NBU - tracking configuration changes

Unless you're using NBAC (*shudder*) I think you're out of luck even for GUI auditing. You will see that a change was made but not who made it. I think even with NBAC you won't be able to see CLI-driven changes if your admins are elevating to root. 

For person referable auditing NBAC is the only solution.

While NBAC do add a bit of extra complexity its not that bad. 

Thanks for the timely responses !  

NBAC is not configured on our NBU environment and it appears that it requires some major planning to implement. I'm guessing, perhaps incorrectly, that if NBAC was configured today, the detailed reporting would only be from today forward.

The command nbauditreport returns some really good configuration change info. It's unfortunate though that the NBU administrators are not setup to access NBU with root access using their individual accounts.  As mentioned, the NBU admins use "sudo su -" to directly access root privileges for NBU admin GUI and NBU commands, so all nbauditreport output shows all commands made by root@master.  Great command that returns good historical info.