Identify who is closing incidents?

[bwarehime]

Is there an easy way to identify who is closing each alert out? Going through the logs in the Admin section, I can see edits to the incidents, but, doesn't specifically mention if it was closed or anything, which could mean multiple things. I just want to know who closed the incident out.

Also, are these logs available anywhere on the host, without going through the UI? Ideally, I'd put those through Splunk or something to keep metrics on who is closing out what and how long it takes to close an incident from creation.

[gaelmuller]

Unfortunately, there is currently no reliable way to determine who closed an incident. When the incident is closed using a comment or the Close button, there will be a comment added that will contain the who. But it will not be the case when the incident is closed via the Edit button, and comments can be easily removed.

FYI, the logs are stored in the database.