Is there a way to either see what nodes have been removed from the Solarwinds Database from week to week....or....a way to compare the Node List report from week to week to see what has changed?
Personally I find it easier to work this in SWQL and also it means you aren't directly interacting with the DB and possibly could cause a mistake.
Second, I think Orion.Events is probably a better table to query and you can query on EventType = '8' then. So, something like:
SELECT EventID, EventTime, NetworkNode, EngineID, EventType, Message FROM Orion.Events WHERE EventType = '8' AND EventTime >= GETDATE()-7
This includes the node name in the Message, though it isn't just the node name. If you prefer to have just the node name, then you can utilise an IMPLICIT JOIN to Orion.Nodes and do this:
SELECT EventID, EventTime, NetworkNode, EventType, e.Nodes.Caption, Message FROM Orion.Events AS e WHERE EventType = '8' AND EventTime >= GETDATE()-7
So those are basically the breadcrumbs of deleting the node.. The caption, and any other data that normally could be joined in is now deleted. The IP I thought was all that was left (in the audit or maybe event log).
I could be wrong and maybe there's something else?
We use an alert to save deleted nodes info to a .csv file on a shared drive. In addition, we run a report nightly that writes a .csv file out to the same shared drive that has our complete inventory including all custom properties. Because both files are there we can go back a retrieve all the information about a node even if it has been deleted. This has been extremely helpful on several occasions.
SolarWinds solutions are rooted in our deep connection to our user base in the THWACK© online community. More than 180,000 members are here to solve problems, share technology and best practices, and directly contribute to our product development process.