Node missing, but no audit event showing it.

Question

We've got a node that seems to have disappeared.  The last notification I have regarding it is an email from February 2019, so it must have existed in NPM until at least that date.

At some point, it was removed from NPM, somehow; not just muted or unmanaged - it's completely gone.  The audit logs that I can find do not show the event, though.

Name and IP of the node did not change.

Am I using Message Center wrong, or... ???

Unfortunately, the old notification emails for this didn't include a link to the node's page, so I have no idea what its nodeID may have been.

joepoutre · Answer

We have (at least) two devices where this happened.

Additionally, looking back using both Events and Message Center I don't see any Node Removed events, and I know I removed a node this past Sunday.

I did upgrade our Orion environment, but that removal was after the entire upgrade was completed so it should still be in the records.

Is it possible that the system drops Node Removed events?

Regards,

Joe Poutre, BNP Paribas

jaybone · Answer

Nope.  Neither searching by IP nor hostname, both of which have been the same for many years, shows any activity before my adding the node two days ago.

Even searching Event Messages - All Events, This Year (i.e. stuff would have been triggering the email alerts up until it didn't) returns nothing before two days ago.

sander_franken · Answer

If you know the IP address you can do this:

It could be that someone changed the name or something and that's the reason you can't find it. With the IP address you can just show All action types and (hopefully) you won't be overwhelmed with user actions.