Nagios Support Forum

Hi -

I had a recent incident where a host notification was disabled and the host went down. I need to know which user did it but the audit log only specifies the event but not a user. Is this data captured somewhere and if not, how do I enable it?

That's odd. Are you using an older version of XI? The audit log in my 5.2.8 version shows the user...

Actually you're right - some of them shows a user but this one just says:

2016-06-03 09:56:32 43035 Nagios XI INFO localhost cmdsubsys: User submitted a command to Nagios Core: ENABLE_HOST_NOTIFICATIONS;<Hostname>

So items done in Nagios core doesn't log?

It does not, because the way Core authenticates vs XI are completely different. They both do their own logging independently.

I created a feature request to have the dev's look further into the auditing in regards to Core, so that hopefully it'll be possible to see which core user submitted the command. The ID is #8709.

Thanks for this.

I think a work around is to look at the audit log immediately before that who submitted the command. Unfortunately when you search by host - that submission doesn't show up.

We can close this case. Thanks.

Glad you were able to find a solution! Locking this