Audit Log not showing user account

Good Morning All,

Apparently last week either the system or a user went in and unmanaged hundreds of nodes simultaneously (which has me thinking system). I ran an audit report and have found all the events, but there is no username associated with them. Is there a way to add username to the message center report or can I look up who last changed a node somewhere? Any help would be greatly appreciated. Management is wanting to know where to point the finger.......

Find more posts tagged with

audit

Accepted answers

Seashore

Ahh, had to read a couple of times :-)
It's not the NODE that has been unmanaged but the APPLICATION. You can unmanage on several different levels.

Adjusted the query to include "application unmanage" also.

SELECT 
    ToLocal(TimeLoggedUtc) AS [DATETIME]
    ,A.AccountID
    ,A.AuditEventMessage
    ,A.AuditingActionType.ActionTypeDisplayName
    ,A.DetailsUrl
    ,A.DisplayName
FROM Orion.AuditingEvents AS A
WHERE 
    (A.AuditingActionType.ActionType='Orion.NodeUnmanaged'
    OR A.AuditingActionType.ActionType='Orion.APM.ApplicationUnmanaged')
    AND A.TimeLoggedUtc>Getdate()-7

All comments

Seashore

Below SWQL will give you all unmanage event last 7 days. There you have user account and nodes.

!!You have to have admin access to Orion to get audit info!!

SELECT 
    ToLocal(TimeLoggedUtc) AS [DATETIME]
    ,A.AccountID
    ,A.AuditEventMessage
    ,A.DetailsUrl
    ,A.DisplayName
FROM Orion.AuditingEvents AS A
WHERE 
    A.AuditingActionType.ActionType='Orion.NodeUnmanaged'
    AND A.TimeLoggedUtc>Getdate()-7

BeegeeM

I'm not very familiar with SWQL and how to run it yet, but when I tried I am getting the following error. Do I need to be under a certain section to run the query?

Msg 195, Level 15, State 10, Line 2
'ToLocal' is not a recognized built-in function name.

Seashore

This is not a MS SQL query but a Solarwinds SWQL query. Are you using SWQL Studio to run it? You can also create a report from this query. You may also just remove the "ToLocal" part if it does not work where you try it.

Getting started with SWQL Studio:
https://support.solarwinds.com/SuccessCenter/s/article/Download-the-SolarWinds-Orion-SDK?language=en_US

BeegeeM

Got it downloaded and that worked well I think. The problem is it only pulled 2 events from the last 7 days and in the message center I have over 20 alerts that show different nodes were unmanaged. The specific alert says:

Application "URL Monitor ABC" on node "XYZ" has been unmanaged. Polling and statistics collection are suspended.

Any idea how so many items could have been unmanaged without record in the audit? These did all happen in the last 7 days.