Identifying user that Disables Service Notfications

[awilson]

Hi. Is there a way to identify which user used the Service Details view to disable or enable notifications?

I don't see the action in the event log.

Thanks!

[eloyd]

If you have the Enterprise add-on, you would see that in Admin | Audit Log. If you do not have the Enterprise add-on, then no, you would not. It still won't tell you who looked, but it will tell you who changed something. You may also look at your Apache log file for the URL that is the event you're looking for and trace back to an IP.

[tgriep]

Thanks @eloyd for the help.
@awilson, To see what was enabled or disabled in the Event Log from the status menu, you would have to set this option enable log_external_commands=1 in the /usr/local/nagios/etc/nagios.cfg file so it will log that data.

It will not show the user who did it, that is what the Audit Log is for but you at least see it in the event log.

[awilson]

Thank you both. We have the audit log. I'll look at that. I'll also enable log_external_commands.

Thanks!

You can close this.