NagiosXI CCM log

[Gonela]

Hi Team,

How to find if any one change config's in NagiosXI CCM. how we will find that users.?

We checked in audit log in the Admin --> System information --> Audit log option. But no luck .

Presently we are facing one issue .

If i see one services.
1. Some times it is showing contact is assigned for that service.
2. Some time it is not showing contact assignment for that service

We verified in audit log . there is no log for CCM for that service.

[scottwilkerson]

It should be showing in the Audit Log. What version of XI are you running?

Reminder the Audit log only shows 24 hours by default

[Gonela]

Hi Team,

We are using 5.4.0 Nagios enterprise XI.

As you suggest we have seen in audit log. But we have no luck. We are not able to find who changed the service config file.

Apart from FrontEnd in audit log, Can we see at backend. Is there any possibility to check at backend.

[scottwilkerson]

Actually I believe that XI started logging that to the audit login a version newer than 5.4.0.

I know in 5.5.0 it is logged to a separate CCM audit log
CCM -> CCM Admin -> Audit Log

[Gonela]

My NagiosXI upgraded to 5.5.1 .

Still no luck in CCM audit log

[lmiltchev]

When did your user make changes in the CCM? Maybe the "Max Logbook Age" value set too low (Admin > Performance Settings > Databases > NagiosQL Database) and you will need to increase it.

I haven't been able to recreate the issue in house. I logged in XI 5.5.1 as "test123" user, deleted one service, and verified that this activity in fact showed up in the CCM Audit log.

example01.PNG

[Gonela]

Hi Team,

Can you please tell us what is the Event or Event ID will generate if someone remove checks/service config file. What will be the general audit log will generate.

[jomann]

There is not a way to audit the files being edited on the backend. The audit log itself, you can get to from the Admin section in XI and it may have more data (it stores it longer) so you can find it in Admin > Audit Log on the right-hand side.

[Gonela]

Hi Team,

We are not able to find in Audit log which you refer at Admin >> audit log.
I Need help on below two points.

1) How we can know who removed service checks/service config in nagiosxi. (If possible in backend or from Database)
2) EX: If we delete any config file from GUI (Removed CPU Usage service ) What is the log will generate. Please help on this.

One of user has removed one service but we are not sure who removed we have checked the audit log but no luck.

[jomann]

The longer audit log is in the Admin area, but is an Enterprise feature. You can also access it from the CCM audit log.

Here is an example of deleting a service and how it shows up in the Audit log in the CCM.

If you want to get the data from the database it's in the nagiosxi database in MySQL (or postgres if you had originally installed XI < 5) and in the xi_auditlog table, with the source column of "Nagios CCM"