Can we detect who did a particular operation in NiFi?

[#1]

Hello we have single user based NiFi but in reality around 15 to 20 people use that instance. How to know who added a process group or stopped a processor and at which point of time was that processor stopped? Do we have any IP getting recorded or anything like that? 
Is it possible in NiFi having OIDC/Oauth2 based authentication that which user added/removed something?

[#2]

Hello @AlokKumar, 

Thanks for being part of the community. 

Yes, that is possible. 
You should be able to search on the nifi-user.log for entries. You can either filter them by user or by processor IDs. 

For example, I did some starts and stops for this processor. 

By checking the log using the ID, I found this: 

2026-05-26 18:29:40,582 INFO [NiFi Web Server-36464] o.a.n.w.s.NiFiAuthenticationFilter Authentication Started 10.129.x.x [<vafs><CN=node1.cfm-vafs.cloudera.com, ST=CA, C=US>] PUT https://node1.cfm-vafs.cloudera.com:8443/nifi-api/processors/3be575b5-019e-1000-0000-00002f93e650/run-status
2026-05-26 18:29:40,582 INFO [NiFi Web Server-36464] o.a.n.w.s.NiFiAuthenticationFilter Authentication Success [vafs] 10.129.x.x PUT https://node1.cfm-vafs.cloudera.com:8443/nifi-api/processors/3be575b5-019e-1000-0000-00002f93e650/run-status
2026-05-26 18:29:40,597 INFO [NiFi Web Server-33000] o.a.n.w.s.NiFiAuthenticationFilter Authentication Started 10.129.x.x [<vafs><CN=node1.cfm-vafs.cloudera.com, ST=CA, C=US>] PUT https://node1.cfm-vafs.cloudera.com:8443/nifi-api/processors/3be575b5-019e-1000-0000-00002f93e650/run-status
2026-05-26 18:29:40,598 INFO [NiFi Web Server-33000] o.a.n.w.s.NiFiAuthenticationFilter Authentication Success [vafs] 10.129.x.x PUT https://node1.cfm-vafs.cloudera.com:8443/nifi-api/processors/3be575b5-019e-1000-0000-00002f93e650/run-status
...
2026-05-26 18:29:51,454 INFO [NiFi Web Server-36459] o.a.n.w.s.NiFiAuthenticationFilter Authentication Started 10.129.x.x [<vafs><CN=node1.cfm-vafs.cloudera.com, ST=CA, C=US>] PUT https://node1.cfm-vafs.cloudera.com:8443/nifi-api/processors/3be575b5-019e-1000-0000-00002f93e650/run-status
2026-05-26 18:29:51,455 INFO [NiFi Web Server-36459] o.a.n.w.s.NiFiAuthenticationFilter Authentication Success [vafs] 10.129.x.x PUT https://node1.cfm-vafs.cloudera.com:8443/nifi-api/processors/3be575b5-019e-1000-0000-00002f93e650/run-status
2026-05-26 18:29:51,465 INFO [NiFi Web Server-36510] o.a.n.w.s.NiFiAuthenticationFilter Authentication Started 10.129.x.x [<vafs><CN=node1.cfm-vafs.cloudera.com, ST=CA, C=US>] PUT https://node1.cfm-vafs.cloudera.com:8443/nifi-api/processors/3be575b5-019e-1000-0000-00002f93e650/run-status
2026-05-26 18:29:51,465 INFO [NiFi Web Server-36510] o.a.n.w.s.NiFiAuthenticationFilter Authentication Success [vafs] 10.129.x.x PUT https://node1.cfm-vafs.cloudera.com:8443/nifi-api/processors/3be575b5-019e-1000-0000-00002f93e650/run-status

Also, by checking the ID for a proccessor group I see the following: 

2026-05-26 18:31:40,166 INFO [NiFi Web Server-36460] o.a.n.w.s.NiFiAuthenticationFilter Authentication Started 10.129.x.x [<vafs><CN=node1.cfm-vafs.cloudera.com, ST=CA, C=US>] PUT https://node1.cfm-vafs.cloudera.com:8443/nifi-api/process-groups/658e5692-019e-1000-ffff-ffff8f55b0de
2026-05-26 18:31:40,167 INFO [NiFi Web Server-36460] o.a.n.w.s.NiFiAuthenticationFilter Authentication Success [vafs] 10.129.x.x PUT https://node1.cfm-vafs.cloudera.com:8443/nifi-api/process-groups/658e5692-019e-1000-ffff-ffff8f55b0de
2026-05-26 18:31:40,187 INFO [NiFi Web Server-36459] o.a.n.w.s.NiFiAuthenticationFilter Authentication Started 10.129.x.x [<vafs><CN=node1.cfm-vafs.cloudera.com, ST=CA, C=US>] PUT https://node1.cfm-vafs.cloudera.com:8443/nifi-api/process-groups/658e5692-019e-1000-ffff-ffff8f55b0de
2026-05-26 18:31:40,188 INFO [NiFi Web Server-36459] o.a.n.w.s.NiFiAuthenticationFilter Authentication Success [vafs] 10.129.x.x PUT https://node1.cfm-vafs.cloudera.com:8443/nifi-api/process-groups/658e5692-019e-1000-ffff-ffff8f55b0de

This should give you the information you want. 

[#3]

hello in the logs above I don't see any log which describes LogAttribute (the screenshot you have posted above says it is a LogAttribute processor) being started or stopped. Also anyway to know which user did this

[#4]

Hello @AlokKumar, 

The log used the Processor or Group ID, not the name. 
This is because you can have multiple processor for the same one, but the ID is always unique. 
On this example, the ID is: 3be575b5-019e-1000-0000-00002f93e650

The user is also reported between the [], in my case, is vafs: 

2026-05-26 18:29:51,455 INFO [NiFi Web Server-36459] o.a.n.w.s.NiFiAuthenticationFilter Authentication Success [vafs] 10.129.x.x PUT https://node1.cfm-vafs.cloudera.com:8443/nifi-api/processors/3be575b5-019e-1000-0000-00002f93e650/run-status

[#5 · Accepted solution]

@AlokKumar 

You need to make sure each user is authenticating with a unique username in order to

know which user made a change If you are using the same user, then all recorded changes will show that single user.  Form a pure security standpoint it is a bad practice to have multiple users share authentication credentials.  Apache NiFi offers numerous

methods for User Authentication.   While Lightweight Directory Access Protocol (LDAP) is probably the most commonly used, there are other options to include OpenID Connect, Kerberos, SAML, JSON Web Tokens, and X.509 Client Certificates.

If you are currently using the default Single User authentication which the utilizes the Single User authorizer, you will also need to select a different Multi-Tenant Authorization as well to go with the new multi user authentication methods.  The most commonly used is the StandardManagedAuthorizer. 

Please help our community grow. If you found any of the suggestions/solutions provided helped you with solving your issue or answering your question, please take a moment to login and click "Accept as Solution" on one or more of them that helped.

Thank you,
Matt