Hi Nigios Gurus
Just a silly question, is there any way that we can see on nagios who's login credential initiated some disable/enable service check?
You could write a wrapper or watcher daemon script to catch that. The configuration files can be watched for any change, or even opened for write using fuser (not a fast command). Now, determining "who" is a question of who logged in where as who before arriving to modify the config file. Someone could even scp in a new version of a file. However, catching SIGHUP being sent to nagios to make it see the new config would require a modified nagios.