nagios log server

[geremew]

hello dears,
please help me on how to query for database activities on nagios log server(example: user creation, deletion ,modification, connecting to DB,and....
also when i create a user on linux server, i am unable to get the following information: who did the activity(user), from where he/she is doing that activity(source address of from where )
could you please help me to fix this issues .
regards

[mbellerue]

Building queries takes a bit of experimentation. But we can help get you started.

First, here's a good video on building queries.
https://exchange.nagios.org/directory/T ... -2/details

In order to start querying for data, you will want to see what the logs look like, and what makes them unique from other logs. That way you can apply good filters to get the exact data that you want.

Regarding your second issue, the level of detail you can get from a log is limited by what has actually been logged. If a log entry does not contain user/source IP/etc., then that data will not appear on Log Server. Do the log entries contain user and source IP on the host?

[geremew]

no it has log source, activities performed, time stamp but it hasnot source and user

[mbellerue]

If the logs generated on the host system don't include the information you need, then you have to look at the application that is generating the logs and see if there is a way to add the fields you want to the logged data. Once it's actually logging that data, it will get sent to Log Server, and from there you can query it.