Page 1 of 2
Service check creation information
Posted: Tue May 28, 2019 12:37 pm
by rferebee
Good morning all,
I would like to know if, in the CLI, there is a way to find a specific service check and when it was created and by whom?
My audit logs in the GUI are only going back to the beginning of the month and I need to search further.
Unfortunately, one of my colleagues deleted the service checks while I was gone, so I do not have the service ID numbers. They do however have a very specific name 'SSH' and there are only 4 other services with the same name.
Thank you.
Re: Service check creation information
Posted: Tue May 28, 2019 1:26 pm
by npolovenko
Hello,
@rferebee. Normally, Audit log should contain info for at least a few months. Can you check the Audit Log retention setting under Performance Settings?
Untitled.png
Try tunning the following query and see if the older entries are still in the database from the command line:
Code: Select all
echo "select * FROM xi_auditlog;" | mysql -u root -pnagiosxi nagiosxi
You can grep the name of the service from this mysql query above.
On the XI server, see if you have the following file:
Code: Select all
/usr/local/nagiosxi/var/components/auditlog.log
Re: Service check creation information
Posted: Tue May 28, 2019 1:44 pm
by rferebee
Our Max Audit Log Age is only set to 30 days.
The auditlog.log file does not exist on my XI server.
Re: Service check creation information
Posted: Tue May 28, 2019 1:48 pm
by rferebee
When I try to run the MySQL command I get the following error:
ERROR 1049 (42000): Unknown database 'nagiosxi'
I think we're using Postgre SQL not MySQL.
Re: Service check creation information
Posted: Tue May 28, 2019 2:20 pm
by scottwilkerson
rferebee wrote:Our Max Audit Log Age is only set to 30 days.
You would want to increase that to longer than 30 days in you want to look back further.
This isn't going to allow you to get back logs from the past, but it will start saving them for longer periods of time to the length you specify in days.
Re: Service check creation information
Posted: Tue May 28, 2019 2:53 pm
by rferebee
Ok, so with the service check deleted. There would be no other record of it in the CLI besides the auditlog.log?
Re: Service check creation information
Posted: Tue May 28, 2019 3:14 pm
by scottwilkerson
rferebee wrote:Ok, so with the service check deleted. There would be no other record of it in the CLI besides the auditlog.log?
Unfortunately with your setting set to 30 days, if it was more than 30 days ago that would be correct.
Re: Service check creation information
Posted: Tue May 28, 2019 3:29 pm
by rferebee
Is there a way I can see what size the current audit log file is? We'd like to possibly extend the reporting to 365 days, but I'd like to know what kind of space that would take up on the server. Thank you.
Re: Service check creation information
Posted: Wed May 29, 2019 7:10 am
by scottwilkerson
If you look at the backup files in
Code: Select all
ls /store/backups/postgresql/daily/nagiosxi
A good estimate is about 10x bigger than the size of the gz backup
they really shouldn't take up that much space even on a busy system
Re: Service check creation information
Posted: Wed May 29, 2019 9:27 am
by rferebee
Thank you, you can close this thread.