Service check creation information

[rferebee]

Good morning all,

I would like to know if, in the CLI, there is a way to find a specific service check and when it was created and by whom?

My audit logs in the GUI are only going back to the beginning of the month and I need to search further.

Unfortunately, one of my colleagues deleted the service checks while I was gone, so I do not have the service ID numbers. They do however have a very specific name 'SSH' and there are only 4 other services with the same name.

Thank you.

[npolovenko]

Hello, @rferebee. Normally, Audit log should contain info for at least a few months. Can you check the Audit Log retention setting under Performance Settings?

Untitled.png

Try tunning the following query and see if the older entries are still in the database from the command line:

Code: Select all

echo "select * FROM xi_auditlog;" | mysql -u root -pnagiosxi nagiosxi

You can grep the name of the service from this mysql query above.

On the XI server, see if you have the following file:

Code: Select all

/usr/local/nagiosxi/var/components/auditlog.log

[rferebee]

Our Max Audit Log Age is only set to 30 days.

The auditlog.log file does not exist on my XI server.

[rferebee]

When I try to run the MySQL command I get the following error:

ERROR 1049 (42000): Unknown database 'nagiosxi'

I think we're using Postgre SQL not MySQL.

[scottwilkerson]

Our Max Audit Log Age is only set to 30 days.

You would want to increase that to longer than 30 days in you want to look back further.

This isn't going to allow you to get back logs from the past, but it will start saving them for longer periods of time to the length you specify in days.

[rferebee]

Ok, so with the service check deleted. There would be no other record of it in the CLI besides the auditlog.log?

[scottwilkerson]

Ok, so with the service check deleted. There would be no other record of it in the CLI besides the auditlog.log?

Unfortunately with your setting set to 30 days, if it was more than 30 days ago that would be correct.

[rferebee]

Is there a way I can see what size the current audit log file is? We'd like to possibly extend the reporting to 365 days, but I'd like to know what kind of space that would take up on the server. Thank you.

[scottwilkerson]

If you look at the backup files in

Code: Select all

ls /store/backups/postgresql/daily/nagiosxi

A good estimate is about 10x bigger than the size of the gz backup

they really shouldn't take up that much space even on a busy system

[rferebee]

Thank you, you can close this thread.