Command line to get audit logs from xi_auditlog

xlin125 · Post by **xlin125** » Mon Apr 05, 2021 9:43 pm

We have Nagios xi 2014R2.7 on RHEL6, and we also have Nagios xi 5.2.3 on RHEL6 and Nagios xi 5.4.8 on RHEL7.

On Nagios xi 2014R2.7, both MySQL and Postgres are used. We can run the command "echo 'select * from xi_auditlog;' | psql nagiosxi nagiosxi" to get the audit logs in the table "xi_auditlog".

On Nagios xi 5.2.3 and Nagios xi 5.4.8, MySQL is used but Postgres is not used. What is the equivalent command that can be used to get the audit logs in the table "xi_auditlog"?

benjaminsmith · Post by **benjaminsmith** » Tue Apr 06, 2021 10:05 am

Hi

The table structre is the same, but connection commands will change from postgress to mysql.

Code: Select all

echo "select * from xi_auditlog;" | mysql -h 127.0.0.1 -uroot -pnagiosxi nagiosxi

Let us know if you need further assistance with the query.

Also, RHEL 6 is EOL and not supported at this time. I would recommend planning a migration for those systems. The Nagios xi license policy does allow for 3 separate activations (production, test and backup) to help make this a smooth transition.

Reference:
Migrating Nagios xi to a different Server

Regards,
Benjamin

xlin125 · Post by **xlin125** » Tue Apr 06, 2021 8:09 pm

@Benjamin, thanks for the quick response.

I tried the command that you provided, and received an access denied error:
$ echo "select * from xi_auditlog;" | mysql -h 127.0.0.1 -uroot -pnagiosxi nagiosxi
ERROR 1045 (28000): Access denied for user 'root'@'localhost' (using password: YES)

Any suggestion to resolve this issue?

benjaminsmith · Post by **benjaminsmith** » Wed Apr 07, 2021 11:20 am

Hi,

It looks like the default database passwords were changed on this system. You can retrieve this information by inspecting the following file.

Code: Select all

cat /usr/local/nagiosxi/html/config.inc.php

For more details, we have a useful guide with detailed instructions on changing the default passwords, take a look on page 3 for the database settings.

Nagios xi How to Change Default Passwords

If that's not it, try logging in directly and then running the query.

Code: Select all

mysql -u root -p 
use nagiosxi;
select * from xi_auditlog;

Let us know if you get it resolved.

xlin125 · Post by **xlin125** » Fri Apr 30, 2021 1:07 pm

Yes, the default database password was changed during the Nagios xi installation on this system. I found the password, and all looks fine. Thanks!

benjaminsmith · Post by **benjaminsmith** » Fri Apr 30, 2021 2:17 pm

Hello @xlin125,

Excellent! We'll go ahead and mark this as resolved.

Have a great weekend.

Nagios Support Forum

Command line to get audit logs from xi_auditlog

Command line to get audit logs from xi_auditlog

Re: Command line to get audit logs from xi_auditlog

Re: Command line to get audit logs from xi_auditlog

Re: Command line to get audit logs from xi_auditlog

Re: Command line to get audit logs from xi_auditlog

Re: Command line to get audit logs from xi_auditlog