I was going through Audit logs to get name of person who delete Item/Trigger on a host but i think Audit log doesn't provide sufficient information.

• If i want to check for any ITEM/TRIGGER is disabled by someone i can use Action: Update and Resource: Action/Trigger and in details trigger.status: 0 => 1 and we will have ItemID/TriggerID which we can use to get Hostname that ITEM/TRIGGER belongs and its good information.
• But if i want to check if any ITEM/TRIGGER is deleted by someone i can use Action: Delete and Resource: Action/Trigger and in details we just get Name of ITEM/TRIGGER and we will also have resourceID but since resource itself is deleted there is no way to know which host that resource belongs to.

My suggestion is to add Hostname in detail section for all Delete Action, this will give more useful audit information than what we get now.