Auditing report for various configurations

Question

Hey all,

I'm not new to SWQL, but this one is puzzling me.

I'm in the process of creating a Roles-based permissioned access for SolarWinds, I've gone and split them up Read-only, RO+Acknowledge Alerts, editing rights (Dashboards, Reports, Alerts, SAM templates, API Pollers etc..). I'm not entirely comfortable with giving them these edit rights, but this is what they want.

Now, in order for me to sleep at night and ensure that only the people managing their own monitoring devices update their own configurations, I wanted to put in place a SWQL query that would inform the owners when the last update was for each category; Alerts, Dashboards etc…

Does anyone know of how this can be achieved? I can see when you go into the Manage Dashboards, you get the last updated x days ago, so surely this is possible. I'd really like to know if I could also get the last person that modified it, that'd be great!

Anyway thanks for reading and many thanks in advance if you can help.

SW_United · Answer

So I've been looking at the dashboards to create these items and managed to find a few swql queries that could produce part of this report;

Alerts

SELECT

AlertID,

DisplayName,

Enabled,

Frequency,

LastEdit,

ObjectType,

CASE Severity

WHEN 1 THEN 'WARNING'

WHEN 2 THEN 'CRITICAL'

ELSE 'Other'

END AS SeverityName

FROM Orion.AlertConfigurations

Dashboards

SELECT DisplayName, LastUpdate, Owner

FROM Orion.Dashboards.Entity

Reports (not figured out the last modified date yet)

SELECT DisplayName, LimitationCategory, Name, Owner, ReportID, SubTitle, Title

FROM Orion.Report

I'm going to look for more swql queries, so will try to update this post.