This THWACK article explains how to create a custom report based on Audit Events / Auditing Events that lists deleted nodes, interfaces, and volumes over a chosen time range, and how to make the report dynamic for rolling time windows (for example, the last 30 or 60 days).
Resolution
- Navigate to Reports → All Reports → Manage Reports → Click on add New Report.
- Choose Custom Table for the layout.
- In the Custom Table resource, click Edit Table → Edit Data Source.
- For "I want to report on", select "Auditing Events" (same data source used for “Node Added” audit reports).
- Add conditions/filters:
- Field: Action Type
- Operator: is equal to
- Values: add one row each for:
- Node deleted
- Interface deleted
- Volume deleted
- (Use “OR” between them.)
- Field: Time Logged
- Use either:
- is between → set your exact From and to dates, or
- is less than (X days ago) / is greater than (X days ago) style filters for rolling windows (similar to the “Node Added” audit report example).
- In Columns, add at least:
- Time Logged
- Account ID (who performed the delete)
- Action Type
- Audit Event Message (contains text like “User X deleted node Y…”)
- Optional: NetObjectType, Display Name, NetworkNode, NetObjectID, DetailsUrl, Display name, Site Hostname for drilldowns.
- Save and run the report; schedule/email it if needed (e.g., daily/weekly).
- On the Manage Reports page, configure a schedule to have the report emailed or exported automatically (for example, daily or weekly) so you always have an updated record of recent deletions. (Optional)
