who is changing my node names? no audit events are showing up for this potentially devastating node edit

keoki

Normally if someone edits a node, I see the evidence of the change in both a weekly report that is emailed out, and in the "Last 20 Audit Events" table on the node dashboard as well as the "ALL AUDIT EVENTS" view.

But someone edited the names of a group of nodes, and there is nothing to tell me who did it  How do I get the name of the user that edited the node names?  A swql  would be fine, but I would expect it to show up with the other edits in the various "audit events" views.

The issue we have is edits to solarwinds must go through change control to prevent damaging integrated processes that use the SolarWinds data.  Changes I can't see in the audit events are very concerning.

Keoki

marcrobinson

This used to be a quirky feature. NPM would change the node caption if the hostname or dns name would change. If you set the caption to something specific, it typically would not change it. I have not seen dns changes do this in recent versions. The hostname - not sure, but I do not think so. Again this would somehow be fixed if you manually set captions. I would check the event (not just  the audit) logs, as I vaguely recall a system entry for a name change/update. Start there at least. Here is the most recent article on this odd effect: How Caption field for nodes is determined   (https://solarwindscore.my.site.com/SuccessCenter/s/article/How-Caption-field-for-nodes-is-determined?language=en_US)

Again - i have not noticed this in recent versions - older versions, yes.  It also forced some admins to properly clean up DNS entries and set proper hostnames, so I did not mind it.