We are in the process of migrating from core to XI and I am wondering how I can see who has logged in to Nagios on my core server. Is there a log file? I looked but couldn't find one.
Thanks.
Who has logged in to core
Re: Who has logged in to core
Hey @kbauma01
I looked into this and unfortunately I don't believe we have a log file with login history for Nagios Core. There was recommendations to check /var/log/httpd/access_log however I didn't see login attempts there when testing.
I looked into this and unfortunately I don't believe we have a log file with login history for Nagios Core. There was recommendations to check /var/log/httpd/access_log however I didn't see login attempts there when testing.
Re: Who has logged in to core
Hi @kbauma01, thanks for reaching out.
Nagios Core handles authentication through Apache's implementation of BasicAuth - you won't be able to see individual logins, but you should be able to check your apache access log for each individual page, and the username should be logged there.
Here's an example from my own Core server:
Hopefully that helps - let me know if you run into any issues or have further questions or concerns
-Sebastian
Nagios Core handles authentication through Apache's implementation of BasicAuth - you won't be able to see individual logins, but you should be able to check your apache access log for each individual page, and the username should be logged there.
Here's an example from my own Core server:
Code: Select all
[root@localhost ~]# tail -5 /var/log/httpd/access_log
192.168.107.11 - nagiosadmin [18/Jan/2024:10:51:22 -0500] "GET /nagios/images/sflogo.png HTTP/1.1" 200 469 "http://192.168.0.117/nagios/main.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
192.168.107.11 - nagiosadmin [18/Jan/2024:10:51:23 -0500] "GET /nagios/images/passiveonly.gif HTTP/1.1" 200 882 "http://192.168.0.117/nagios/main.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
192.168.107.11 - nagiosadmin [18/Jan/2024:10:51:23 -0500] "GET /nagios/cgi-bin/statusjson.cgi?query=programstatus HTTP/1.1" 200 999 "http://192.168.0.117/nagios/main.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
192.168.107.11 - nagiosadmin [18/Jan/2024:10:51:23 -0500] "GET /nagios/images/enabled.gif HTTP/1.1" 200 90 "http://192.168.0.117/nagios/main.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
192.168.107.11 - nagiosadmin [18/Jan/2024:10:51:23 -0500] "GET /nagios/images/favicon.ico HTTP/1.1" 200 822 "http://192.168.0.117/nagios/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
-Sebastian
As of May 25th, 2018, all communications with Nagios Enterprises and its employees are covered under our new Privacy Policy
Re: Who has logged in to core
Thanks @swolf.
Here is what I am seeing. It looks like my second column is just "- -" where yours is nagiosadmin.
::1 - - [18/Jan/2024:12:20:56 -0500] "OPTIONS * HTTP/1.0" 200 - "-" "Apache/2.4.6 (Red Hat Enterprise Linux) OpenSSL/1.0.2k-fips (internal dummy connection)"
192.168.10.10 - - [18/Jan/2024:12:29:43 -0500] "GET /nagios/ HTTP/1.1" 302 217 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
Any ideas?
Here is what I am seeing. It looks like my second column is just "- -" where yours is nagiosadmin.
::1 - - [18/Jan/2024:12:20:56 -0500] "OPTIONS * HTTP/1.0" 200 - "-" "Apache/2.4.6 (Red Hat Enterprise Linux) OpenSSL/1.0.2k-fips (internal dummy connection)"
192.168.10.10 - - [18/Jan/2024:12:29:43 -0500] "GET /nagios/ HTTP/1.1" 302 217 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
Any ideas?