Is there a log showing who has logged into the Orion website? Someone had removed an entire group from the system, and we need to find out who.
An audit Trail is an existing Feature Request but you can refer to the IIS logs and this may help you narrow down who the culprit is.
IIS Logs will store the username and IP address of the login, for example:
2011-3-08 18:17:01 W3SVC3 10.160.5.226 GET /Orion/Report.aspx Report=Test1&InlineRendering=TRUE&AccountID=Admin&Password=&Printable=TRUE 80 - 10.160.5.226
Above, for example the user name Admin logged in from 10.160.5.226
IIS 6 Log files location:%windir%\System32\LogFiles
IIS 7 Log files location:%SystemDrive%\inetpub\logs\LogFiles
Please also see:
IIS 6.0 logshttp://www.microsoft.com/technet/prodtechnol/WindowsServer2003/Library/IIS/3e27a577-a6e3-4b0b-9379-68efb5d52ee9.mspx?mfr=true
IIS 7.0 logshttp://technet.microsoft.com/en-us/library/cc732079(WS.10).aspx
WOW that is a LOT of text. I found the time frame in the log, but not sure what to look for when it comes to the node being removed. There are a few IP's showing, so I have to back track to find the user ID. I am looking at the time frame Orion shows the nodes were removed, but can't seem to find it in the log.
