE_AUDIT_GRAPH_UPDATE(ymax_itemid, zbx_uint64_t)
-PREPARE_AUDIT_GRAPH_UPDATE(discover, int)
-PREPARE_AUDIT_GRAPH_UPDATE(templateid, zbx_uint64_t)
-#undef PREPARE_AUDIT_GRAPH_UPDATE
-
-void	zbx_audit_graph_update_json_update_gitem_create_entry(zbx_uint64_t graphid, int flags, zbx_uint64_t gitemid);
-
-#define PREPARE_AUDIT_GRAPH_UPDATE(resource, type1)								\
-void	zbx_audit_graph_update_json_update_gitem_update_##resource(zbx_uint64_t graphid, int flags,		\
-		zbx_uint64_t gitemid, type1 resource##_old, type1 resource##_new);
-PREPARE_AUDIT_GRAPH_UPDATE(itemid, zbx_uint64_t)
-PREPARE_AUDIT_GRAPH_UPDATE(drawtype, int)
-PREPARE_AUDIT_GRAPH_UPDATE(sortorder, int)
-PREPARE_AUDIT_GRAPH_UPDATE(color, const char*)
-PREPARE_AUDIT_GRAPH_UPDATE(yaxisside, int)
-PREPARE_AUDIT_GRAPH_UPDATE(calc_fnc, int)
-PREPARE_AUDIT_GRAPH_UPDATE(type, int)
-#undef PREPARE_AUDIT_GRAPH_UPDATE
-
-void	zbx_audit_graph_update_json_delete_gitems(zbx_uint64_t graphid, int flags, zbx_uint64_t gitemid);
-
-void	zbx_audit_DBselect_delete_for_graph(const char *sql, zbx_vector_uint64_t *ids);
-
-#endif	/* ZABBIX_AUDIT_GRAPH_H */
diff --git a/src/libs/zbxaudit/audit_ha.c b/src/libs/zbxaudit/audit_ha.c
index 77acc775f66..ee7bacdc565 100644
--- a/src/libs/zbxaudit/audit_ha.c
+++ b/src/libs/zbxaudit/audit_ha.c
@@ -17,8 +17,9 @@
 ** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
 **/
 
-#include "audit_ha.h"
+#include "audit/zbxaudit_ha.h"
 
+#include "audit/zbxaudit.h"
 #include "zbxalgo.h"
 #include "audit.h"
 
@@ -50,9 +51,9 @@ void	zbx_audit_ha_add_create_fields(const char *nodeid, const char *name, int st
 
 	entry = zbx_audit_get_entry(0, nodeid, AUDIT_HA_NODE_ID);
 
-	zbx_audit_entry_append_string(entry, AUDIT_ACTION_ADD, ZBX_AUDIT_HA_NODEID, nodeid);
-	zbx_audit_entry_append_string(entry, AUDIT_ACTION_ADD, ZBX_AUDIT_HA_NAME, name);
-	zbx_audit_entry_append_int(entry, AUDIT_ACTION_ADD, ZBX_AUDIT_HA_STATUS, status);
+	zbx_audit_entry_append_string(entry, ZBX_AUDIT_ACTION_ADD, ZBX_AUDIT_HA_NODEID, nodeid);
+	zbx_audit_entry_append_string(entry, ZBX_AUDIT_ACTION_ADD, ZBX_AUDIT_HA_NAME, name);
+	zbx_audit_entry_append_int(entry, ZBX_AUDIT_ACTION_ADD, ZBX_AUDIT_HA_STATUS, status);
 }
 
 void	zbx_audit_ha_update_field_string(const char *nodeid, const char *key, const char *old_value,
@@ -63,7 +64,7 @@ void	zbx_audit_ha_update_field_string(const char *nodeid, const char *key, const
 	RETURN_IF_AUDIT_OFF();
 
 	entry = zbx_audit_get_entry(0, nodeid, AUDIT_HA_NODE_ID);
-	zbx_audit_entry_append_string(entry, AUDIT_ACTION_UPDATE, key, old_value, new_value);
+	zbx_audit_entry_append_string(entry, ZBX_AUDIT_ACTION_UPDATE, key, old_value, new_value);
 }
 
 void	zbx_audit_ha_update_field_int(const char *nodeid, const char *key, int old_value, int new_value)
@@ -73,5 +74,5 @@ void	zbx_audit_ha_update_field_int(const char *nodeid, const char *key, int old_
 	RETURN_IF_AUDIT_OFF();
 
 	entry = zbx_audit_get_entry(0, nodeid, AUDIT_HA_NODE_ID);
-	zbx_audit_entry_append_int(entry, AUDIT_ACTION_UPDATE, key, old_value, new_value);
+	zbx_audit_entry_append_int(entry, ZBX_AUDIT_ACTION_UPDATE, key, old_value, new_value);
 }
diff --git a/src/libs/zbxaudit/audit_ha.h b/src/libs/zbxaudit/audit_ha.h
deleted file mode 100644
index 78cb2ed69c7..00000000000
--- a/src/libs/zbxaudit/audit_ha.h
+++ /dev/null
@@ -1,36 +0,0 @@
-/*
-** Zabbix
-** Copyright (C) 2001-2022 Zabbix SIA
-**
-** This program is free software; you can redistribute it and/or modify
-** it under the terms of the GNU General Public License as published by
-** the Free Software Foundation; either version 2 of the License, or
-** (at your option) any later version.
-**
-** This program is distributed in the hope that it will be useful,
-** but WITHOUT ANY WARRANTY; without even the implied warranty of
-** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-** GNU General Public License for more details.
-**
-** You should have received a copy of the GNU General Public License
-** along with this program; if not, write to the Free Software
-** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
-**/
-
-#ifndef ZABBIX_AUDIT_HA_H
-#define ZABBIX_AUDIT_HA_H
-
-#define ZBX_AUDIT_HA_NODE	"hanode"
-#define ZBX_AUDIT_HA_NODEID	ZBX_AUDIT_HA_NODE ".ha_nodeid"
-#define ZBX_AUDIT_HA_NAME	ZBX_AUDIT_HA_NODE ".name"
-#define ZBX_AUDIT_HA_STATUS	ZBX_AUDIT_HA_NODE ".status"
-#define ZBX_AUDIT_HA_ADDRESS	ZBX_AUDIT_HA_NODE ".address"
-#define ZBX_AUDIT_HA_PORT	ZBX_AUDIT_HA_NODE ".port"
-
-void	zbx_audit_ha_create_entry(int audit_action, const char *nodeid, const char *name);
-void	zbx_audit_ha_add_create_fields(const char *nodeid, const char *name, int status);
-void	zbx_audit_ha_update_field_string(const char *nodeid, const char *key, const char *old_value,
-		const char *new_value);
-void	zbx_audit_ha_update_field_int(const char *nodeid, const char *key, int old_value, int new_value);
-
-#endif
diff --git a/src/libs/zbxaudit/audit_host.c b/src/libs/zbxaudit/audit_host.c
index 59f01c94be3..1b63e1eb567 100644
--- a/src/libs/zbxaudit/audit_host.c
+++ b/src/libs/zbxaudit/audit_host.c
@@ -17,8 +17,9 @@
 ** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
 **/
 
-#include "audit_host.h"
+#include "audit/zbxaudit_host.h"
 
+#include "audit/zbxaudit.h"
 #include "audit.h"
 
 #define PREPARE_UPDATE_JSON_SNMP_INTERFACE_OP(auditentry)							\
@@ -231,7 +232,7 @@ void	zbx_audit_##funcname##_create_entry(int audit_action, zbx_uint64_t hostid,
 		zbx_hashset_insert(zbx_get_audit_hashset(), &local_audit_host_entry_insert,			\
 				sizeof(local_audit_host_entry_insert));						\
 														\
-		if (AUDIT_ACTION_ADD == audit_action)								\
+		if (ZBX_AUDIT_ACTION_ADD == audit_action)								\
 		{												\
 			zbx_audit_update_json_append_uint64(hostid, AUDIT_HOST_ID, AUDIT_DETAILS_ACTION_ADD,	\
 					#auditentry".hostid", hostid, "hosts", "hostid");			\
@@ -449,7 +450,7 @@ void	zbx_audit_host_hostgroup_delete(zbx_uint64_t hostid, const char* hostname,
 
 	RETURN_IF_AUDIT_OFF();
 
-	zbx_audit_host_create_entry(AUDIT_ACTION_UPDATE, hostid, hostname);
+	zbx_audit_host_create_entry(ZBX_AUDIT_ACTION_UPDATE, hostid, hostname);
 
 	for (i = 0; i < groupids->values_num; i++)
 	{
@@ -463,7 +464,7 @@ void	zbx_audit_host_del(zbx_uint64_t hostid, const char *hostname)
 {
 	RETURN_IF_AUDIT_OFF();
 
-	zbx_audit_host_create_entry(AUDIT_ACTION_DELETE, hostid, hostname);
+	zbx_audit_host_create_entry(ZBX_AUDIT_ACTION_DELETE, hostid, hostname);
 }
 
 void	zbx_audit_host_update_json_add_details(zbx_uint64_t hostid, const char *host, zbx_uint64_t proxy_hostid,
@@ -575,7 +576,7 @@ void	zbx_audit_host_prototype_del(zbx_uint64_t hostid, const char *hostname)
 {
 	RETURN_IF_AUDIT_OFF();
 
-	zbx_audit_host_prototype_create_entry(AUDIT_ACTION_DELETE, hostid, hostname);
+	zbx_audit_host_prototype_create_entry(ZBX_AUDIT_ACTION_DELETE, hostid, hostname);
 }
 
 void	zbx_audit_host_prototype_update_json_add_details(zbx_uint64_t hostid, zbx_uint64_t templateid,
@@ -919,7 +920,7 @@ void	zbx_audit_host_group_del(zbx_uint64_t groupid, const char *name)
 {
 	RETURN_IF_AUDIT_OFF();
 
-	zbx_audit_host_group_create_entry(AUDIT_ACTION_DELETE, groupid, name);
+	zbx_audit_host_group_create_entry(ZBX_AUDIT_ACTION_DELETE, groupid, name);
 }
 
 void	zbx_audit_host_group_update_json_add_details(zbx_uint64_t groupid, const char *name, int flags)
@@ -946,4 +947,11 @@ void	zbx_audit_host_group_update_json_update_##resource(zbx_uint64_t groupid, ty
 
 PREPARE_AUDIT_HOST_GROUP_UPDATE(name, const char*, string)
 
+void	zbx_audit_host_update_json_add_proxy_hostid(zbx_uint64_t hostid, zbx_uint64_t proxy_hostid)
+{
+	RETURN_IF_AUDIT_OFF();
+
+	zbx_audit_update_json_append_uint64(hostid, AUDIT_HOST_ID, AUDIT_DETAILS_ACTION_ADD, "host.proxy_hostid",
+			proxy_hostid, "hosts", "proxy_hostid");
+}
 #undef PREPARE_AUDIT_HOST_GROUP_UPDATE
diff --git a/src/libs/zbxaudit/audit_host.h b/src/libs/zbxaudit/audit_host.h
deleted file mode 100644
index 111e9505759..00000000000
--- a/src/libs/zbxaudit/audit_host.h
+++ /dev/null
@@ -1,211 +0,0 @@
-/*
-** Zabbix
-** Copyright (C) 2001-2022 Zabbix SIA
-**
-** This program is free software; you can redistribute it and/or modify
-** it under the terms of the GNU General Public License as published by
-** the Free Software Foundation; either version 2 of the License, or
-** (at your option) any later version.
-**
-** This program is distributed in the hope that it will be useful,
-** but WITHOUT ANY WARRANTY; without even the implied warranty of
-** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-** GNU General Public License for more details.
-**
-** You should have received a copy of the GNU General Public License
-** along with this program; if not, write to the Free Software
-** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
-**/
-
-#ifndef ZABBIX_AUDIT_HOST_H
-#define ZABBIX_AUDIT_HOST_H
-
-#include "zbxtypes.h"
-#include "zbxalgo.h"
-
-#define PREPARE_AUDIT_SNMP_INTERFACE_H(funcname)								\
-void	zbx_audit_##funcname##_update_json_add_snmp_interface(zbx_uint64_t hostid, zbx_uint64_t version,	\
-		zbx_uint64_t bulk, const char *community, const char *securityname, zbx_uint64_t securitylevel,	\
-		const char *authpassphrase, const char *privpassphrase, zbx_uint64_t authprotocol,		\
-		zbx_uint64_t privprotocol, const char *contextname, zbx_uint64_t interfaceid);			\
-void	zbx_audit_##funcname##_update_json_update_snmp_interface(zbx_uint64_t hostid, zbx_uint64_t version_old,	\
-		zbx_uint64_t version_new, zbx_uint64_t bulk_old,  zbx_uint64_t bulk_new,			\
-		const char *community_old, const char *community_new, const char *securityname_old,		\
-		const char *securityname_new, zbx_uint64_t securitylevel_old, zbx_uint64_t securitylevel_new,	\
-		const char *authpassphrase_old,	const char *authpassphrase_new, const char *privpassphrase_old,	\
-		const char *privpassphrase_new,	zbx_uint64_t authprotocol_old, zbx_uint64_t authprotocol_new,	\
-		zbx_uint64_t privprotocol_old, zbx_uint64_t privprotocol_new, const char *contextname_old,	\
-		const char *contextname_new, zbx_uint64_t interfaceid);						\
-
-PREPARE_AUDIT_SNMP_INTERFACE_H(host)
-PREPARE_AUDIT_SNMP_INTERFACE_H(host_prototype)
-
-void	zbx_audit_host_update_json_add_proxy_hostid_and_hostname_and_inventory_mode(zbx_uint64_t hostid,
-		zbx_uint64_t proxy_hostid, const char *hostname, int inventory_mode);
-void	zbx_audit_host_update_json_add_tls_and_psk(zbx_uint64_t hostid, int tls_connect, int tls_accept,
-		const char *tls_psk_identity, const char *tls_psk);
-void	zbx_audit_host_update_json_add_inventory_mode(zbx_uint64_t hostid, int inventory_mode);
-void	zbx_audit_host_update_json_update_inventory_mode(zbx_uint64_t hostid, int inventory_mode_old,
-		int inventory_mode_new);
-void	zbx_audit_host_update_json_update_host_status(zbx_uint64_t hostid, int host_status_old,
-		int host_status_new);
-void	zbx_audit_host_prototype_update_json_update_interface_details_create_entry(zbx_uint64_t hostid,
-		zbx_uint64_t interfaceid);
-
-#define PREPARE_AUDIT_HOST_INTERFACE_H(funcname, interface_resource, type1)					\
-void	zbx_audit_##funcname##_update_json_update_interface_##interface_resource(zbx_uint64_t hostid,		\
-		zbx_uint64_t interfaceid, type1 interface_resource##_old, type1 interface_resource##_new);	\
-
-#define	PREPARE_AUDIT_HOST_H(funcname, audit_resource_flag)							\
-void	zbx_audit_##funcname##_create_entry(int audit_action, zbx_uint64_t hostid, const char *name);		\
-void	zbx_audit_##funcname##_update_json_add_interfaces(zbx_uint64_t hostid, zbx_uint64_t interfaceid,	\
-		zbx_uint64_t main_, zbx_uint64_t type, zbx_uint64_t useip, const char *ip, const char *dns,	\
-		int port);											\
-PREPARE_AUDIT_HOST_INTERFACE_H(funcname, useip, zbx_uint64_t)							\
-PREPARE_AUDIT_HOST_INTERFACE_H(funcname, main, zbx_uint64_t)							\
-PREPARE_AUDIT_HOST_INTERFACE_H(funcname, type, zbx_uint64_t)							\
-PREPARE_AUDIT_HOST_INTERFACE_H(funcname, ip, const char*)							\
-PREPARE_AUDIT_HOST_INTERFACE_H(funcname, dns, const char*)							\
-PREPARE_AUDIT_HOST_INTERFACE_H(funcname, port, int)								\
-/* snmp */													\
-PREPARE_AUDIT_HOST_INTERFACE_H(funcname, version, zbx_uint64_t)							\
-PREPARE_AUDIT_HOST_INTERFACE_H(funcname, bulk, zbx_uint64_t)							\
-PREPARE_AUDIT_HOST_INTERFACE_H(funcname, community, const char*)						\
-PREPARE_AUDIT_HOST_INTERFACE_H(funcname, securityname, const char*)						\
-PREPARE_AUDIT_HOST_INTERFACE_H(funcname, securitylevel, int)							\
-PREPARE_AUDIT_HOST_INTERFACE_H(funcname, authpassphrase, const char*)						\
-PREPARE_AUDIT_HOST_INTERFACE_H(funcname, privpassphrase, const char*)						\
-PREPARE_AUDIT_HOST_INTERFACE_H(funcname, authprotocol, zbx_uint64_t)						\
-PREPARE_AUDIT_HOST_INTERFACE_H(funcname, privprotocol, zbx_uint64_t)						\
-PREPARE_AUDIT_HOST_INTERFACE_H(funcname, contextname, const char*)						\
-
-PREPARE_AUDIT_HOST_H(host, AUDIT_RESOURCE_HOST)
-PREPARE_AUDIT_HOST_H(host_prototype, AUDIT_RESOURCE_HOST_PROTOTYPE)
-
-#define PREPARE_AUDIT_HOST_UPDATE_H(resource, type1)							\
-void	zbx_audit_host_update_json_update_##resource(zbx_uint64_t hostid, type1 old_##resource,		\
-		type1 new_##resource);									\
-
-PREPARE_AUDIT_HOST_UPDATE_H(host, const char*)
-PREPARE_AUDIT_HOST_UPDATE_H(name, const char*)
-PREPARE_AUDIT_HOST_UPDATE_H(proxy_hostid, zbx_uint64_t)
-PREPARE_AUDIT_HOST_UPDATE_H(ipmi_authtype, int)
-PREPARE_AUDIT_HOST_UPDATE_H(ipmi_privilege, int)
-PREPARE_AUDIT_HOST_UPDATE_H(ipmi_username, const char*)
-PREPARE_AUDIT_HOST_UPDATE_H(ipmi_password, const char*)
-PREPARE_AUDIT_HOST_UPDATE_H(tls_connect, int)
-PREPARE_AUDIT_HOST_UPDATE_H(tls_accept, int)
-PREPARE_AUDIT_HOST_UPDATE_H(tls_issuer, const char*)
-PREPARE_AUDIT_HOST_UPDATE_H(tls_subject, const char*)
-PREPARE_AUDIT_HOST_UPDATE_H(tls_psk_identity, const char*)
-PREPARE_AUDIT_HOST_UPDATE_H(tls_psk, const char*)
-PREPARE_AUDIT_HOST_UPDATE_H(custom_interfaces, int)
-#undef PREPARE_AUDIT_HOST_UPDATE_H
-
-void	zbx_audit_host_update_json_delete_interface(zbx_uint64_t hostid, zbx_uint64_t interfaceid);
-void	zbx_audit_host_update_json_add_hostmacro(zbx_uint64_t hostid, zbx_uint64_t macroid,
-		const char *macro, const char *value, const char *description, int type);
-
-#define PREPARE_AUDIT_HOST_UPDATE_HOSTMACRO_H(resource, type1)					\
-void	zbx_audit_host_update_json_update_hostmacro_##resource(zbx_uint64_t hostid,		\
-		zbx_uint64_t hostmacroid, type1 old_##resource, type1 new_##resource);
-PREPARE_AUDIT_HOST_UPDATE_HOSTMACRO_H(value, const char*)
-PREPARE_AUDIT_HOST_UPDATE_HOSTMACRO_H(description, const char*)
-PREPARE_AUDIT_HOST_UPDATE_HOSTMACRO_H(type, int)
-
-void	zbx_audit_host_update_json_delete_hostmacro(zbx_uint64_t hostid, zbx_uint64_t hostmacroid);
-
-void	zbx_audit_host_update_json_add_tag(zbx_uint64_t hostid, zbx_uint64_t tagid, const char* tag,
-		const char* value);
-
-void	zbx_audit_host_update_json_update_tag_tag(zbx_uint64_t hostid, zbx_uint64_t tagid,
-		const char* tag_old, const char *tag_new);
-
-void	zbx_audit_host_update_json_update_tag_value(zbx_uint64_t hostid, zbx_uint64_t tagid,
-		const char* value_old, const char *value_new);
-
-void	zbx_audit_host_update_json_delete_tag(zbx_uint64_t hostid, zbx_uint64_t tagid);
-
-void	zbx_audit_hostgroup_update_json_add_group(zbx_uint64_t hostid, zbx_uint64_t hostgroupid, zbx_uint64_t groupid);
-void	zbx_audit_hostgroup_update_json_delete_group(zbx_uint64_t hostid, zbx_uint64_t hostgroupid,
-		zbx_uint64_t groupid);
-void	zbx_audit_host_hostgroup_delete(zbx_uint64_t hostid, const char* hostname, zbx_vector_uint64_t *hostgroupids,
-		zbx_vector_uint64_t *groupids);
-void	zbx_audit_host_del(zbx_uint64_t hostid, const char *hostname);
-void	zbx_audit_host_update_json_add_details(zbx_uint64_t hostid, const char *host, zbx_uint64_t proxy_hostid,
-		int ipmi_authtype, int ipmi_privilege, const char *ipmi_username, const char *ipmi_password,
-		int status, int flags, int tls_connect, int tls_accept, const char *tls_issuer, const char *tls_subject,
-		const char *tls_psk_identity, const char *tls_psk, int custom_interfaces, int inventory_mode);
-void	zbx_audit_host_prototype_del(zbx_uint64_t hostid, const char *hostname);
-void	zbx_audit_host_prototype_update_json_add_details(zbx_uint64_t hostid, zbx_uint64_t templateid, const char *name,
-		int status, int discover, int custom_interfaces, int inventory_mode);
-void	zbx_audit_host_prototype_update_json_update_templateid(zbx_uint64_t hostid, zbx_uint64_t templateid_orig,
-		zbx_uint64_t templateid);
-
-#define PREPARE_AUDIT_HOST_PROTOTYPE_UPDATE_H(resource, type1)							\
-void	zbx_audit_host_prototype_update_json_update_##resource(zbx_uint64_t hostid, type1 old_##resource,	\
-		type1 new_##resource);										\
-
-PREPARE_AUDIT_HOST_PROTOTYPE_UPDATE_H(name, const char*)
-PREPARE_AUDIT_HOST_PROTOTYPE_UPDATE_H(status, int)
-PREPARE_AUDIT_HOST_PROTOTYPE_UPDATE_H(discover, int)
-PREPARE_AUDIT_HOST_PROTOTYPE_UPDATE_H(custom_interfaces, int)
-PREPARE_AUDIT_HOST_PROTOTYPE_UPDATE_H(inventory_mode, int)
-
-void	zbx_audit_host_prototype_update_json_add_group_details(zbx_uint64_t hostid, zbx_uint64_t group_prototypeid,
-		const char* name, zbx_uint64_t groupid, zbx_uint64_t templateid);
-
-void	zbx_audit_host_prototype_update_json_update_group_details(zbx_uint64_t hostid, zbx_uint64_t group_prototypeid,
-		const char* name, zbx_uint64_t groupid, zbx_uint64_t templateid_old, zbx_uint64_t templateid_new);
-
-#define PREPARE_AUDIT_TEMPLATE_ADD_H(funcname)									\
-void	zbx_audit_##funcname##_update_json_add_parent_template(zbx_uint64_t hostid,				\
-		zbx_uint64_t hosttemplateid, zbx_uint64_t templateid);
-#define PREPARE_AUDIT_TEMPLATE_DELETE_H(funcname)								\
-void	zbx_audit_##funcname##_update_json_delete_parent_template(zbx_uint64_t hostid,				\
-		zbx_uint64_t hosttemplateid);
-PREPARE_AUDIT_TEMPLATE_ADD_H(host)
-PREPARE_AUDIT_TEMPLATE_DELETE_H(host)
-PREPARE_AUDIT_TEMPLATE_ADD_H(host_prototype)
-PREPARE_AUDIT_TEMPLATE_DELETE_H(host_prototype)
-
-void	zbx_audit_host_prototype_update_json_delete_interface(zbx_uint64_t hostid, zbx_uint64_t interfaceid);
-
-void	zbx_audit_host_prototype_update_json_add_hostmacro(zbx_uint64_t hostid, zbx_uint64_t macroid,
-		const char *macro, const char *value, const char *description, int type);
-void	zbx_audit_host_update_json_update_hostmacro_create_entry(zbx_uint64_t hostid,
-		zbx_uint64_t hostmacroid);
-void	zbx_audit_host_prototype_update_json_update_hostmacro_create_entry(zbx_uint64_t hostid,
-		zbx_uint64_t hostmacroid);
-#define PREPARE_AUDIT_HOST_PROTOTYPE_UPDATE_HOSTMACRO_H(resource, type1)					\
-void	zbx_audit_host_prototype_update_json_update_hostmacro_##resource(zbx_uint64_t hostid,			\
-		zbx_uint64_t hostmacroid, type1 old_##resource, type1 new_##resource);
-PREPARE_AUDIT_HOST_PROTOTYPE_UPDATE_HOSTMACRO_H(value, const char*)
-PREPARE_AUDIT_HOST_PROTOTYPE_UPDATE_HOSTMACRO_H(description, const char*)
-PREPARE_AUDIT_HOST_PROTOTYPE_UPDATE_HOSTMACRO_H(type, int)
-
-void	zbx_audit_host_prototype_update_json_delete_hostmacro(zbx_uint64_t hostid, zbx_uint64_t hostmacroid);
-
-void	zbx_audit_host_prototype_update_json_add_tag(zbx_uint64_t hostid, zbx_uint64_t tagid, const char* tag,
-		const char* value);
-void	zbx_audit_host_prototype_update_json_update_tag_create_entry(zbx_uint64_t hostid, zbx_uint64_t tagid);
-void	zbx_audit_host_update_json_update_tag_create_entry(zbx_uint64_t hostid, zbx_uint64_t tagid);
-void	zbx_audit_host_prototype_update_json_update_tag_tag(zbx_uint64_t hostid, zbx_uint64_t tagid,
-		const char* tag_old, const char *tag_new);
-void	zbx_audit_host_prototype_update_json_update_tag_value(zbx_uint64_t hostid, zbx_uint64_t tagid,
-		const char* value_old, const char *value_new);
-
-void	zbx_audit_host_prototype_update_json_delete_tag(zbx_uint64_t hostid, zbx_uint64_t tagid);
-
-void	zbx_audit_host_group_create_entry(int audit_action, zbx_uint64_t groupid, const char *name);
-void	zbx_audit_host_group_del(zbx_uint64_t groupid, const char *name);
-void	zbx_audit_host_group_update_json_add_details(zbx_uint64_t groupid, const char *name, int flags);
-
-#define PREPARE_AUDIT_HOST_GROUP_UPDATE_H(resource, type1)							\
-void	zbx_audit_host_group_update_json_update_##resource(zbx_uint64_t groupid, type1 old_##resource,		\
-		type1 new_##resource);										\
-
-PREPARE_AUDIT_HOST_GROUP_UPDATE_H(name, const char*)
-#undef PREPARE_AUDIT_HOST_UPDATE_H
-
-#endif	/* ZABBIX_AUDIT_HOST_H */
diff --git a/src/libs/zbxaudit/audit_httptest.c b/src/libs/zbxaudit/audit_httptest.c
index 7131a2a24be..4857f30d42d 100644
--- a/src/libs/zbxaudit/audit_httptest.c
+++ b/src/libs/zbxaudit/audit_httptest.c
@@ -17,8 +17,9 @@
 ** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
 **/
 
-#include "audit_httptest.h"
+#include "audit/zbxaudit_httptest.h"
 
+#include "audit/zbxaudit.h"
 #include "log.h"
 #include "zbxalgo.h"
 #include "audit.h"
@@ -162,7 +163,7 @@ int	zbx_audit_DBselect_delete_for_httptest(const char *sql, zbx_vector_uint64_t
 		ZBX_STR2UINT64(id, row[0]);
 		zbx_vector_uint64_append(ids, id);
 
-		zbx_audit_httptest_create_entry(AUDIT_ACTION_DELETE, id, row[1]);
+		zbx_audit_httptest_create_entry(ZBX_AUDIT_ACTION_DELETE, id, row[1]);
 	}
 
 	DBfree_result(result);
diff --git a/src/libs/zbxaudit/audit_httptest.h b/src/libs/zbxaudit/audit_httptest.h
deleted file mode 100644
index d6082269e70..00000000000
--- a/src/libs/zbxaudit/audit_httptest.h
+++ /dev/null
@@ -1,88 +0,0 @@
-/*
-** Zabbix
-** Copyright (C) 2001-2022 Zabbix SIA
-**
-** This program is free software; you can redistribute it and/or modify
-** it under the terms of the GNU General Public License as published by
-** the Free Software Foundation; either version 2 of the License, or
-** (at your option) any later version.
-**
-** This program is distributed in the hope that it will be useful,
-** but WITHOUT ANY WARRANTY; without even the implied warranty of
-** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-** GNU General Public License for more details.
-**
-** You should have received a copy of the GNU General Public License
-** along with this program; if not, write to the Free Software
-** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
-**/
-
-#ifndef ZABBIX_AUDIT_HTTPTEST_H
-#define ZABBIX_AUDIT_HTTPTEST_H
-
-#include "common.h"
-#include "zbxalgo.h"
-
-void	zbx_audit_httptest_create_entry(int audit_action, zbx_uint64_t httptestid, const char *name);
-
-void	zbx_audit_httptest_update_json_add_data(zbx_uint64_t httptestid, zbx_uint64_t templateid, const char *name,
-		const char *delay, unsigned char status, const char *agent, unsigned char authentication,
-		const char *httpuser, const char *httppassword, const char *http_proxy, int retries,
-		const char *ssl_cert_file, const char *ssl_key_file, const char *ssl_key_password, int verify_peer,
-		int verify_host, zbx_uint64_t hostid);
-
-#define PREPARE_AUDIT_HTTPTEST_UPDATE_H(resource, type1)						\
-void	zbx_audit_httptest_update_json_update_##resource(zbx_uint64_t httptestid, type1 resource##_old,	\
-		type1 resource##_new);
-
-PREPARE_AUDIT_HTTPTEST_UPDATE_H(templateid, zbx_uint64_t)
-PREPARE_AUDIT_HTTPTEST_UPDATE_H(delay, const char*)
-PREPARE_AUDIT_HTTPTEST_UPDATE_H(agent, const char*)
-PREPARE_AUDIT_HTTPTEST_UPDATE_H(http_user, const char*)
-PREPARE_AUDIT_HTTPTEST_UPDATE_H(http_password, const char*)
-PREPARE_AUDIT_HTTPTEST_UPDATE_H(http_proxy, const char*)
-PREPARE_AUDIT_HTTPTEST_UPDATE_H(retries, int)
-PREPARE_AUDIT_HTTPTEST_UPDATE_H(status, int)
-PREPARE_AUDIT_HTTPTEST_UPDATE_H(authentication, int)
-PREPARE_AUDIT_HTTPTEST_UPDATE_H(ssl_cert_file, const char*)
-PREPARE_AUDIT_HTTPTEST_UPDATE_H(ssl_key_file, const char*)
-PREPARE_AUDIT_HTTPTEST_UPDATE_H(ssl_key_password, const char*)
-PREPARE_AUDIT_HTTPTEST_UPDATE_H(verify_peer, int)
-PREPARE_AUDIT_HTTPTEST_UPDATE_H(verify_host, int)
-
-int	zbx_audit_DBselect_delete_for_httptest(const char *sql, zbx_vector_uint64_t *ids);
-
-void	zbx_audit_httptest_update_json_add_httptest_tag(zbx_uint64_t httptestid, zbx_uint64_t tagid, const char *tag,
-		const char *value);
-
-void	zbx_audit_httptest_update_json_delete_tags(zbx_uint64_t httptestid, zbx_uint64_t tagid);
-
-void	zbx_audit_httptest_update_json_add_httptest_httpstep(zbx_uint64_t httptestid, zbx_uint64_t httpstepid,
-		const char *name, int no, const char *url, const char *timeout, const char *posts, const char *required,
-		const char *status_codes, int follow_redirects, int retrieve_mode, int post_type);
-
-#define PREPARE_AUDIT_HTTPSTEP_UPDATE_H(resource, type1)					\
-void	zbx_audit_httptest_update_json_httpstep_update_##resource(zbx_uint64_t httptestid,	\
-		zbx_uint64_t httpstepid, type1 resource##_old, type1 resource##_new);
-
-PREPARE_AUDIT_HTTPSTEP_UPDATE_H(url, const char*)
-PREPARE_AUDIT_HTTPSTEP_UPDATE_H(posts, const char*)
-PREPARE_AUDIT_HTTPSTEP_UPDATE_H(required, const char*)
-PREPARE_AUDIT_HTTPSTEP_UPDATE_H(status_codes, const char*)
-PREPARE_AUDIT_HTTPSTEP_UPDATE_H(timeout, const char*)
-PREPARE_AUDIT_HTTPSTEP_UPDATE_H(follow_redirects, int)
-PREPARE_AUDIT_HTTPSTEP_UPDATE_H(retrieve_mode, int)
-PREPARE_AUDIT_HTTPSTEP_UPDATE_H(post_type, int)
-
-void	zbx_audit_httptest_update_json_add_httptest_field(zbx_uint64_t httptestid, zbx_uint64_t httptestfieldid,
-		int type, const char *name, const char *value);
-
-void	zbx_audit_httptest_update_json_delete_httptest_field(zbx_uint64_t httptestid, zbx_uint64_t fieldid, int type);
-
-void	zbx_audit_httptest_update_json_add_httpstep_field(zbx_uint64_t httptestid, zbx_uint64_t httpstepid,
-		zbx_uint64_t httpstepfieldid, int type, const char *name, const char *value);
-
-void	zbx_audit_httptest_update_json_delete_httpstep_field(zbx_uint64_t httptestid, zbx_uint64_t httpstepid,
-		zbx_uint64_t fieldid, int type);
-
-#endif	/* ZABBIX_AUDIT_HTTPTEST_H */
diff --git a/src/libs/zbxaudit/audit_item.c b/src/libs/zbxaudit/audit_item.c
index 85727b0b8e2..b51d172158c 100644
--- a/src/libs/zbxaudit/audit_item.c
+++ b/src/libs/zbxaudit/audit_item.c
@@ -17,8 +17,9 @@
 ** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
 **/
 
-#include "audit_item.h"
+#include "audit/zbxaudit_item.h"
 
+#include "audit/zbxaudit.h"
 #include "log.h"
 #include "audit.h"
 #include "db.h"
@@ -393,7 +394,7 @@ void	zbx_audit_item_create_entry_for_delete(zbx_uint64_t id, const char *name, i
 	{
 		zbx_audit_entry_t	*local_audit_item_entry_insert;
 
-		local_audit_item_entry_insert = zbx_audit_entry_init(id, AUDIT_ITEM_ID, name, AUDIT_ACTION_DELETE,
+		local_audit_item_entry_insert = zbx_audit_entry_init(id, AUDIT_ITEM_ID, name, ZBX_AUDIT_ACTION_DELETE,
 				resource_type);
 		zbx_hashset_insert(zbx_get_audit_hashset(), &local_audit_item_entry_insert,
 				sizeof(local_audit_item_entry_insert));
diff --git a/src/libs/zbxaudit/audit_item.h b/src/libs/zbxaudit/audit_item.h
deleted file mode 100644
index 48ef9186678..00000000000
--- a/src/libs/zbxaudit/audit_item.h
+++ /dev/null
@@ -1,196 +0,0 @@
-/*
-** Zabbix
-** Copyright (C) 2001-2022 Zabbix SIA
-**
-** This program is free software; you can redistribute it and/or modify
-** it under the terms of the GNU General Public License as published by
-** the Free Software Foundation; either version 2 of the License, or
-** (at your option) any later version.
-**
-** This program is distributed in the hope that it will be useful,
-** but WITHOUT ANY WARRANTY; without even the implied warranty of
-** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-** GNU General Public License for more details.
-**
-** You should have received a copy of the GNU General Public License
-** along with this program; if not, write to the Free Software
-** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
-**/
-
-#ifndef ZABBIX_AUDIT_ITEM_H
-#define ZABBIX_AUDIT_ITEM_H
-
-#include "common.h"
-
-#include "../zbxdbhigh/template.h"
-#include "../../zabbix_server/lld/lld.h"
-
-void	zbx_audit_item_create_entry(int audit_action, zbx_uint64_t itemid, const char *name, int flags);
-void	zbx_audit_item_update_json_add_data(zbx_uint64_t itemid, const zbx_template_item_t *item, zbx_uint64_t hostid);
-void	zbx_audit_item_update_json_add_lld_data(zbx_uint64_t itemid, const zbx_lld_item_full_t *item,
-		const zbx_lld_item_prototype_t *item_prototype, zbx_uint64_t hostid);
-
-#define PREPARE_AUDIT_ITEM_UPDATE_H(resource, type1)								\
-void	zbx_audit_item_update_json_update_##resource(zbx_uint64_t itemid, int flags,				\
-		type1 resource##_old, type1 resource##_new);
-
-PREPARE_AUDIT_ITEM_UPDATE_H(interfaceid, zbx_uint64_t)
-PREPARE_AUDIT_ITEM_UPDATE_H(templateid, zbx_uint64_t)
-PREPARE_AUDIT_ITEM_UPDATE_H(name, const char*)
-PREPARE_AUDIT_ITEM_UPDATE_H(type, int)
-PREPARE_AUDIT_ITEM_UPDATE_H(value_type, int)
-PREPARE_AUDIT_ITEM_UPDATE_H(delay, const char*)
-PREPARE_AUDIT_ITEM_UPDATE_H(history, const char*)
-PREPARE_AUDIT_ITEM_UPDATE_H(trends, const char*)
-PREPARE_AUDIT_ITEM_UPDATE_H(status, int)
-PREPARE_AUDIT_ITEM_UPDATE_H(trapper_hosts, const char*)
-PREPARE_AUDIT_ITEM_UPDATE_H(units, const char*)
-PREPARE_AUDIT_ITEM_UPDATE_H(formula, const char*)
-PREPARE_AUDIT_ITEM_UPDATE_H(logtimefmt, const char*)
-PREPARE_AUDIT_ITEM_UPDATE_H(valuemapid, zbx_uint64_t)
-PREPARE_AUDIT_ITEM_UPDATE_H(params, const char*)
-PREPARE_AUDIT_ITEM_UPDATE_H(ipmi_sensor, const char*)
-PREPARE_AUDIT_ITEM_UPDATE_H(snmp_oid, const char*)
-PREPARE_AUDIT_ITEM_UPDATE_H(authtype, int)
-PREPARE_AUDIT_ITEM_UPDATE_H(username, const char*)
-PREPARE_AUDIT_ITEM_UPDATE_H(password, const char*)
-PREPARE_AUDIT_ITEM_UPDATE_H(publickey, const char*)
-PREPARE_AUDIT_ITEM_UPDATE_H(privatekey, const char*)
-PREPARE_AUDIT_ITEM_UPDATE_H(flags, int)
-PREPARE_AUDIT_ITEM_UPDATE_H(description, const char*)
-PREPARE_AUDIT_ITEM_UPDATE_H(inventory_link, int)
-PREPARE_AUDIT_ITEM_UPDATE_H(lifetime, const char*)
-PREPARE_AUDIT_ITEM_UPDATE_H(evaltype, int)
-PREPARE_AUDIT_ITEM_UPDATE_H(jmx_endpoint, const char*)
-PREPARE_AUDIT_ITEM_UPDATE_H(master_itemid, zbx_uint64_t)
-PREPARE_AUDIT_ITEM_UPDATE_H(timeout, const char*)
-PREPARE_AUDIT_ITEM_UPDATE_H(url, const char*)
-PREPARE_AUDIT_ITEM_UPDATE_H(query_fields, const char*)
-PREPARE_AUDIT_ITEM_UPDATE_H(posts, const char*)
-PREPARE_AUDIT_ITEM_UPDATE_H(status_codes, const char*)
-PREPARE_AUDIT_ITEM_UPDATE_H(follow_redirects, int)
-PREPARE_AUDIT_ITEM_UPDATE_H(redirects, int)
-PREPARE_AUDIT_ITEM_UPDATE_H(post_type, int)
-PREPARE_AUDIT_ITEM_UPDATE_H(http_proxy, const char*)
-PREPARE_AUDIT_ITEM_UPDATE_H(headers, const char*)
-PREPARE_AUDIT_ITEM_UPDATE_H(retrieve_mode, int)
-PREPARE_AUDIT_ITEM_UPDATE_H(request_method, int)
-PREPARE_AUDIT_ITEM_UPDATE_H(output_format, int)
-PREPARE_AUDIT_ITEM_UPDATE_H(ssl_cert_file, const char*)
-PREPARE_AUDIT_ITEM_UPDATE_H(ssl_key_file, const char*)
-PREPARE_AUDIT_ITEM_UPDATE_H(ssl_key_password, const char*)
-PREPARE_AUDIT_ITEM_UPDATE_H(verify_peer, int)
-PREPARE_AUDIT_ITEM_UPDATE_H(verify_host, int)
-PREPARE_AUDIT_ITEM_UPDATE_H(allow_traps, int)
-PREPARE_AUDIT_ITEM_UPDATE_H(discover, int)
-PREPARE_AUDIT_ITEM_UPDATE_H(key, const char*)
-
-void	zbx_audit_item_create_entry_for_delete(zbx_uint64_t id, const char *name, int flag);
-int	zbx_audit_DBselect_delete_for_item(const char *sql, zbx_vector_uint64_t *ids);
-
-void	zbx_audit_discovery_rule_update_json_add_filter_conditions(zbx_uint64_t itemid, zbx_uint64_t rule_conditionid,
-		zbx_uint64_t op, const char *macro, const char *value);
-void	zbx_audit_discovery_rule_update_json_update_filter_conditions_create_entry(zbx_uint64_t itemid,
-		zbx_uint64_t item_conditionid);
-
-#define PREPARE_AUDIT_DISCOVERY_RULE_UPDATE_H(resource, type1)							\
-void	zbx_audit_discovery_rule_update_json_update_filter_conditions_##resource(zbx_uint64_t itemid,		\
-		zbx_uint64_t item_conditionid, type1 resource##_old, type1 resource##_new);
-PREPARE_AUDIT_DISCOVERY_RULE_UPDATE_H(operator, int)
-PREPARE_AUDIT_DISCOVERY_RULE_UPDATE_H(macro, const char*)
-PREPARE_AUDIT_DISCOVERY_RULE_UPDATE_H(value, const char*)
-
-void	zbx_audit_discovery_rule_update_json_delete_filter_conditions(zbx_uint64_t itemid,
-		zbx_uint64_t item_conditionid);
-
-void	zbx_audit_item_update_json_add_item_preproc(zbx_uint64_t itemid, zbx_uint64_t preprocid, int item_flags,
-		int step, int type, const char *params, int error_handler, const char *error_handler_params);
-
-void	zbx_audit_item_update_json_update_item_preproc_create_entry(zbx_uint64_t itemid, int item_flags,
-		zbx_uint64_t preprocid);
-
-#define PREPARE_AUDIT_ITEM_UPDATE_PREPROC_H(resource, type1)							\
-void	zbx_audit_item_update_json_update_item_preproc_##resource(zbx_uint64_t itemid, int item_flags,		\
-		zbx_uint64_t preprocid, type1 resource##_old, type1 resource##_new);
-
-PREPARE_AUDIT_ITEM_UPDATE_PREPROC_H(type, int)
-PREPARE_AUDIT_ITEM_UPDATE_PREPROC_H(params, const char*)
-PREPARE_AUDIT_ITEM_UPDATE_PREPROC_H(error_handler, int)
-PREPARE_AUDIT_ITEM_UPDATE_PREPROC_H(error_handler_params, const char*)
-
-void	zbx_audit_item_delete_preproc(zbx_uint64_t itemid, int item_flags, zbx_uint64_t preprocid);
-
-void	zbx_audit_item_update_json_add_item_tag(zbx_uint64_t itemid, zbx_uint64_t tagid, int item_flags,
-		const char *tag, const char *value);
-
-void	zbx_audit_item_update_json_update_item_tag_create_entry(zbx_uint64_t itemid, int item_flags,
-		zbx_uint64_t tagid);
-
-#define PREPARE_AUDIT_ITEM_UPDATE_TAG_H(resource, type1)							\
-void	zbx_audit_item_update_json_update_item_tag_##resource(zbx_uint64_t itemid, int item_flags,		\
-		zbx_uint64_t tagid, type1 resource##_old, type1 resource##_new);
-
-PREPARE_AUDIT_ITEM_UPDATE_TAG_H(tag, const char*)
-PREPARE_AUDIT_ITEM_UPDATE_TAG_H(value, const char*)
-
-void	zbx_audit_item_delete_tag(zbx_uint64_t itemid, int item_flags, zbx_uint64_t tagid);
-
-void	zbx_audit_item_update_json_add_params(zbx_uint64_t itemid, int item_flags, zbx_uint64_t item_parameter_id,
-		const char *name, const char *value);
-
-void	zbx_audit_item_update_json_update_params_create_entry(zbx_uint64_t itemid, int item_flags, zbx_uint64_t
-		item_parameter_id);
-
-#define PREPARE_AUDIT_ITEM_PARAMS_UPDATE_H(resource)								\
-void	zbx_audit_item_update_json_update_params_##resource(zbx_uint64_t itemid, int item_flags,		\
-		zbx_uint64_t item_parameter_id, const char *resource##_orig, const char *resource);
-
-PREPARE_AUDIT_ITEM_PARAMS_UPDATE_H(name)
-PREPARE_AUDIT_ITEM_PARAMS_UPDATE_H(value)
-
-void	zbx_audit_item_delete_params(zbx_uint64_t itemid, int item_flags, zbx_uint64_t item_parameter_id);
-
-void	zbx_audit_discovery_rule_update_json_add_lld_macro_path(zbx_uint64_t itemid,
-		zbx_uint64_t lld_macro_pathid, const char *lld_macro, const char *path);
-
-void	zbx_audit_discovery_rule_update_json_lld_macro_path_create_update_entry(zbx_uint64_t itemid,
-		zbx_uint64_t lld_macro_pathid);
-
-#define PREPARE_AUDIT_DISCOVERY_RULE_UPDATE_LLD_MACRO_PATH_H(resource)						\
-void	zbx_audit_discovery_rule_update_json_update_lld_macro_path_##resource(zbx_uint64_t itemid,		\
-		zbx_uint64_t lld_macro_pathid, const char *resource##_old, const char *resource##_new);
-PREPARE_AUDIT_DISCOVERY_RULE_UPDATE_LLD_MACRO_PATH_H(lld_macro)
-PREPARE_AUDIT_DISCOVERY_RULE_UPDATE_LLD_MACRO_PATH_H(path)
-void	zbx_audit_discovery_rule_update_json_delete_lld_macro_path(zbx_uint64_t itemid,
-		zbx_uint64_t lld_macro_pathid);
-
-void	zbx_audit_discovery_rule_update_json_add_lld_override(zbx_uint64_t itemid, zbx_uint64_t overrideid,
-		const char *name, int step, int stop);
-void	zbx_audit_discovery_rule_update_json_delete_lld_override(zbx_uint64_t itemid, zbx_uint64_t overrideid);
-void	zbx_audit_discovery_rule_update_json_add_lld_override_filter(zbx_uint64_t itemid, zbx_uint64_t overrideid,
-		int evaltype, const char *formula);
-
-void	zbx_audit_discovery_rule_update_json_add_lld_override_condition(zbx_uint64_t itemid, zbx_uint64_t overrideid,
-		zbx_uint64_t override_conditionid, int condition_operator, const char *macro, const char *value);
-
-void	zbx_audit_discovery_rule_update_json_add_lld_override_operation(zbx_uint64_t itemid, zbx_uint64_t overrideid,
-		zbx_uint64_t override_operationid,  int condition_operator, const char *value);
-
-#define PREPARE_AUDIT_DISCOVERY_RULE_OVERRIDE_ADD_H(resource, type)						\
-void	zbx_audit_discovery_rule_update_json_add_lld_override_##resource(zbx_uint64_t itemid,			\
-		zbx_uint64_t overrideid, zbx_uint64_t resource##_id, type resource);
-
-PREPARE_AUDIT_DISCOVERY_RULE_OVERRIDE_ADD_H(opstatus, int)
-PREPARE_AUDIT_DISCOVERY_RULE_OVERRIDE_ADD_H(opdiscover, int)
-PREPARE_AUDIT_DISCOVERY_RULE_OVERRIDE_ADD_H(opperiod, const char*)
-PREPARE_AUDIT_DISCOVERY_RULE_OVERRIDE_ADD_H(optrends, const char*)
-PREPARE_AUDIT_DISCOVERY_RULE_OVERRIDE_ADD_H(ophistory, const char*)
-PREPARE_AUDIT_DISCOVERY_RULE_OVERRIDE_ADD_H(opseverity, int)
-PREPARE_AUDIT_DISCOVERY_RULE_OVERRIDE_ADD_H(opinventory, int)
-
-void	zbx_audit_discovery_rule_update_json_add_lld_override_optag(zbx_uint64_t itemid, zbx_uint64_t overrideid,
-		zbx_uint64_t lld_override_optagid, const char *tag, const char *value);
-
-void	zbx_audit_discovery_rule_update_json_add_lld_override_optemplate(zbx_uint64_t itemid, zbx_uint64_t overrideid,
-		zbx_uint64_t lld_override_optemplateid, zbx_uint64_t templateid);
-#endif	/* ZABBIX_AUDIT_ITEM_H */
diff --git a/src/libs/zbxaudit/audit_settings.c b/src/libs/zbxaudit/audit_settings.c
index 07761c0e07d..1641cd6c9e3 100644
--- a/src/libs/zbxaudit/audit_settings.c
+++ b/src/libs/zbxaudit/audit_settings.c
@@ -17,11 +17,13 @@
 ** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
 **/
 
-#include "audit_settings.h"
+#include "audit/zbxaudit_settings.h"
 
-#include "zbxalgo.h"
+#include "audit/zbxaudit.h"
 #include "audit.h"
 
+#include "zbxalgo.h"
+
 void	zbx_audit_settings_create_entry(int audit_action, zbx_uint64_t configid)
 {
 	zbx_audit_entry_t	local_audit_entry, *plocal_audit_entry = &local_audit_entry;
@@ -48,5 +50,5 @@ void	zbx_audit_settings_update_field_int(zbx_uint64_t configid, const char *key,
 	RETURN_IF_AUDIT_OFF();
 
 	entry = zbx_audit_get_entry(configid, NULL, AUDIT_CONFIG_ID);
-	zbx_audit_entry_append_int(entry, AUDIT_ACTION_UPDATE, key, old_value, new_value);
+	zbx_audit_entry_append_int(entry, ZBX_AUDIT_ACTION_UPDATE, key, old_value, new_value);
 }
diff --git a/src/libs/zbxaudit/audit_settings.h b/src/libs/zbxaudit/audit_settings.h
deleted file mode 100644
index 689686f586f..00000000000
--- a/src/libs/zbxaudit/audit_settings.h
+++ /dev/null
@@ -1,28 +0,0 @@
-/*
-** Zabbix
-** Copyright (C) 2001-2022 Zabbix SIA
-**
-** This program is free software; you can redistribute it and/or modify
-** it under the terms of the GNU General Public License as published by
-** the Free Software Foundation; either version 2 of the License, or
-** (at your option) any later version.
-**
-** This program is distributed in the hope that it will be useful,
-** but WITHOUT ANY WARRANTY; without even the implied warranty of
-** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-** GNU General Public License for more details.
-**
-** You should have received a copy of the GNU General Public License
-** along with this program; if not, write to the Free Software
-** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
-**/
-
-#ifndef ZABBIX_AUDIT_SETTINGS_H
-#define ZABBIX_AUDIT_SETTINGS_H
-
-#include "zbxtypes.h"
-
-void	zbx_audit_settings_create_entry(int audit_action, zbx_uint64_t configid);
-void	zbx_audit_settings_update_field_int(zbx_uint64_t configid, const char *key, int old_value, int new_value);
-
-#endif
diff --git a/src/libs/zbxaudit/audit_trigger.c b/src/libs/zbxaudit/audit_trigger.c
index 4085a48c772..86d32c06dff 100644
--- a/src/libs/zbxaudit/audit_trigger.c
+++ b/src/libs/zbxaudit/audit_trigger.c
@@ -17,8 +17,9 @@
 ** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
 **/
 
-#include "audit_trigger.h"
+#include "audit/zbxaudit_trigger.h"
 
+#include "audit/zbxaudit.h"
 #include "log.h"
 #include "db.h"
 #include "zbxdb.h"
@@ -70,7 +71,7 @@ void	zbx_audit_trigger_create_entry(int audit_action, zbx_uint64_t triggerid, co
 		zbx_hashset_insert(zbx_get_audit_hashset(), &local_audit_trigger_entry_insert,
 				sizeof(local_audit_trigger_entry_insert));
 
-		if (AUDIT_ACTION_ADD == audit_action)
+		if (ZBX_AUDIT_ACTION_ADD == audit_action)
 		{
 			zbx_audit_update_json_append_uint64(triggerid, AUDIT_TRIGGER_ID, AUDIT_DETAILS_ACTION_ADD,
 					TR_OR_TRP(triggerid), triggerid, "triggers", "triggerid");
@@ -240,7 +241,7 @@ void	zbx_audit_DBselect_delete_for_trigger(const char *sql, zbx_vector_uint64_t
 		ZBX_STR2UINT64(id, row[0]);
 		zbx_vector_uint64_append(ids, id);
 
-		zbx_audit_trigger_create_entry(AUDIT_ACTION_DELETE, id, row[1], atoi(row[2]));
+		zbx_audit_trigger_create_entry(ZBX_AUDIT_ACTION_DELETE, id, row[1], atoi(row[2]));
 	}
 
 	DBfree_result(result);
diff --git a/src/libs/zbxaudit/audit_trigger.h b/src/libs/zbxaudit/audit_trigger.h
deleted file mode 100644
index 11f30420b3e..00000000000
--- a/src/libs/zbxaudit/audit_trigger.h
+++ /dev/null
@@ -1,72 +0,0 @@
-/*
-** Zabbix
-** Copyright (C) 2001-2022 Zabbix SIA
-**
-** This program is free software; you can redistribute it and/or modify
-** it under the terms of the GNU General Public License as published by
-** the Free Software Foundation; either version 2 of the License, or
-** (at your option) any later version.
-**
-** This program is distributed in the hope that it will be useful,
-** but WITHOUT ANY WARRANTY; without even the implied warranty of
-** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-** GNU General Public License for more details.
-**
-** You should have received a copy of the GNU General Public License
-** along with this program; if not, write to the Free Software
-** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
-**/
-
-#ifndef ZABBIX_AUDIT_TRIGGER_H
-#define ZABBIX_AUDIT_TRIGGER_H
-
-#include "common.h"
-#include "zbxalgo.h"
-
-void	zbx_audit_trigger_create_entry(int audit_action, zbx_uint64_t triggerid, const char *name, int flags);
-
-void	zbx_audit_trigger_update_json_add_data(zbx_uint64_t triggerid, zbx_uint64_t templateid,
-		unsigned char recovery_mode, unsigned char status, unsigned char type, zbx_uint64_t value,
-		zbx_uint64_t state, unsigned char priority, const char *comments, const char *url, int flags,
-		unsigned char correlation_mode, const char *correlation_tag, unsigned char manual_close,
-		const char *opdata, unsigned char discover, const char *event_name);
-
-void	zbx_audit_trigger_update_json_add_expr(zbx_uint64_t triggerid, int flags, const char *expression);
-void	zbx_audit_trigger_update_json_add_rexpr(zbx_uint64_t triggerid, int flags, const char *recovery_expression);
-
-#define PREPARE_AUDIT_TRIGGER_UPDATE_H(resource, type1)								\
-void	zbx_audit_trigger_update_json_update_##resource(zbx_uint64_t triggerid, int flags,			\
-		type1 resource##_old, type1 resource##_new);
-PREPARE_AUDIT_TRIGGER_UPDATE_H(flags, int)
-PREPARE_AUDIT_TRIGGER_UPDATE_H(recovery_mode, int)
-PREPARE_AUDIT_TRIGGER_UPDATE_H(correlation_mode, int)
-PREPARE_AUDIT_TRIGGER_UPDATE_H(correlation_tag, const char*)
-PREPARE_AUDIT_TRIGGER_UPDATE_H(manual_close, int)
-PREPARE_AUDIT_TRIGGER_UPDATE_H(opdata, const char*)
-PREPARE_AUDIT_TRIGGER_UPDATE_H(discover, int)
-PREPARE_AUDIT_TRIGGER_UPDATE_H(event_name, const char*)
-PREPARE_AUDIT_TRIGGER_UPDATE_H(priority, int)
-PREPARE_AUDIT_TRIGGER_UPDATE_H(comments, const char*)
-PREPARE_AUDIT_TRIGGER_UPDATE_H(url, const char*)
-PREPARE_AUDIT_TRIGGER_UPDATE_H(type, int)
-PREPARE_AUDIT_TRIGGER_UPDATE_H(status, int)
-PREPARE_AUDIT_TRIGGER_UPDATE_H(templateid, zbx_uint64_t)
-PREPARE_AUDIT_TRIGGER_UPDATE_H(description, const char*)
-PREPARE_AUDIT_TRIGGER_UPDATE_H(expression, const char*)
-PREPARE_AUDIT_TRIGGER_UPDATE_H(recovery_expression, const char*)
-
-void	zbx_audit_DBselect_delete_for_trigger(const char *sql, zbx_vector_uint64_t *ids);
-void	zbx_audit_trigger_update_json_add_dependency(int flags, zbx_uint64_t triggerdepid,
-		zbx_uint64_t triggerid, zbx_uint64_t triggerid_up);
-void	zbx_audit_trigger_update_json_remove_dependency(int flags, zbx_uint64_t triggerdepid, zbx_uint64_t triggerid);
-void	zbx_audit_trigger_update_json_add_tags_and_values(zbx_uint64_t triggerid, int flags, zbx_uint64_t triggertagid,
-		const char *tag, const char *value);
-void	zbx_audit_trigger_update_json_delete_tags(zbx_uint64_t triggerid, int flags, zbx_uint64_t triggertagid);
-
-#define PREPARE_AUDIT_TRIGGER_UPDATE_TAG_H(resource, type1)							\
-void	zbx_audit_trigger_update_json_update_tag_##resource(zbx_uint64_t triggerid, zbx_uint64_t triggertagid,	\
-		type1 resource##_old, type1 resource##_new);
-PREPARE_AUDIT_TRIGGER_UPDATE_TAG_H(tag, const char*)
-PREPARE_AUDIT_TRIGGER_UPDATE_TAG_H(value, const char*)
-
-#endif	/* ZABBIX_AUDIT_TRIGGER_H */
diff --git a/src/libs/zbxcrypto/tls.c b/src/libs/zbxcrypto/tls.c
index 6419ccf602d..86b0e3a7f2b 100644
--- a/src/libs/zbxcrypto/tls.c
+++ b/src/libs/zbxcrypto/tls.c
@@ -311,7 +311,7 @@ static void	zbx_openssl_info_cb(const SSL *ssl, int where, int ret)
  *                                                                            *
  ******************************************************************************/
 #if defined(HAVE_OPENSSL)
-void	zbx_tls_error_msg(char **error, size_t *error_alloc, size_t *error_offset)
+static void	zbx_tls_error_msg(char **error, size_t *error_alloc, size_t *error_offset)
 {
 	unsigned long	error_code;
 	const char	*file, *data;
@@ -319,13 +319,22 @@ void	zbx_tls_error_msg(char **error, size_t *error_alloc, size_t *error_offset)
 	char		err[1024];
 
 	/* concatenate all error messages in the queue into one string */
+#if defined(OPENSSL_VERSION_MAJOR) && OPENSSL_VERSION_NUMBER >=	3	/* OpenSSL 3.0.0 or newer */
+	const char	*func;
 
+	while (0 != (error_code = ERR_get_error_all(&file, &line, &func, &data, &flags)))
+#else									/* OpenSSL 1.x.x or LibreSSL */
 	while (0 != (error_code = ERR_get_error_line_data(&file, &line, &data, &flags)))
+#endif
 	{
 		ERR_error_string_n(error_code, err, sizeof(err));
 
+#if defined(OPENSSL_VERSION_MAJOR) && OPENSSL_VERSION_NUMBER >=	3	/* OpenSSL 3.0.0 or newer */
+		zbx_snprintf_alloc(error, error_alloc, error_offset, " file %s line %d func %s: %s",
+				file, line, func, err);
+#else									/* OpenSSL 1.x.x or LibreSSL */
 		zbx_snprintf_alloc(error, error_alloc, error_offset, " file %s line %d: %s", file, line, err);
-
+#endif
 		if (NULL != data && 0 != (flags & ERR_TXT_STRING))
 			zbx_snprintf_alloc(error, error_alloc, error_offset, ": %s", data);
 	}
@@ -2466,12 +2475,21 @@ static const char	*zbx_ctx_name(SSL_CTX *param)
 static int	zbx_set_ecdhe_parameters(SSL_CTX *ctx)
 {
 	const char	*msg = "Perfect Forward Secrecy ECDHE ciphersuites will not be available for";
-	EC_KEY		*ecdh;
 	long		res;
 	int		ret = SUCCEED;
+#if defined(OPENSSL_VERSION_MAJOR) && OPENSSL_VERSION_NUMBER >= 3	/* OpenSSL 3.0.0 or newer */
+	int		grp_list[1] = { NID_X9_62_prime256v1 };	/* use curve secp256r1/prime256v1/NIST P-256 */
 
-	/* use curve secp256r1/prime256v1/NIST P-256 */
+	if (1 != (res = SSL_CTX_set1_groups(ctx, grp_list, ARRSIZE(grp_list))))
+	{
+		zabbix_log(LOG_LEVEL_WARNING, "%s() SSL_CTX_set1_groups() returned %ld. %s %s",
+				__func__, res, msg, zbx_ctx_name(ctx));
+		ret = FAIL;
+	}
+#else									/* OpenSSL 1.x.x or LibreSSL */
+	EC_KEY	*ecdh;
 
+	/* use curve secp256r1/prime256v1/NIST P-256 */
 	if (NULL == (ecdh = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1)))
 	{
 		zabbix_log(LOG_LEVEL_WARNING, "%s() EC_KEY_new_by_curve_name() failed. %s %s",
@@ -2489,7 +2507,7 @@ static int	zbx_set_ecdhe_parameters(SSL_CTX *ctx)
 	}
 
 	EC_KEY_free(ecdh);
-
+#endif
 	return ret;
 }
 
diff --git a/src/libs/zbxcrypto/tls_tcp.h b/src/libs/zbxcrypto/tls_tcp.h
index 1aacf483e83..90bc460275c 100644
--- a/src/libs/zbxcrypto/tls_tcp.h
+++ b/src/libs/zbxcrypto/tls_tcp.h
@@ -29,8 +29,4 @@ ssize_t	zbx_tls_read(zbx_socket_t *s, char *buf, size_t len, char **error);
 void	zbx_tls_close(zbx_socket_t *s);
 #endif
 
-#if defined(HAVE_OPENSSL)
-void	zbx_tls_error_msg(char **error, size_t *error_alloc, size_t *error_offset);
-#endif
-
 #endif	/* ZABBIX_TLS_TCP_H */
diff --git a/src/libs/zbxdbhigh/graph_linking.c b/src/libs/zbxdbhigh/graph_linking.c
index 15f3621678c..43312f61abd 100644
--- a/src/libs/zbxdbhigh/graph_linking.c
+++ b/src/libs/zbxdbhigh/graph_linking.c
@@ -20,8 +20,8 @@
 #include "graph_linking.h"
 
 #include "db.h"
-#include "../../libs/zbxaudit/audit.h"
-#include "../../libs/zbxaudit/audit_graph.h"
+#include "audit/zbxaudit.h"
+#include "audit/zbxaudit_graph.h"
 
 typedef struct
 {
@@ -1152,7 +1152,7 @@ static int	execute_graphs_updates(zbx_hashset_t *host_graphs_main_data, zbx_hash
 
 		zbx_strcpy_alloc(&sql, &sql_alloc, &sql_offset, "update graphs set ");
 
-		zbx_audit_graph_create_entry(AUDIT_ACTION_UPDATE, found->graphid, found->name_orig,
+		zbx_audit_graph_create_entry(ZBX_AUDIT_ACTION_UPDATE, found->graphid, found->name_orig,
 				(int)(found->flags));
 
 		if (0 != (found->update_flags & ZBX_FLAG_LINK_GRAPH_UPDATE_NAME))
@@ -1402,7 +1402,7 @@ static int	execute_graphs_inserts(zbx_vector_graphs_copies_t *graphs_copies_inse
 				graph_copy->ymin_itemid, graph_copy->ymax_itemid,
 				(int)(graph_copy->flags), (int)(graph_copy->discover));
 
-		zbx_audit_graph_create_entry(AUDIT_ACTION_ADD, graphid, graph_copy_name, (int)(graph_copy->flags));
+		zbx_audit_graph_create_entry(ZBX_AUDIT_ACTION_ADD, graphid, graph_copy_name, (int)(graph_copy->flags));
 		zbx_audit_graph_update_json_add_data(graphid, graph_copy_name, graph_copy->width,
 				graph_copy->height, graph_copy->yaxismin, graph_copy->yaxismax, graph_copy->templateid,
 				(int)graph_copy->show_work_period, (int)(graph_copy->show_triggers),
diff --git a/src/libs/zbxdbhigh/host.c b/src/libs/zbxdbhigh/host.c
index a450092b85d..37f9ba0ea9f 100644
--- a/src/libs/zbxdbhigh/host.c
+++ b/src/libs/zbxdbhigh/host.c
@@ -21,12 +21,12 @@
 #include "log.h"
 #include "dbcache.h"
 #include "zbxserver.h"
-#include "../../libs/zbxaudit/audit_host.h"
-#include "../../libs/zbxaudit/audit_item.h"
-#include "../../libs/zbxaudit/audit_trigger.h"
-#include "../../libs/zbxaudit/audit_httptest.h"
-#include "../../libs/zbxaudit/audit_graph.h"
-#include "../../libs/zbxaudit/audit.h"
+#include "audit/zbxaudit_host.h"
+#include "audit/zbxaudit_item.h"
+#include "audit/zbxaudit_trigger.h"
+#include "audit/zbxaudit_httptest.h"
+#include "audit/zbxaudit_graph.h"
+#include "audit/zbxaudit.h"
 #include "trigger_linking.h"
 #include "graph_linking.h"
 
@@ -1821,7 +1821,7 @@ int	DBdelete_template_elements(zbx_uint64_t hostid, const char *hostname, zbx_ve
 		goto clean;
 	}
 
-	zbx_audit_host_create_entry(AUDIT_ACTION_UPDATE, hostid, hostname);
+	zbx_audit_host_create_entry(ZBX_AUDIT_ACTION_UPDATE, hostid, hostname);
 
 	DBdelete_template_httptests(hostid, del_templateids);
 	DBdelete_template_graphs(hostid, del_templateids);
@@ -2415,7 +2415,7 @@ static void	DBhost_prototypes_templates_make(zbx_vector_ptr_t *host_prototypes,
 						ZBX_STR2UINT64(hosttemplateid, row[2]);
 						zbx_vector_uint64_append(del_hosttemplateids, hosttemplateid);
 
-						zbx_audit_host_prototype_create_entry(AUDIT_ACTION_UPDATE,
+						zbx_audit_host_prototype_create_entry(ZBX_AUDIT_ACTION_UPDATE,
 								host_prototype->hostid, host_prototype->host);
 
 						zbx_audit_host_prototype_update_json_delete_parent_template(
@@ -2926,7 +2926,7 @@ static void	DBhost_prototypes_macros_make(zbx_vector_ptr_t *host_prototypes, zbx
 					{
 						zbx_vector_uint64_append(del_macroids, hostmacroid);
 
-						zbx_audit_host_prototype_create_entry(AUDIT_ACTION_UPDATE,
+						zbx_audit_host_prototype_create_entry(ZBX_AUDIT_ACTION_UPDATE,
 								host_prototype->hostid, host_prototype->host);
 
 						zbx_audit_host_prototype_update_json_delete_hostmacro(
@@ -3082,7 +3082,7 @@ static void	DBhost_prototypes_tags_make(zbx_vector_ptr_t *host_prototypes, zbx_v
 			{
 				zbx_vector_uint64_append(del_tagids, tagid);
 
-				zbx_audit_host_prototype_create_entry(AUDIT_ACTION_UPDATE, host_prototype_local->hostid,
+				zbx_audit_host_prototype_create_entry(ZBX_AUDIT_ACTION_UPDATE, host_prototype_local->hostid,
 						host_prototype_local->host);
 				zbx_audit_host_prototype_update_json_delete_tag(host_prototype_local->hostid, tagid);
 			}
@@ -3295,7 +3295,7 @@ static void	DBhost_prototypes_interfaces_make(zbx_vector_ptr_t *host_prototypes,
 						{
 							zbx_vector_uint64_append(del_interfaceids, interfaceid);
 
-							zbx_audit_host_prototype_create_entry(AUDIT_ACTION_UPDATE,
+							zbx_audit_host_prototype_create_entry(ZBX_AUDIT_ACTION_UPDATE,
 									host_prototype->hostid, host_prototype->host);
 
 							zbx_audit_host_prototype_update_json_delete_interface(
@@ -3317,7 +3317,7 @@ static void	DBhost_prototypes_interfaces_make(zbx_vector_ptr_t *host_prototypes,
 						{
 							zbx_vector_uint64_append(del_interfaceids, interfaceid);
 
-							zbx_audit_host_prototype_create_entry(AUDIT_ACTION_UPDATE,
+							zbx_audit_host_prototype_create_entry(ZBX_AUDIT_ACTION_UPDATE,
 									host_prototype->hostid, host_prototype->host);
 
 							zbx_audit_host_prototype_update_json_delete_interface(
@@ -3526,7 +3526,7 @@ static void	DBhost_prototypes_save(const zbx_vector_ptr_t *host_prototypes,
 		}
 		else
 		{
-			zbx_audit_host_prototype_create_entry(AUDIT_ACTION_UPDATE, host_prototype->hostid,
+			zbx_audit_host_prototype_create_entry(ZBX_AUDIT_ACTION_UPDATE, host_prototype->hostid,
 					host_prototype->host);
 
 			if (0 != (host_prototype->flags & ZBX_FLAG_HPLINK_UPDATE_INVENTORY_MODE))
@@ -3745,7 +3745,7 @@ static void	DBhost_prototypes_save(const zbx_vector_ptr_t *host_prototypes,
 					(int)ZBX_FLAG_DISCOVERY_PROTOTYPE, host_prototype->templateid,
 					(int)host_prototype->discover, (int)host_prototype->custom_interfaces);
 
-			zbx_audit_host_prototype_create_entry(AUDIT_ACTION_ADD, host_prototype->hostid,
+			zbx_audit_host_prototype_create_entry(ZBX_AUDIT_ACTION_ADD, host_prototype->hostid,
 					host_prototype->host);
 
 			zbx_db_insert_add_values(&db_insert_hdiscovery, host_prototype->hostid, host_prototype->itemid);
@@ -5019,7 +5019,7 @@ static void	DBsave_httptests(zbx_uint64_t hostid, const zbx_vector_ptr_t *httpte
 				zbx_vector_uint64_append(&httpupdstepids, httpstep->hoststepid);
 			}
 
-			zbx_audit_httptest_create_entry(AUDIT_ACTION_UPDATE, httptest->httptestid, httptest->name);
+			zbx_audit_httptest_create_entry(ZBX_AUDIT_ACTION_UPDATE, httptest->httptestid, httptest->name);
 		}
 	}
 
@@ -5198,7 +5198,7 @@ static void	DBsave_httptests(zbx_uint64_t hostid, const zbx_vector_ptr_t *httpte
 		{
 			httptest->httptestid = httptestid++;
 
-			zbx_audit_httptest_create_entry(AUDIT_ACTION_ADD, httptest->httptestid, httptest->name);
+			zbx_audit_httptest_create_entry(ZBX_AUDIT_ACTION_ADD, httptest->httptestid, httptest->name);
 
 			zbx_db_insert_add_values(&db_insert_htest, httptest->httptestid, httptest->name,
 					httptest->delay, (int)httptest->status, httptest->agent,
@@ -5263,7 +5263,7 @@ static void	DBsave_httptests(zbx_uint64_t hostid, const zbx_vector_ptr_t *httpte
 		{
 			const char	*d = ",";
 
-			zbx_audit_httptest_create_entry(AUDIT_ACTION_UPDATE, httptest->httptestid, httptest->name);
+			zbx_audit_httptest_create_entry(ZBX_AUDIT_ACTION_UPDATE, httptest->httptestid, httptest->name);
 
 			zbx_snprintf_alloc(&sql, &sql_alloc, &sql_offset, "update httptest"
 					" set templateid=" ZBX_FS_UI64, httptest->templateid);
diff --git a/src/libs/zbxdbhigh/template_item.c b/src/libs/zbxdbhigh/template_item.c
index 104f6cd1424..0d7548711da 100644
--- a/src/libs/zbxdbhigh/template_item.c
+++ b/src/libs/zbxdbhigh/template_item.c
@@ -22,8 +22,8 @@
 #include "db.h"
 #include "log.h"
 #include "dbcache.h"
-#include "../../libs/zbxaudit/audit.h"
-#include "../../libs/zbxaudit/audit_item.h"
+#include "audit/zbxaudit.h"
+#include "audit/zbxaudit_item.h"
 
 struct _zbx_template_item_preproc_t
 {
@@ -872,7 +872,7 @@ static void	save_template_item(zbx_uint64_t hostid, zbx_uint64_t *itemid, zbx_te
 					item->field##_orig, item->field);					\
 		}
 
-		zbx_audit_item_create_entry(AUDIT_ACTION_UPDATE, item->itemid, item->name, item->flags);
+		zbx_audit_item_create_entry(ZBX_AUDIT_ACTION_UPDATE, item->itemid, item->name, item->flags);
 		PREPARE_UPDATE_ID(INTERFACEID, interfaceid)
 		PREPARE_UPDATE_STR(NAME, name)
 		PREPARE_UPDATE_UC(TYPE, type)
@@ -942,7 +942,7 @@ static void	save_template_item(zbx_uint64_t hostid, zbx_uint64_t *itemid, zbx_te
 
 		zbx_db_insert_add_values(db_insert_irtdata, *itemid);
 
-		zbx_audit_item_create_entry(AUDIT_ACTION_ADD, *itemid, item->name, item->flags);
+		zbx_audit_item_create_entry(ZBX_AUDIT_ACTION_ADD, *itemid, item->name, item->flags);
 		zbx_audit_item_update_json_add_data(*itemid, item, hostid);
 
 		item->itemid = (*itemid)++;
diff --git a/src/libs/zbxdbhigh/trigger_dep_linking.c b/src/libs/zbxdbhigh/trigger_dep_linking.c
index 6ff39733dc1..8937231e4ed 100644
--- a/src/libs/zbxdbhigh/trigger_dep_linking.c
+++ b/src/libs/zbxdbhigh/trigger_dep_linking.c
@@ -21,7 +21,7 @@
 
 #include "db.h"
 #include "log.h"
-#include "../../libs/zbxaudit/audit_trigger.h"
+#include "audit/zbxaudit_trigger.h"
 
 typedef struct
 {
diff --git a/src/libs/zbxdbhigh/trigger_linking.c b/src/libs/zbxdbhigh/trigger_linking.c
index 657c22c1e51..68b85195caf 100644
--- a/src/libs/zbxdbhigh/trigger_linking.c
+++ b/src/libs/zbxdbhigh/trigger_linking.c
@@ -22,8 +22,8 @@
 #include "db.h"
 #include "zbxeval.h"
 #include "log.h"
-#include "../../libs/zbxaudit/audit.h"
-#include "../../libs/zbxaudit/audit_trigger.h"
+#include "audit/zbxaudit.h"
+#include "audit/zbxaudit_trigger.h"
 #include "trigger_dep_linking.h"
 
 typedef struct
@@ -860,7 +860,7 @@ static int	execute_triggers_updates(zbx_hashset_t *zbx_host_triggers_main_data)
 	{
 		d = "";
 
-		zbx_audit_trigger_create_entry(AUDIT_ACTION_UPDATE, found->triggerid, found->description,
+		zbx_audit_trigger_create_entry(ZBX_AUDIT_ACTION_UPDATE, found->triggerid, found->description,
 				(int)found->flags);
 
 		if (0 != (found->update_flags & ZBX_FLAG_LINK_TRIGGER_UPDATE))
@@ -1161,7 +1161,7 @@ static int	execute_triggers_inserts(zbx_vector_trigger_copies_insert_t *trigger_
 
 		zbx_vector_uint64_append(new_triggerids, triggerid);
 
-		zbx_audit_trigger_create_entry(AUDIT_ACTION_ADD, triggerid, trigger_copy_template->description,
+		zbx_audit_trigger_create_entry(ZBX_AUDIT_ACTION_ADD, triggerid, trigger_copy_template->description,
 				(int)trigger_copy_template->flags);
 		zbx_audit_trigger_update_json_add_data(triggerid, trigger_copy_template->templateid,
 				trigger_copy_template->recovery_mode, trigger_copy_template->status,
diff --git a/src/zabbix_server/actions.c b/src/zabbix_server/actions.c
index 2309db15d44..9d1d5ed687d 100644
--- a/src/zabbix_server/actions.c
+++ b/src/zabbix_server/actions.c
@@ -23,7 +23,7 @@
 #include "zbxserver.h"
 #include "operations.h"
 #include "zbxregexp.h"
-#include "../../libs/zbxaudit/audit.h"
+#include "audit/zbxaudit.h"
 
 /******************************************************************************
  *                                                                            *
diff --git a/src/zabbix_server/ha/ha_manager.c b/src/zabbix_server/ha/ha_manager.c
index f162a2cdf39..16b7967e9ef 100644
--- a/src/zabbix_server/ha/ha_manager.c
+++ b/src/zabbix_server/ha/ha_manager.c
@@ -25,9 +25,10 @@
 #include "zbxserialize.h"
 #include "threads.h"
 #include "mutexs.h"
-#include "../../libs/zbxaudit/audit.h"
-#include "../../libs/zbxaudit/audit_ha.h"
-#include "../../libs/zbxaudit/audit_settings.h"
+
+#include "audit/zbxaudit.h"
+#include "audit/zbxaudit_ha.h"
+#include "audit/zbxaudit_settings.h"
 
 #define ZBX_HA_POLL_PERIOD	5
 
@@ -689,7 +690,7 @@ static void	ha_db_create_node(zbx_ha_info_t *info)
 			nodeid.str, name_esc, ZBX_NODE_STATUS_STOPPED))
 	{
 		zbx_audit_init(info->auditlog);
-		zbx_audit_ha_create_entry(AUDIT_ACTION_ADD, nodeid.str, info->name);
+		zbx_audit_ha_create_entry(ZBX_AUDIT_ACTION_ADD, nodeid.str, info->name);
 		zbx_audit_ha_add_create_fields(nodeid.str, info->name, ZBX_NODE_STATUS_STOPPED);
 		ha_flush_audit(info);
 	}
@@ -743,7 +744,7 @@ static int	ha_db_check_unavailable_nodes(zbx_ha_info_t *info, zbx_vector_ha_node
 		{
 			zbx_vector_str_append(&unavailable_nodes, nodes->values[i]->ha_nodeid.str);
 
-			zbx_audit_ha_create_entry(AUDIT_ACTION_UPDATE, nodes->values[i]->ha_nodeid.str,
+			zbx_audit_ha_create_entry(ZBX_AUDIT_ACTION_UPDATE, nodes->values[i]->ha_nodeid.str,
 					nodes->values[i]->name);
 			zbx_audit_ha_update_field_int(nodes->values[i]->ha_nodeid.str, ZBX_AUDIT_HA_STATUS,
 					nodes->values[i]->status, ZBX_NODE_STATUS_UNAVAILABLE);
@@ -832,7 +833,7 @@ static void	ha_db_register_node(zbx_ha_info_t *info)
 	ha_get_external_address(&address, &port);
 
 	zbx_audit_init(info->auditlog);
-	zbx_audit_ha_create_entry(AUDIT_ACTION_UPDATE, info->ha_nodeid.str, info->name);
+	zbx_audit_ha_create_entry(ZBX_AUDIT_ACTION_UPDATE, info->ha_nodeid.str, info->name);
 
 	zbx_snprintf_alloc(&sql, &sql_alloc, &sql_offset, "update ha_node set lastaccess="
 				ZBX_DB_TIMESTAMP() ",ha_sessionid='%s'", ha_sessionid.str);
@@ -1044,7 +1045,7 @@ static void	ha_check_nodes(zbx_ha_info_t *info)
 	{
 		zbx_snprintf_alloc(&sql, &sql_alloc, &sql_offset, ",status=%d", ha_status);
 
-		zbx_audit_ha_create_entry(AUDIT_ACTION_UPDATE, node->ha_nodeid.str, node->name);
+		zbx_audit_ha_create_entry(ZBX_AUDIT_ACTION_UPDATE, node->ha_nodeid.str, node->name);
 		zbx_audit_ha_update_field_int(node->ha_nodeid.str, ZBX_AUDIT_HA_STATUS, node->status,
 				ha_status);
 	}
@@ -1058,7 +1059,7 @@ static void	ha_check_nodes(zbx_ha_info_t *info)
 		ha_db_execute(info, "update ha_node set status=%d where ha_nodeid='%s'",
 				ZBX_NODE_STATUS_UNAVAILABLE, last_active->ha_nodeid.str);
 
-		zbx_audit_ha_create_entry(AUDIT_ACTION_UPDATE, last_active->ha_nodeid.str, last_active->name);
+		zbx_audit_ha_create_entry(ZBX_AUDIT_ACTION_UPDATE, last_active->ha_nodeid.str, last_active->name);
 		zbx_audit_ha_update_field_int(last_active->ha_nodeid.str, ZBX_AUDIT_HA_STATUS, last_active->status,
 				ZBX_NODE_STATUS_UNAVAILABLE);
 	}
@@ -1231,7 +1232,7 @@ static int	ha_remove_node_impl(zbx_ha_info_t *info, const char *node, char **res
 	else
 	{
 		zbx_audit_init(info->auditlog);
-		zbx_audit_ha_create_entry(AUDIT_ACTION_DELETE, nodes.values[i]->ha_nodeid.str,
+		zbx_audit_ha_create_entry(ZBX_AUDIT_ACTION_DELETE, nodes.values[i]->ha_nodeid.str,
 				nodes.values[i]->name);
 		ha_flush_audit(info);
 	}
@@ -1355,7 +1356,7 @@ static void	ha_set_failover_delay(zbx_ha_info_t *info, zbx_ipc_client_t *client,
 
 		ZBX_STR2UINT64(configid, row[0]);
 		zbx_audit_init(info->auditlog);
-		zbx_audit_settings_create_entry(AUDIT_ACTION_UPDATE, configid);
+		zbx_audit_settings_create_entry(ZBX_AUDIT_ACTION_UPDATE, configid);
 		zbx_audit_settings_update_field_int(configid, "settings.ha_failover_delay", atoi(row[1]), delay);
 		ha_flush_audit(info);
 	}
@@ -1443,7 +1444,7 @@ static void	ha_db_update_exit_status(zbx_ha_info_t *info)
 			ZBX_NODE_STATUS_STOPPED, info->ha_nodeid.str))
 	{
 		zbx_audit_init(info->auditlog);
-		zbx_audit_ha_create_entry(AUDIT_ACTION_UPDATE, info->ha_nodeid.str, info->name);
+		zbx_audit_ha_create_entry(ZBX_AUDIT_ACTION_UPDATE, info->ha_nodeid.str, info->name);
 		zbx_audit_ha_update_field_int(info->ha_nodeid.str, ZBX_AUDIT_HA_STATUS, info->ha_status, ZBX_NODE_STATUS_STOPPED);
 		ha_flush_audit(info);
 	}
diff --git a/src/zabbix_server/lld/lld.c b/src/zabbix_server/lld/lld.c
index 1ac6fe02e39..a0ffc8b5062 100644
--- a/src/zabbix_server/lld/lld.c
+++ b/src/zabbix_server/lld/lld.c
@@ -24,7 +24,7 @@
 #include "zbxserver.h"
 #include "zbxregexp.h"
 
-#include "../../libs/zbxaudit/audit.h"
+#include "audit/zbxaudit.h"
 
 #define OVERRIDE_STOP_TRUE	1
 
diff --git a/src/zabbix_server/lld/lld_common.c b/src/zabbix_server/lld/lld_common.c
index d1b2eeba42b..4736b232b3d 100644
--- a/src/zabbix_server/lld/lld_common.c
+++ b/src/zabbix_server/lld/lld_common.c
@@ -20,10 +20,10 @@
 #include "log.h"
 #include "db.h"
 
-#include "../../libs/zbxaudit/audit.h"
-#include "../../libs/zbxaudit/audit_item.h"
-#include "../../libs/zbxaudit/audit_graph.h"
-#include "../../libs/zbxaudit/audit_trigger.h"
+#include "audit/zbxaudit.h"
+#include "audit/zbxaudit_item.h"
+#include "audit/zbxaudit_graph.h"
+#include "audit/zbxaudit_trigger.h"
 
 void	lld_field_str_rollback(char **field, char **field_orig, zbx_uint64_t *flags, zbx_uint64_t flag)
 {
@@ -96,12 +96,12 @@ void	lld_remove_lost_objects(const char *table, const char *id_name, const zbx_v
 				}
 				else if (0 == strcmp(table, "graph_discovery"))
 				{
-					zbx_audit_graph_create_entry(AUDIT_ACTION_DELETE, id, name,
+					zbx_audit_graph_create_entry(ZBX_AUDIT_ACTION_DELETE, id, name,
 							(int)ZBX_FLAG_DISCOVERY_CREATED);
 				}
 				else if (0 == strcmp(table, "trigger_discovery"))
 				{
-					zbx_audit_trigger_create_entry(AUDIT_ACTION_DELETE, id, name,
+					zbx_audit_trigger_create_entry(ZBX_AUDIT_ACTION_DELETE, id, name,
 							ZBX_FLAG_DISCOVERY_CREATED);
 				}
 			}
diff --git a/src/zabbix_server/lld/lld_graph.c b/src/zabbix_server/lld/lld_graph.c
index 824ba85e6ac..ad05a9cf8af 100644
--- a/src/zabbix_server/lld/lld_graph.c
+++ b/src/zabbix_server/lld/lld_graph.c
@@ -21,8 +21,8 @@
 
 #include "log.h"
 #include "zbxserver.h"
-#include "../../libs/zbxaudit/audit.h"
-#include "../../libs/zbxaudit/audit_graph.h"
+#include "audit/zbxaudit.h"
+#include "audit/zbxaudit_graph.h"
 
 typedef struct
 {
@@ -1003,7 +1003,7 @@ static int	lld_graphs_save(zbx_uint64_t hostid, zbx_uint64_t parent_graphid, zbx
 
 		if (0 != graph->graphid)
 		{
-			zbx_audit_graph_create_entry(AUDIT_ACTION_UPDATE, graph->graphid, (NULL == graph->name_orig) ?
+			zbx_audit_graph_create_entry(ZBX_AUDIT_ACTION_UPDATE, graph->graphid, (NULL == graph->name_orig) ?
 					graph->name : graph->name_orig, ZBX_FLAG_DISCOVERY_CREATED);
 		}
 
@@ -1088,7 +1088,7 @@ static int	lld_graphs_save(zbx_uint64_t hostid, zbx_uint64_t parent_graphid, zbx
 					(int)show_3d, percent_left, percent_right, (int)ymin_type, graph->ymin_itemid,
 					(int)ymax_type, graph->ymax_itemid, (int)ZBX_FLAG_DISCOVERY_CREATED);
 
-			zbx_audit_graph_create_entry(AUDIT_ACTION_ADD, graphid, graph->name,
+			zbx_audit_graph_create_entry(ZBX_AUDIT_ACTION_ADD, graphid, graph->name,
 					ZBX_FLAG_DISCOVERY_CREATED);
 
 			zbx_audit_graph_update_json_add_data(graphid, graph->name, width, height, yaxismin, yaxismax, 0,
diff --git a/src/zabbix_server/lld/lld_host.c b/src/zabbix_server/lld/lld_host.c
index deaf3fda3c3..203d1d5c9d4 100644
--- a/src/zabbix_server/lld/lld_host.c
+++ b/src/zabbix_server/lld/lld_host.c
@@ -21,8 +21,8 @@
 
 #include "log.h"
 #include "zbxserver.h"
-#include "../../libs/zbxaudit/audit.h"
-#include "../../libs/zbxaudit/audit_host.h"
+#include "audit/zbxaudit.h"
+#include "audit/zbxaudit_host.h"
 
 typedef struct
 {
@@ -1117,7 +1117,7 @@ static void	lld_hostgroups_make(const zbx_vector_uint64_t *groupids, zbx_vector_
 				ZBX_STR2UINT64(hostgroupid, row[2]);
 				zbx_vector_uint64_append(del_hostgroupids, hostgroupid);
 
-				zbx_audit_host_create_entry(AUDIT_ACTION_UPDATE, hostid,
+				zbx_audit_host_create_entry(ZBX_AUDIT_ACTION_UPDATE, hostid,
 						(NULL == host->host_orig) ? host->host : host->host_orig);
 
 				zbx_audit_hostgroup_update_json_delete_group(hostid, hostgroupid, groupid);
@@ -1798,7 +1798,7 @@ static void	lld_groups_save(zbx_vector_ptr_t *groups, const zbx_vector_ptr_t *gr
 
 			zbx_db_insert_add_values(&db_insert, group->groupid, group->name,
 					(int)ZBX_FLAG_DISCOVERY_CREATED);
-			zbx_audit_host_group_create_entry(AUDIT_ACTION_ADD, group->groupid, group->name);
+			zbx_audit_host_group_create_entry(ZBX_AUDIT_ACTION_ADD, group->groupid, group->name);
 
 			zbx_audit_host_group_update_json_add_details(group->groupid, group->name,
 					(int)ZBX_FLAG_DISCOVERY_CREATED);
@@ -1829,7 +1829,7 @@ static void	lld_groups_save(zbx_vector_ptr_t *groups, const zbx_vector_ptr_t *gr
 			if (0 != (group->flags & ZBX_FLAG_LLD_GROUP_UPDATE))
 			{
 				zbx_strcpy_alloc(&sql, &sql_alloc, &sql_offset, "update hstgrp set ");
-				zbx_audit_host_group_create_entry(AUDIT_ACTION_UPDATE, group->groupid, group->name);
+				zbx_audit_host_group_create_entry(ZBX_AUDIT_ACTION_UPDATE, group->groupid, group->name);
 
 				if (0 != (group->flags & ZBX_FLAG_LLD_GROUP_UPDATE_NAME))
 				{
@@ -2696,7 +2696,7 @@ static void	lld_hosts_save(zbx_uint64_t parent_hostid, zbx_vector_ptr_t *hosts,
 		}
 		else
 		{
-			zbx_audit_host_create_entry(AUDIT_ACTION_UPDATE, host->hostid,
+			zbx_audit_host_create_entry(ZBX_AUDIT_ACTION_UPDATE, host->hostid,
 					(NULL == host->host_orig) ? host->host : host->host_orig);
 
 			if (0 != (host->flags & ZBX_FLAG_LLD_HOST_UPDATE))
@@ -2746,7 +2746,7 @@ static void	lld_hosts_save(zbx_uint64_t parent_hostid, zbx_vector_ptr_t *hosts,
 			{
 				zbx_vector_uint64_append(&del_interfaceids, interface->interfaceid);
 
-				zbx_audit_host_create_entry(AUDIT_ACTION_UPDATE,
+				zbx_audit_host_create_entry(ZBX_AUDIT_ACTION_UPDATE,
 						host->hostid, (NULL == host->host_orig) ? host->host : host->host_orig);
 
 				zbx_audit_host_update_json_delete_interface(
@@ -2757,7 +2757,7 @@ static void	lld_hosts_save(zbx_uint64_t parent_hostid, zbx_vector_ptr_t *hosts,
 			{
 				zbx_vector_uint64_append(&del_snmp_ids, interface->interfaceid);
 
-				zbx_audit_host_create_entry(AUDIT_ACTION_UPDATE,
+				zbx_audit_host_create_entry(ZBX_AUDIT_ACTION_UPDATE,
 						host->hostid, (NULL == host->host_orig) ? host->host : host->host_orig);
 
 				zbx_audit_host_update_json_delete_interface(
@@ -2792,7 +2792,7 @@ static void	lld_hosts_save(zbx_uint64_t parent_hostid, zbx_vector_ptr_t *hosts,
 			{
 				zbx_vector_uint64_append(&del_hostmacroids, hostmacro->hostmacroid);
 
-				zbx_audit_host_create_entry(AUDIT_ACTION_UPDATE,
+				zbx_audit_host_create_entry(ZBX_AUDIT_ACTION_UPDATE,
 						host->hostid, (NULL == host->host_orig) ? host->host : host->host_orig);
 
 				zbx_audit_host_update_json_delete_hostmacro(
@@ -2814,7 +2814,7 @@ static void	lld_hosts_save(zbx_uint64_t parent_hostid, zbx_vector_ptr_t *hosts,
 			{
 				zbx_vector_uint64_append(&del_tagids, host->tags.values[j]->tagid);
 
-				zbx_audit_host_prototype_create_entry(AUDIT_ACTION_UPDATE, host->hostid,
+				zbx_audit_host_prototype_create_entry(ZBX_AUDIT_ACTION_UPDATE, host->hostid,
 						host->host);
 				zbx_audit_host_update_json_delete_tag(host->hostid, host->tags.values[j]->tagid);
 			}
@@ -2921,7 +2921,7 @@ static void	lld_hosts_save(zbx_uint64_t parent_hostid, zbx_vector_ptr_t *hosts,
 					(int)tls_accept, tls_issuer, tls_subject, tls_psk_identity, tls_psk,
 					(int)host->custom_interfaces);
 
-			zbx_audit_host_create_entry(AUDIT_ACTION_ADD, host->hostid, host->host);
+			zbx_audit_host_create_entry(ZBX_AUDIT_ACTION_ADD, host->hostid, host->host);
 
 			zbx_db_insert_add_values(&db_insert_hdiscovery, host->hostid, parent_hostid, host_proto);
 
diff --git a/src/zabbix_server/lld/lld_item.c b/src/zabbix_server/lld/lld_item.c
index 491a027e10c..fb93c6aca96 100644
--- a/src/zabbix_server/lld/lld_item.c
+++ b/src/zabbix_server/lld/lld_item.c
@@ -25,8 +25,8 @@
 #include "zbxprometheus.h"
 #include "zbxxml.h"
 
-#include "../../libs/zbxaudit/audit.h"
-#include "../../libs/zbxaudit/audit_item.h"
+#include "audit/zbxaudit.h"
+#include "audit/zbxaudit_item.h"
 
 typedef zbx_lld_item_full_t	zbx_lld_item_t;
 
@@ -3054,7 +3054,7 @@ static void	lld_item_save(zbx_uint64_t hostid, const zbx_vector_ptr_t *item_prot
 
 		zbx_db_insert_add_values(db_insert_irtdata, *itemid);
 
-		zbx_audit_item_create_entry(AUDIT_ACTION_ADD, *itemid, item->name, ZBX_FLAG_DISCOVERY_CREATED);
+		zbx_audit_item_create_entry(ZBX_AUDIT_ACTION_ADD, *itemid, item->name, ZBX_FLAG_DISCOVERY_CREATED);
 		zbx_audit_item_update_json_add_lld_data(*itemid, item, item_prototype, hostid);
 		item->itemid = (*itemid)++;
 	}
@@ -3538,7 +3538,7 @@ static int	lld_items_save(zbx_uint64_t hostid, const zbx_vector_ptr_t *item_prot
 		}
 		else
 		{
-			zbx_audit_item_create_entry(AUDIT_ACTION_UPDATE, item->itemid,
+			zbx_audit_item_create_entry(ZBX_AUDIT_ACTION_UPDATE, item->itemid,
 					(NULL == item->name_proto) ? item->name : item->name_proto,
 					ZBX_FLAG_DISCOVERY_CREATED);
 		}
diff --git a/src/zabbix_server/lld/lld_trigger.c b/src/zabbix_server/lld/lld_trigger.c
index 245b948d51a..acbe8b607b3 100644
--- a/src/zabbix_server/lld/lld_trigger.c
+++ b/src/zabbix_server/lld/lld_trigger.c
@@ -22,8 +22,8 @@
 #include "log.h"
 #include "zbxserver.h"
 
-#include "../../libs/zbxaudit/audit.h"
-#include "../../libs/zbxaudit/audit_trigger.h"
+#include "audit/zbxaudit.h"
+#include "audit/zbxaudit_trigger.h"
 
 typedef struct
 {
@@ -2581,7 +2581,7 @@ static int	lld_triggers_save(zbx_uint64_t hostid, const zbx_vector_ptr_t *trigge
 
 		if (0 != trigger->triggerid)
 		{
-			zbx_audit_trigger_create_entry(AUDIT_ACTION_UPDATE, trigger->triggerid,
+			zbx_audit_trigger_create_entry(ZBX_AUDIT_ACTION_UPDATE, trigger->triggerid,
 					(NULL == trigger->description_orig) ? trigger->description :
 					trigger->description_orig, ZBX_FLAG_DISCOVERY_CREATED);
 		}
@@ -2780,7 +2780,7 @@ static int	lld_triggers_save(zbx_uint64_t hostid, const zbx_vector_ptr_t *trigge
 					trigger->correlation_tag, (int)trigger_prototype->manual_close,
 					trigger->opdata, trigger->event_name);
 
-			zbx_audit_trigger_create_entry(AUDIT_ACTION_ADD,triggerid, trigger->description,
+			zbx_audit_trigger_create_entry(ZBX_AUDIT_ACTION_ADD,triggerid, trigger->description,
 					ZBX_FLAG_DISCOVERY_CREATED);
 
 			zbx_audit_trigger_update_json_add_data(triggerid, 0, (int)trigger_prototype->recovery_mode,
diff --git a/src/zabbix_server/operations.c b/src/zabbix_server/operations.c
index 4460a07be43..fd4db831f06 100644
--- a/src/zabbix_server/operations.c
+++ b/src/zabbix_server/operations.c
@@ -20,8 +20,8 @@
 #include "operations.h"
 
 #include "log.h"
-#include "../../libs/zbxaudit/audit.h"
-#include "../../libs/zbxaudit/audit_host.h"
+#include "audit/zbxaudit.h"
+#include "audit/zbxaudit_host.h"
 
 typedef enum
 {
@@ -435,7 +435,7 @@ static zbx_uint64_t	add_discovered_host(const DB_EVENT *event, int *status, zbx_
 				zbx_db_insert_execute(&db_insert);
 				zbx_db_insert_clean(&db_insert);
 
-				zbx_audit_host_create_entry(AUDIT_ACTION_ADD, hostid, hostname);
+				zbx_audit_host_create_entry(ZBX_AUDIT_ACTION_ADD, hostid, hostname);
 
 				if (HOST_INVENTORY_DISABLED != cfg->default_inventory_mode)
 					DBadd_host_inventory(hostid, cfg->default_inventory_mode);
@@ -452,7 +452,7 @@ static zbx_uint64_t	add_discovered_host(const DB_EVENT *event, int *status, zbx_
 			}
 			else
 			{
-				zbx_audit_host_create_entry(AUDIT_ACTION_UPDATE, hostid, hostname);
+				zbx_audit_host_create_entry(ZBX_AUDIT_ACTION_UPDATE, hostid, hostname);
 				interfaceid = DBadd_interface(hostid, interface_type, 1, row[2], row[3], port,
 						ZBX_CONN_DEFAULT);
 			}
@@ -566,7 +566,7 @@ static zbx_uint64_t	add_discovered_host(const DB_EVENT *event, int *status, zbx_
 					zbx_db_insert_add_values(&db_insert, hostid, proxy_hostid, hostname, hostname,
 						tls_accepted, tls_accepted, psk_identity, psk);
 
-					zbx_audit_host_create_entry(AUDIT_ACTION_ADD, hostid, hostname);
+					zbx_audit_host_create_entry(ZBX_AUDIT_ACTION_ADD, hostid, hostname);
 					zbx_audit_host_update_json_add_tls_and_psk(hostid, tls_accepted, tls_accepted,
 							psk_identity, psk);
 				}
@@ -575,7 +575,7 @@ static zbx_uint64_t	add_discovered_host(const DB_EVENT *event, int *status, zbx_
 					zbx_db_insert_prepare(&db_insert, "hosts", "hostid", "proxy_hostid", "host",
 							"name", NULL);
 
-					zbx_audit_host_create_entry(AUDIT_ACTION_ADD, hostid, hostname);
+					zbx_audit_host_create_entry(ZBX_AUDIT_ACTION_ADD, hostid, hostname);
 					zbx_db_insert_add_values(&db_insert, hostid, proxy_hostid, hostname,
 							hostname);
 				}
@@ -600,7 +600,7 @@ static zbx_uint64_t	add_discovered_host(const DB_EVENT *event, int *status, zbx_
 				hostname = zbx_strdup(hostname, row2[2]);
 				*status = atoi(row2[3]);
 
-				zbx_audit_host_create_entry(AUDIT_ACTION_UPDATE, hostid, hostname);
+				zbx_audit_host_create_entry(ZBX_AUDIT_ACTION_UPDATE, hostid, hostname);
 
 				if (host_proxy_hostid != proxy_hostid)
 				{
diff --git a/src/zabbix_server/trapper/nodecommand.c b/src/zabbix_server/trapper/nodecommand.c
index 291a2c3f808..d11d93140af 100644
--- a/src/zabbix_server/trapper/nodecommand.c
+++ b/src/zabbix_server/trapper/nodecommand.c
@@ -24,7 +24,7 @@
 #include "trapper_auth.h"
 
 #include "../scripts/scripts.h"
-#include "../../libs/zbxaudit/audit.h"
+#include "audit/zbxaudit.h"
 #include "../../libs/zbxserver/get_host_from_event.h"
 #include "../../libs/zbxserver/zabbix_users.h"