If a pool node is modified from the UI, the details in the audit log include the node IP address that the change was made on.
For example, the following log entry is made when changing a node to "draining".:
[05/Jun/2014:16:40:19 +0100] USER=admin GROUP=admin AUTH=local IP=10.0.0.1 OPERATION=keymod KEY=draining VALUE=10.0.2.2 OLDVAL= FILE=Pool > pool_name
When the same change is made via REST API, the value for the node is replaced with the change made and the node IP is missing from the audit log entry:
[05/Jun/2014:16:41:55 +0100] USER=admin GROUP=admin AUTH=local IP=10.0.0.1 OPERATION=keymod KEY=nodes_table VALUE=draining OLDVAL=active FILE=pools > pool_name