Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

Finding out who removed a Node from NPM, when there is no log in the events, and node is not present in NCM anymore

So yesterday there was a Distribution Node that is not present today.. The building has 2, they are being refreshed, so all 4 are in Orion. Today the first of the old nodes is not present in NPM, NCM, and there is no log in the events. So I have to idea to track where this node went. It was here yesterday, but not now.

Operating System	Windows Server 2008 R2
OS Version	6.1.7601.xxxx
Service Pack	Service Pack 1

Product Name	SolarWinds Network Configuration Manager
Version	7.1.1
Service Pack	None

Product Name	Server & Application Monitor
Version	5.5.0
Service Pack	None

License	Production
Product Name	Network Performance Monitor
Version	10.5
Service Pack	None

We have our Web engine on a separate server, with 3 individual pollers.

Find more posts tagged with

deleted

network_monitoring

Node

network_management

missing

Accepted answers

All comments

LadaVarga

Hello cahunt,

Please look to message center, where you can see audit events and you should who deleted your node.

You should see something like this:

8.1.2014 11:16:04

Audit Event

User admin deleted node 10.111.11.11

cahunt

So I have listed the Audit Events, but the node removal is not showing. In the drop down of Nodes, the removed node is not listed; So I am wondering where this data would have been stored; and possibly removed with the process of the node removal. If I can not search for it specifically, due to it not being there I can not tie any events to it... Suggestions?

FormerMember

Hi cahunt,

Did you find an answer to this question, or is it still outstanding? I have recently had a customer contact me regarding the same thing. The node is removed from NPM and NCM databases and all historic stats and config data has gone with it and no audit trail.

wluther

cahunt garrethcoleman

We are having the same issue(s).

We have an open case:

Case # 585417 - Audit events lacks information

We first noticed ours when we unmanaged some interfaces. I checked the message center to make sure they were unmanaged, yet the only thing that showed up for the day was user logins. (option was set to show all).

The next day our audit trail showed what it needed to for the day, however, still nothing from the day before.

Hope they get this figured out soon...

-Will

Server

Web Server	ORION01
Operating System	Windows Server 2012
OS Version	6.2.9200.0
Service Pack	None

Network Elements

Total Count	11257
Nodes	1054
Interfaces	6043
Volumes	4160

Orion

Module Name	Orion Platform
Version	2013.2.1
Service Pack	None
Nodes currently monitored	1054
Total nodes in license	unlimited
Volumes currently monitored	4160
Total volumes in license	unlimited

NCM

Product Name	SolarWinds Network Configuration Manager
Version	7.2.2
Service Pack	None
License	Production
Allowed number of nodes	3000
Current number of nodes	862

NPM

License	Production
Product Name	Network Performance Monitor
Version	10.6.1
Service Pack	None
Current number of interfaces	6043
Allowed number of interfaces	unlimited

NTA

License	Production
Module Name	NetFlow Traffic Analyzer
Version	4.0.0
Service Pack	None

mr.e

First, I would suggest for you to:

Confirm that the Enable audit trails box is checked under the Auditing Settings (Web Settings link on Admin page)
Check on the number of days that events remain until removed. For this, go to the Polling Settings link and check the Events Retention under the Database Settings section.

Also, to prevent from missing other removals, I would suggest for you to download the Nodes Removed From Orion report to your Orion server on Thwack. Unfortunately, the report only tells you which node was removed and when. It does not tell you the username for the person who removed the node. For testing purposes, I removed node that I was testing from our Orion server.

Again, the node does not appear on the report. But, if I go to the Message Center, I can locate the name of node removed, when it was removed and who removed it (in this case, myself). So, if the Message Center does hold this information (until purged), you may want to check it out on your Orion instanace. Also, there must be a way to create a report that shows who deleted a node. I will keep checking on this, since I have a vested interest myself.

I hope this helps,

mr.e

Good news!!! I was able to create a SW report that shows who deleted a node and when; please, see attached. The report is set for the last 24 hours, which works for me since I would send these daily reports to myself.

Nodes_removed_in_last_24_hrs_-_Username_listed.OrionReport

wluther

cahunt Were you meaning that the audit trail data, for the time, is actually missing? Or, were you looking in the wrong location (Events V.S. Audit)?

newkidd2 I was under the impression cahunt looked through the logs and could not find any reference to those events. However, now that I saw your post, and re-read his, I am not sure if my original reply is related or not...

Otherwise, your report should him out.

-Will

mr.e

Hello again. I came up with a slightly better version of my previous report, in my humble opinion. The new report includes not only removed nodes but added nodes as well, again during the last 24 hours. I posted the report under the Content Exchange-->Reports section. The direct link to this page is Nodes added or deleted with username - Last 24 hrs

Best wishes.

cahunt

First off, this is why this community is so great. Life gets in the way, and the answer is waiting for me when I get back. Many thanks wluther, newkidd2, garrethcoleman, garrethcoleman, LadaVarga !! You all ROCK!

* Audit Trails is on

* I have used the 2nd report, and this is GREAT! - Though I am not seeing a spot for Node Name, I will flip this to SQL and see if I can add. All I get is the IP Address. I DID Add the username to this, so that shows in a seperate field for easy viewing.

Initially I was looking in the Audit's, I would select Node Removed and then look for the node that was removed trying to find the username attached; but that Node is not there since I was already removed from the DB... I was hoping Audit would hold the info. I started running inventory reports before each weeekend of refreshes (though I wont go over that unless there is an issue or something missing)...

I think the Events - Node removal just shows it was removed or added without the user info. So with no page for the node anymore I was forced to check the Audit.

So it appears I need to watch that Case that was opened.

I do like the first report, it reads just like the events, with no usermame. I will try both reports, turning them to SQL and trying to tie in the Node Name, or the username for each report. But this is Very Good, Awesome Job and all that Jazz!

mr.e

Thanks for the compliments. By the way, I do not think you'll be able to get a Node Name. To confirm, do the following:

Login onto your Orion server and select Start-->All Programs-->SolarWinds Orion-->Advanced Features-->Database Manager
From the Database Manager applet, click the Add default server option on the menu
Expand the tree until you find the database name (i.e. SolarWindsOrion)
Expand the Orion database and locate the AuditingEvents table
Right-click on the AuditingEvents table and scroll until you find the nodes additions or deletions (ActionTypeID 24 and 25, respectively)

If you cannot see any nodes added or deleted, I'd suggest for you to add a node to NPM and delete it shortly after. Then, you will notice that, for nodes deleted, the AuditEventMessage field does not show the Node Name, only the IP address. I believe that there is a request already for Orion to keep history of nodes even after their deletion. Until that happens, unfortunately, all you'll be able to do is look at IP addresses.

RichardLetts

Note: though you think the node is not in NCM it may still there really...

I've found that if I delete a node in NPM it stays in NCM, but unfindable through the webUI.

I have to go into the database and manually delete the entry from the database manager.

here is the query I use:

SELECT n1.agentip,n1.nodeCaptionfrom NCM.dbo.nodes n1where corenodeid not in  (select nodeid from NPM.dbo.nodes n2)

[replace NCM and NPM with your database names]

cahunt

Yeah, we had that problem when we moved over to v10. But now we do DB Sync's to bring back all the missed nodes to be able to remove them from NCM.

This is my arguement for bringing the Console Back...I would prefer to be able to add/remove nodes from either NPM or NCM as I choose... instead of having to remove NCM first and then do a DB sync. With the sync's it keeps our DB's matching.

cahunt

newkidd2 You are correct, in a first instance sort of way. And I may be wrong in the second instance. BUTT!

I have ambition to create a report using an outer join, to pull the node name from node DB..... or pull user info, and add that to the event report.

Either way, instead of adding /deleting to see the event, i filtered for the event so I could see the instances that have already been.

SELECT TOP 1000 * FROM [dbo].[AuditingEvents]
Where ActionTypeID = 25
ORDER BY TimeLoggedUtc DESC

Just set it back to normal before you close the DB Manager