Auditing and Logging of changes by Users

Please add audit trails to all Solarwinds Orion products. Specifically a log of which user id adds, removes, changes, unmanages elements across products. This is a huge issue for us when researching issues as to why a alert did not go off when someone unmanaged a device. Our EOC is responsible for tracking, trending, and alerting on all systems in our enterprise and as we grow its becoming much harder to track who did what without an actual log for who made changes within the enviornment. Also, the new feature in SAM to allow for SAM administrator access is useless to me until I can track what these new administrators are doing.

Thanks,

Ean

Find more posts tagged with

Security

sam

orion

apm

npm

Auditing

Accepted answers

All comments

danielleh

Hi Ean--

Thank you for your candid feedback, I'll mark for the PM to log. Audit trails is a well-known feature request, please see this "What we are working on" post and comments below.

Thanks,
DH

Marek

I would concur, having the auditing capabilities built into every Orion product is increasingly critical, especially for larger or specialty organizations that have multiple groups using Orion and/or are subject to compliance standards [SOX, HIPPA, CIP, PCI, etc.] which can require identifying who specifically has done what, when, & the like while retaining that evidence.

For instance, I’m debating on making a post shortly regarding retaining and viewing Alerts for knowing who acknowledged something historically (after the Alert/Event has cleared), however I suspect the answer is not going to be favorable (without perhaps having to do some custom work within the SQL Server itself), as my initial research / review of posts looks like once an alert clears it is deleted from the database thus removing that evidence.

(And like a number of other / older posts - Being able to know who acknowledged an alert via Email, etc. would be very useful)

PeterLyttle

+1 for the Feature Request on Audit Trails on who acknowledged events and Added/Unmanaged devices etc.

ctopaloglu

bobteal

Yes, What Marek said. It is becoming an increasingly urgent need in our organization with a growing number of node management users activity tracking is needed!

PeterLyttle

I believe the Acknowledged Events user tracking is already in place, not sure how I missed this. Though a comment box with the Unmanage times could be useful to log a CC number or reason.