Page 1 of 1
Who has logged in to core
Posted: Wed Jan 17, 2024 12:34 pm
by kbauma01
We are in the process of migrating from core to XI and I am wondering how I can see who has logged in to Nagios on my core server. Is there a log file? I looked but couldn't find one.
Thanks.
Re: Who has logged in to core
Posted: Thu Jan 18, 2024 10:50 am
by sgardil
Hey
@kbauma01
I looked into this and unfortunately I don't believe we have a log file with login history for Nagios Core. There was recommendations to check /var/log/httpd/access_log however I didn't see login attempts there when testing.
Re: Who has logged in to core
Posted: Thu Jan 18, 2024 10:51 am
by swolf
Hi
@kbauma01, thanks for reaching out.
Nagios Core handles authentication through Apache's implementation of BasicAuth - you won't be able to see individual logins, but you should be able to check your apache access log for each individual page, and the username should be logged there.
Here's an example from my own Core server:
Code: Select all
[root@localhost ~]# tail -5 /var/log/httpd/access_log
192.168.107.11 - nagiosadmin [18/Jan/2024:10:51:22 -0500] "GET /nagios/images/sflogo.png HTTP/1.1" 200 469 "http://192.168.0.117/nagios/main.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
192.168.107.11 - nagiosadmin [18/Jan/2024:10:51:23 -0500] "GET /nagios/images/passiveonly.gif HTTP/1.1" 200 882 "http://192.168.0.117/nagios/main.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
192.168.107.11 - nagiosadmin [18/Jan/2024:10:51:23 -0500] "GET /nagios/cgi-bin/statusjson.cgi?query=programstatus HTTP/1.1" 200 999 "http://192.168.0.117/nagios/main.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
192.168.107.11 - nagiosadmin [18/Jan/2024:10:51:23 -0500] "GET /nagios/images/enabled.gif HTTP/1.1" 200 90 "http://192.168.0.117/nagios/main.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
192.168.107.11 - nagiosadmin [18/Jan/2024:10:51:23 -0500] "GET /nagios/images/favicon.ico HTTP/1.1" 200 822 "http://192.168.0.117/nagios/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
Hopefully that helps - let me know if you run into any issues or have further questions or concerns
-Sebastian
Re: Who has logged in to core
Posted: Thu Jan 18, 2024 12:38 pm
by kbauma01
Thanks @swolf.
Here is what I am seeing. It looks like my second column is just "- -" where yours is nagiosadmin.
::1 - - [18/Jan/2024:12:20:56 -0500] "OPTIONS * HTTP/1.0" 200 - "-" "Apache/2.4.6 (Red Hat Enterprise Linux) OpenSSL/1.0.2k-fips (internal dummy connection)"
192.168.10.10 - - [18/Jan/2024:12:29:43 -0500] "GET /nagios/ HTTP/1.1" 302 217 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
Any ideas?