This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.

You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

Tracking the Deletion of a Node ?

stuartd over 2 years ago

Is it possible to delete a node and not see any evidence of that?

I ask, as we have a node that has gone from our setup but I can't see anything in Orion.AuditingEvents that shows that. We have events I can see in the DB up to last week where a space was removed from its name, and we have a ticket raised on our ticket mgmt platform 2 days ago from an alert on it.

But the node is not findable by any portion of its name or IP and I can't see any event in the above DB location that would imply it was deleted either.

Any ideas?

Top Replies

Parents

0 dunky2k over 2 years ago

Is there nothing listed in the message center?

If you select the 'Show audited events' and then filter on 'Node Deleted' does this show anything up?
Cancel
Vote Up +1 Vote Down

Cancel
0 stuartd over 2 years ago in reply to dunky2k

It looks like a couple of my replies at the end of last week disappeared or more likely I forgot to submit.

Anyway, tried what you suggested and whilst a few show up this one doesn't.
Cancel
Vote Up 0 Vote Down

Cancel
0 thomasdrinkwater over 2 years ago in reply to stuartd

How far back are you trying to look for this device?

If this is outside your data retention period that you keep logs for, then you will no longer have logs ... I.E if you only keep logs for 30 days... you are not going to see devices that where deleted 32 days ago ETC.

Same is applied on both the GUI and the SWQL back end database manipulation.

If you are sure that the device are looking at is within the retention period, then there will defiantly be audit events for "Add/Remove" device or something similar. ... Happy to be messaged to see if I can assist you further.
Cancel
Vote Up 0 Vote Down

Cancel
0 stuartd over 2 years ago in reply to thomasdrinkwater

Thank you ... it's no real biggie TBH, but yes definitely within our retention period. When I first posted it was less than 14 days and can see events / actions / audits on it up to and including the 6th July and then nothing.

As it is our first experience of this hopefully never to be seen again phenomenon we are putting it down to 'one of them things' but more interested really to hear if others have or suspect they have items that have disappeared without a record.
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 stuartd over 2 years ago in reply to thomasdrinkwater

Thank you ... it's no real biggie TBH, but yes definitely within our retention period. When I first posted it was less than 14 days and can see events / actions / audits on it up to and including the 6th July and then nothing.

As it is our first experience of this hopefully never to be seen again phenomenon we are putting it down to 'one of them things' but more interested really to hear if others have or suspect they have items that have disappeared without a record.
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data