I know there is a config change report but it doesn't show who made the change. Is there a way to edit that report or do i need to make a new report? Thanks.
Use this SQL report.
SELECT * FROM [dbo].[AuditingEvents]
order by timeloggedutc desc
Sorry, do i create a new report and just add this statement or add this to the existing report?
I think there probably needs to be some clarification. Specifically what kind of change are you looking to identify?
You mention a config change report. Are you talking about NCM? The way NCM does config changes it doesn't have any way to know who made a change. Most network devices don't record things like "user abcd changed this" they just record that "user abcd update the config"
You can enable the real time change detection feature in NCM, and it will keep an eye out for those user change events and as soon as it sees one it runs out to grab a new copy of the config so it can try to highlight what new changes have been made.
If you are asking about an audit of changes that users made inside Orion then there is the auditing events mentioned by e.jenidy above, but I have always been a bit annoyed at how many events that I think are auditable that the software doesn't actually record.
I am talking about NCM i guess. I just want to know who to see who made a change on a config on our network devices.
