<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <meta content="text/html; charset=ISO-8859-1" http-equiv="Content-Type"> <title></title> </head> <body bgcolor="#ffffff" text="#000000"> On 2011-08-08 18:01, Robert J Molerio wrote: <blockquote cite="mid:CAJXFarq--_ZqxiLwD7AQYYF+NDjMRQtxFBVhFzfHJM2eynu5+A@mail.gmail.com" type="cite"> <div>Hello,</div> <div><br> I was told the NAGIOS CORE logfile would log any changes made to host command execution ie: External commands:who turned off what and when.</div> <div>Upon examination of my logfile it sems that this is not the case. </div> <div>The log file indicates only that a particular service was enabled or disable but it does not indiacte the user id that performed the change.</div> <div> </div> <div>Can anyone point me in the right direction to make this happen?</div> </blockquote> <br> this isn't possible with nagios core. you'd better catch up on your application sending the external commands, logging that to somewhere. e.g. if you are using the nagios classic ui with the cmd.cgi, you might hack that to log the user into a seperate file. <br> we did hack that in icinga classic and cmd.cgi so that each user and ip address are logged into a seperated file (see <a class="moz-txt-link-freetext" href="https://dev.icinga.org/issues/1161">https://dev.icinga.org/issues/1161</a> for more information). but vanilla nagios cgis don't support that - supposingly you'll open a feature request (if not already there) on tracker.nagios.org to get that feature into nagios too.<br> <br> kind regards,<br> michael<br> <br> <blockquote cite="mid:CAJXFarq--_ZqxiLwD7AQYYF+NDjMRQtxFBVhFzfHJM2eynu5+A@mail.gmail.com" type="cite"> <div> </div> <div>Snippet of log file :</div> <div> </div> <div>[root@its019-lap-v:var]# pwd<br> /usr/local/nagios/var<br> [root@its019-lap-v:var]# ls -lat<br> total 188<br> drwxrwxr-x 5 nagios nagios 4096 Aug 8 11:15 .<br> -rw-rw-r-- 1 nagios nagios 51204 Aug 8 11:15 status.dat<br> -rw-r--r-- 1 nagios nagios 4561 Aug 8 11:09 nagios.log<br> -rw------- 1 nagios nagios 50697 Aug 8 11:09 retention.dat<br> drwxrwxr-x 2 nagios nagios 4096 Aug 8 00:00 archives<br> -rw-r--r-- 1 nagios nagios 41229 Aug 5 15:09 objects.cache<br> -rw-r--r-- 1 nagios nagios 6 Aug 1 13:24 nagios.lock<br> drwxrwsr-x 2 nagios nagcmd 4096 Aug 1 13:24 rw<br> drwxrwxr-x 9 nagios nagios 4096 Jul 1 15:06 ..<br> drwxrwxr-x 3 nagios nagios 4096 Jun 27 15:54 spool<br> [root@its019-lap-v:var]# cat nagios.log<br> [1312776000] LOG ROTATION: DAILY<br> [1312776000] LOG VERSION: 2.0<br> [1312776541] Auto-save of retention data completed successfully.<br> [1312780141] Auto-save of retention data completed successfully.<br> [1312783741] Auto-save of retention data completed successfully.<br> [1312787341] Auto-save of retention data completed successfully.<br> [1312790941] Auto-save of retention data completed successfully.<br> [1312794541] Auto-save of retention data completed successfully.<br> [1312798141] Auto-save of retention data completed successfully.<br> [1312801741] Auto-save of retention data completed successfully.<br> [1312805172] EXTERNAL COMMAND: DEL_ALL_SVC_COMMENTS;TPC Server;root space<br> [1312805341] Auto-save of retention data completed successfully.<br> [1312808941] Auto-save of retention data completed successfully.<br> [1312812541] Auto-save of retention data completed successfully.<br> [1312816017] EXTERNAL COMMAND: ENABLE_SVC_NOTIFICATIONS;Nagios Server;HTTP<br> [1312816033] EXTERNAL COMMAND: ENABLE_SVC_NOTIFICATIONS;Nagios Server;SSH<br> [1312816141] Auto-save of retention data completed successfully.<br> <br clear="all"> <br> -- <br> </div> <div>Thank you,<br> <br> Bob Molerio<br> Systems Administrator<br> New York University<br> ITS Computer Facilities Services/Infrastructure<br> Level C-2</div> <div>75 Third Avenue <br> New York NY 10003-5527<br> <a moz-do-not-send="true" href="mailto:robert.molerio@nyu.edu" target="_blank">email:robert.molerio@nyu.edu</a></div> <div> </div> <div> </div> <br> <pre wrap=""> <fieldset class="mimeAttachmentHeader"></fieldset> ------------------------------------------------------------------------------ BlackBerry® DevCon Americas, Oct. 18-20, San Francisco, CA The must-attend event for mobile developers. Connect with experts. Get tools for creating Super Apps. See the latest technologies. Sessions, hands-on labs, demos & much more. Register early & save! <a class="moz-txt-link-freetext" href="http://p.sf.net/sfu/rim-blackberry-1">http://p.sf.net/sfu/rim-blackberry-1</a></pre> <pre wrap=""> <fieldset class="mimeAttachmentHeader"></fieldset> _______________________________________________ Nagios-users mailing list <a class="moz-txt-link-abbreviated" href="mailto:Nagios-users@lists.sourceforge.net">Nagios-users@lists.sourceforge.net</a> <a class="moz-txt-link-freetext" href="https://lists.sourceforge.net/lists/listinfo/nagios-users">https://lists.sourceforge.net/lists/listinfo/nagios-users</a> ::: Please include Nagios version, plugin version (-v) and OS when reporting any issue. ::: Messages without supporting info will risk being sent to /dev/null</pre> </blockquote> <br> <br> <pre class="moz-signature" cols="72">-- DI (FH) Michael Friedrich Vienna University Computer Center Universitaetsstrasse 7 A-1010 Vienna, Austria email: <a class="moz-txt-link-abbreviated" href="mailto:michael.friedrich@univie.ac.at">michael.friedrich@univie.ac.at</a> phone: +43 1 4277 14359 mobile: +43 664 60277 14359 fax: +43 1 4277 14338 web: <a class="moz-txt-link-freetext" href="http://www.univie.ac.at/zid">http://www.univie.ac.at/zid</a> <a class="moz-txt-link-freetext" href="http://www.aco.net">http://www.aco.net</a> Icinga Core & IDOUtils Developer <a class="moz-txt-link-freetext" href="http://www.icinga.org">http://www.icinga.org</a> </pre> </body> </html>