E-mail
WAS THIS PAGE HELPFUL? Leave Feedback
Overview
The Audit Log feature tracks system configuration and run time changes in an audit trail. This provides the ability to report and correlate failures with configuration changes which can be very useful since a majority of system failures are due to configuration changes.
The audit facility reports on changes made from Status, Event Console, Cloud Hub, and Configuration applications.
Specifically, the action portlet in Status logs any commands sent to Nagios to be logged in the audit system and the action menu code in the Event Console (and the Event Portlet in Status) creates an audit entry for each action executed. Additionally, the Cloud Hub inventory synchronization routine creates an audit entry for each addition or deletion of a virtual machine or hypervisor instance as well as any threshold change into the audit system. Configuration (Monarch) creates audit entries for all additions, deletions, and modifications of configuration data, and each commit command generates an audit entry.
The audit system lists the most recent activity first and includes the time of the change and the user that issued the change.
Filtering Audit Log Activity
As shown below, the user interface lists activity that can be filtered. Filters include the name of a Sub System, Host or Group Name, Service Description, User Name, and by part of an activity Message text. A Date-Time Range can also be used in filtering specific activity. Clicking the column title of each audit log columns will sort the list by ascending or descending order.
Figure: Audit Log
Audit Log Content
The following table describes each of the columns content in the audit log:
| Column Name | Description |
|---|---|
| Activity Message | Displays the textual description of the change that has been made. |
| Subsystem | Indicates where the change occurred, the subsystem the audit action is logged for, (e.g., Console, SV (Status Viewer), Monarch, CloudHub). |
| Hostname |
Indicates the name of the host or instance of the change, the host name the audit is logged for. |
| Service |
Indicates the name of the service or instance of the change. |
| Action |
Lists the audit action logged (e.g., ACTION, ADD, DELETE, MODIFY, ENABLE, DISABLE). |
| Username |
Displays the name of the user that performed the audited action (e.g., admin). |
| Timestamp |
Indicates the date and time the audit action was logged (e.g., 2017-08-25 10:25:13 AM). |