Nagios Support Forum

Hi Nagios Team,

Today I came across a peculiar issue within Nagios XI. It was discovered that services that were configured and working as expected prior to this went missing randomly. Having checked the audit logs, there were no clues as to what could have caused this issue. Any suggestions as to where I should begin investigating this issue?

Thanks,
Jason

Hi Jason,

The best place to look would be the Audit Log, Admin > System Information > Audit Log, and filter on the Core Config Manager.

Sounds like either those services were deactivated or a previous configuration snapshot was reverted. Nagios XI will save the 10 most recent Configuration Snapshots, you can view those at Configure > Quick Tools > Configuration Snapshots. Have there been any recent changes to the snapshots?

Are you able to search in the CCM for those services? Go to Configure > CCM > Services > Search Box. Please let me know the results?

Regards,
Benjamin

Hi Benjamin,

We have tried the provided suggestions but could not narrow down what is causing the services to go missing randomly. Attached are the snapshots taken from the archive logs and audit logs.
Based on the logs provided, we can see that there is a gap within the logs indicating that the services were missing between Oct 8 and Oct 25, 2020. Oct 26 was the date the missing services were reinstated.
We would like some information pertaining to why the services were deleted twice (as seen in the snapshot of the audit log) and simultaneously the service that was supposedly deleted was seen in the logs to be modified. We have clarified with the user and this person has confirmed that he was merely modifying the service (rather than deleting it).

Last but not least, are there any other log sources from which we could obtain a better understanding of what is going on within the system? Preferably log(s) that provide information in a more verbose format?

Thanks,
Jason

Please PM me a copy of your profile, you can download it from Admin > System Profile by clicking the Download Profile button.

There isn't much else for granularity when dealing with the audit logs. Can you ask him what he changed when he modified it? That could be normal depending on what he's doing.

The logs reside in these directories but you won't likely see the granularity you're looking for in the files (some of them are truncated on each run):