SAM recently added some basic user auditing events, but SAM needs more robust auditing of user initiated changes to the system, such as "who deleted my application template?", or " who assigned this application template to my server?" etc.
Here...Here..
We need to be able to audit who UnManged and Managed Node and SAM Application Templates
Was any of this ever added? I could definitely use the who added this application template to a server. More of a education issue as solarwinds tends to auto check certain application monitors (APPInsight) when importing servers.
Never mind i found it. But it doesn't appear to work. I know an App temp had been added as its showing up on servers with down application. But when I search the audit on the specific server it doesn't show any app temp being added.
Audit logs are retained only for 30 days (configurable under [Settings -> Polling Settings]. Is it possible the application template was assigned 31+ days ago?
I created a simple report in Orion Report Writer that is extremely useful for finding out who unmanaged nodes.
Audit Event Log Template.
I filtered results by "Action Type is equal to Node unmanaged" and "records time logged is greater than or equal to 11/11/2015" <=This was just the date that we setup SAM.
Time frame in my case is set to last 7 days for my weekly report.
Not sure if this helps... Enjoy!
Jason
