Nagios sending out text message cannot find entry

[jkinning]

I have a user how has contacted me stating Nagios is sending a text message to their phone for a service that they no longer are in charge of. I looked at the service and found he wasn't a contact for this service. I ask for his phone number and didn't find it anywhere. Is there a way I can search for this user's phone number to see if it is on a different user or what is the easiest way to figure out how or what is sending this notification?

I have tried running this command on the server itself.
find . -type f -exec grep -il "phone_number" {} +

Where are the notification logs located that I can look at?

[rkennedy]

For notification logs, I would look at the Home -> Notifications page. This could be many different things, so here are a few options -

If you've removed them, it's possible there is a ghost process running from before. Sometimes, this is solved by navigating to the Core Config Manager -> Config File Management (Write Config Files pre 5.3.0) -> Run a 'delete', 'write', and 'verify'. If that doesn't work, could you post the full output of ps -ef for us to review?

Another possibility is it will only show when logged in as their XI username. Click the logged in user in the top right -> Notification Methods -> Uncheck the 'Receive text alerts....' box, and click 'Update Settings'.

Lastly, If SMS alerts were going out through a core command, then a recursive grep of the objects.cache file should help find it. grep -R '1234567890' /usr/local/nagios/var/objects.cache

[jkinning]

I found the issue. I looked at the notifications and went Admin|Manage Users and then looked at the users who showed as getting the service notification. A user had the phone number listed for the user who was still getting this notification. I had to masquerade as user and then cleared out the phone number. The user with the number stated they never setup a SMS notification and didn't even know how to do that. How would one user's phone number get placed on a different users Nagios account?

[rkennedy]

I have never heard of this happening before. If I was to guess, perhaps it was an accident, and someone was masqueraded as another user and didn't realize it? Really hard to say though.

[avandemore]

Only a Nagios web admin or OS user w/ ability to manipulate apache and or nagios commands would be able to alter another user's settings. Perhaps office mischief if user A left their terminal unlocked and the SMS was added by user B.