Can we detect who did a particular operation in NiFi?

AlokKumar — Tue, 26 May 2026 16:52:40 GMT

Hello we have single user based NiFi but in reality around 15 to 20 people use that instance. How to know who added a process group or stopped a processor and at which point of time was that processor stopped? Do we have any IP getting recorded or anything like that?
Is it possible in NiFi having OIDC/Oauth2 based authentication that which user added/removed something?

Re: Can we detect who did a particular operation in NiFi?

vafs — Tue, 26 May 2026 18:41:10 GMT

Hello @AlokKumar,

Thanks for being part of the community.

Yes, that is possible.
You should be able to search on the nifi-user.log for entries. You can either filter them by user or by processor IDs.

For example, I did some starts and stops for this processor.

By checking the log using the ID, I found this:

2026-05-26 18:29:40,582 INFO [NiFi Web Server-36464] o.a.n.w.s.NiFiAuthenticationFilter Authentication Started 10.129.x.x [<vafs><CN=node1.cfm-vafs.cloudera.com, ST=CA, C=US>] PUT https://node1.cfm-vafs.cloudera.com:8443/nifi-api/processors/3be575b5-019e-1000-0000-00002f93e650/run-status 2026-05-26 18:29:40,582 INFO [NiFi Web Server-36464] o.a.n.w.s.NiFiAuthenticationFilter Authentication Success [vafs] 10.129.x.x PUT https://node1.cfm-vafs.cloudera.com:8443/nifi-api/processors/3be575b5-019e-1000-0000-00002f93e650/run-status 2026-05-26 18:29:40,597 INFO [NiFi Web Server-33000] o.a.n.w.s.NiFiAuthenticationFilter Authentication Started 10.129.x.x [<vafs><CN=node1.cfm-vafs.cloudera.com, ST=CA, C=US>] PUT https://node1.cfm-vafs.cloudera.com:8443/nifi-api/processors/3be575b5-019e-1000-0000-00002f93e650/run-status 2026-05-26 18:29:40,598 INFO [NiFi Web Server-33000] o.a.n.w.s.NiFiAuthenticationFilter Authentication Success [vafs] 10.129.x.x PUT https://node1.cfm-vafs.cloudera.com:8443/nifi-api/processors/3be575b5-019e-1000-0000-00002f93e650/run-status ... 2026-05-26 18:29:51,454 INFO [NiFi Web Server-36459] o.a.n.w.s.NiFiAuthenticationFilter Authentication Started 10.129.x.x [<vafs><CN=node1.cfm-vafs.cloudera.com, ST=CA, C=US>] PUT https://node1.cfm-vafs.cloudera.com:8443/nifi-api/processors/3be575b5-019e-1000-0000-00002f93e650/run-status 2026-05-26 18:29:51,455 INFO [NiFi Web Server-36459] o.a.n.w.s.NiFiAuthenticationFilter Authentication Success [vafs] 10.129.x.x PUT https://node1.cfm-vafs.cloudera.com:8443/nifi-api/processors/3be575b5-019e-1000-0000-00002f93e650/run-status 2026-05-26 18:29:51,465 INFO [NiFi Web Server-36510] o.a.n.w.s.NiFiAuthenticationFilter Authentication Started 10.129.x.x [<vafs><CN=node1.cfm-vafs.cloudera.com, ST=CA, C=US>] PUT https://node1.cfm-vafs.cloudera.com:8443/nifi-api/processors/3be575b5-019e-1000-0000-00002f93e650/run-status 2026-05-26 18:29:51,465 INFO [NiFi Web Server-36510] o.a.n.w.s.NiFiAuthenticationFilter Authentication Success [vafs] 10.129.x.x PUT https://node1.cfm-vafs.cloudera.com:8443/nifi-api/processors/3be575b5-019e-1000-0000-00002f93e650/run-status

Also, by checking the ID for a proccessor group I see the following:

2026-05-26 18:31:40,166 INFO [NiFi Web Server-36460] o.a.n.w.s.NiFiAuthenticationFilter Authentication Started 10.129.x.x [<vafs><CN=node1.cfm-vafs.cloudera.com, ST=CA, C=US>] PUT https://node1.cfm-vafs.cloudera.com:8443/nifi-api/process-groups/658e5692-019e-1000-ffff-ffff8f55b0de 2026-05-26 18:31:40,167 INFO [NiFi Web Server-36460] o.a.n.w.s.NiFiAuthenticationFilter Authentication Success [vafs] 10.129.x.x PUT https://node1.cfm-vafs.cloudera.com:8443/nifi-api/process-groups/658e5692-019e-1000-ffff-ffff8f55b0de 2026-05-26 18:31:40,187 INFO [NiFi Web Server-36459] o.a.n.w.s.NiFiAuthenticationFilter Authentication Started 10.129.x.x [<vafs><CN=node1.cfm-vafs.cloudera.com, ST=CA, C=US>] PUT https://node1.cfm-vafs.cloudera.com:8443/nifi-api/process-groups/658e5692-019e-1000-ffff-ffff8f55b0de 2026-05-26 18:31:40,188 INFO [NiFi Web Server-36459] o.a.n.w.s.NiFiAuthenticationFilter Authentication Success [vafs] 10.129.x.x PUT https://node1.cfm-vafs.cloudera.com:8443/nifi-api/process-groups/658e5692-019e-1000-ffff-ffff8f55b0de

This should give you the information you want.

Re: Can we detect who did a particular operation in NiFi?

AlokKumar — Wed, 27 May 2026 08:27:38 GMT

hello in the logs above I don't see any log which describes LogAttribute (the screenshot you have posted above says it is a LogAttribute processor) being started or stopped. Also anyway to know which user did this

question Can we detect who did a particular operation in NiFi? in Support Questions

Can we detect who did a particular operation in NiFi?

Re: Can we detect who did a particular operation in NiFi?

Re: Can we detect who did a particular operation in NiFi?