Can we detect who did a particular operation in NiFi?

[#1]

Hello we have single user based NiFi but in reality around 15 to 20 people use that instance. How to know who added a process group or stopped a processor and at which point of time was that processor stopped? Do we have any IP getting recorded or anything like that? 
Is it possible in NiFi having OIDC/Oauth2 based authentication that which user added/removed something?

[#2]

Hello @AlokKumar, 

Thanks for being part of the community. 

Yes, that is possible. 
You should be able to search on the nifi-user.log for entries. You can either filter them by user or by processor IDs. 

For example, I did some starts and stops for this processor. 

By checking the log using the ID, I found this: 

2026-05-26 18:29:40,582 INFO [NiFi Web Server-36464] o.a.n.w.s.NiFiAuthenticationFilter Authentication Started 10.129.x.x [<vafs><CN=node1.cfm-vafs.cloudera.com, ST=CA, C=US>] PUT https://node1.cfm-vafs.cloudera.com:8443/nifi-api/processors/3be575b5-019e-1000-0000-00002f93e650/run-status
2026-05-26 18:29:40,582 INFO [NiFi Web Server-36464] o.a.n.w.s.NiFiAuthenticationFilter Authentication Success [vafs] 10.129.x.x PUT https://node1.cfm-vafs.cloudera.com:8443/nifi-api/processors/3be575b5-019e-1000-0000-00002f93e650/run-status
2026-05-26 18:29:40,597 INFO [NiFi Web Server-33000] o.a.n.w.s.NiFiAuthenticationFilter Authentication Started 10.129.x.x [<vafs><CN=node1.cfm-vafs.cloudera.com, ST=CA, C=US>] PUT https://node1.cfm-vafs.cloudera.com:8443/nifi-api/processors/3be575b5-019e-1000-0000-00002f93e650/run-status
2026-05-26 18:29:40,598 INFO [NiFi Web Server-33000] o.a.n.w.s.NiFiAuthenticationFilter Authentication Success [vafs] 10.129.x.x PUT https://node1.cfm-vafs.cloudera.com:8443/nifi-api/processors/3be575b5-019e-1000-0000-00002f93e650/run-status
...
2026-05-26 18:29:51,454 INFO [NiFi Web Server-36459] o.a.n.w.s.NiFiAuthenticationFilter Authentication Started 10.129.x.x [<vafs><CN=node1.cfm-vafs.cloudera.com, ST=CA, C=US>] PUT https://node1.cfm-vafs.cloudera.com:8443/nifi-api/processors/3be575b5-019e-1000-0000-00002f93e650/run-status
2026-05-26 18:29:51,455 INFO [NiFi Web Server-36459] o.a.n.w.s.NiFiAuthenticationFilter Authentication Success [vafs] 10.129.x.x PUT https://node1.cfm-vafs.cloudera.com:8443/nifi-api/processors/3be575b5-019e-1000-0000-00002f93e650/run-status
2026-05-26 18:29:51,465 INFO [NiFi Web Server-36510] o.a.n.w.s.NiFiAuthenticationFilter Authentication Started 10.129.x.x [<vafs><CN=node1.cfm-vafs.cloudera.com, ST=CA, C=US>] PUT https://node1.cfm-vafs.cloudera.com:8443/nifi-api/processors/3be575b5-019e-1000-0000-00002f93e650/run-status
2026-05-26 18:29:51,465 INFO [NiFi Web Server-36510] o.a.n.w.s.NiFiAuthenticationFilter Authentication Success [vafs] 10.129.x.x PUT https://node1.cfm-vafs.cloudera.com:8443/nifi-api/processors/3be575b5-019e-1000-0000-00002f93e650/run-status

Also, by checking the ID for a proccessor group I see the following: 

2026-05-26 18:31:40,166 INFO [NiFi Web Server-36460] o.a.n.w.s.NiFiAuthenticationFilter Authentication Started 10.129.x.x [<vafs><CN=node1.cfm-vafs.cloudera.com, ST=CA, C=US>] PUT https://node1.cfm-vafs.cloudera.com:8443/nifi-api/process-groups/658e5692-019e-1000-ffff-ffff8f55b0de
2026-05-26 18:31:40,167 INFO [NiFi Web Server-36460] o.a.n.w.s.NiFiAuthenticationFilter Authentication Success [vafs] 10.129.x.x PUT https://node1.cfm-vafs.cloudera.com:8443/nifi-api/process-groups/658e5692-019e-1000-ffff-ffff8f55b0de
2026-05-26 18:31:40,187 INFO [NiFi Web Server-36459] o.a.n.w.s.NiFiAuthenticationFilter Authentication Started 10.129.x.x [<vafs><CN=node1.cfm-vafs.cloudera.com, ST=CA, C=US>] PUT https://node1.cfm-vafs.cloudera.com:8443/nifi-api/process-groups/658e5692-019e-1000-ffff-ffff8f55b0de
2026-05-26 18:31:40,188 INFO [NiFi Web Server-36459] o.a.n.w.s.NiFiAuthenticationFilter Authentication Success [vafs] 10.129.x.x PUT https://node1.cfm-vafs.cloudera.com:8443/nifi-api/process-groups/658e5692-019e-1000-ffff-ffff8f55b0de

This should give you the information you want. 

[#3]

hello in the logs above I don't see any log which describes LogAttribute (the screenshot you have posted above says it is a LogAttribute processor) being started or stopped. Also anyway to know which user did this