This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.
You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

I'm new to . We are moving from a Cisco product to . How can I generate a weekly report of all configuration changes to our devices? I see the Syslog tab log viewer. Can the items be sent to a csv file. I'm looking a weekly report of admin actions

I see the Syslog tab log viewer. Can the items be sent to a csv file. I'm looking for a weekly consolidated report of admin actions of all devices (config changes, login successes and failures and commands used etc..). Is this possible? 

  • You can certainly create a report to show all your audit stuff but be warned the list can get sizeable so best to try and restrict in some manner.  As an e.g. I discovered only a week or so back that SW audits group access - as in anybody that clicks on a group name. But the way it phrases it makes it sound like someone is changing stuff.

    Personally I've never tried creating a report for the syslog for one prime reason - the built-in 'free' version of OLA is about as useful as a chocolate teapot. Any device changes we push off to an external syslog server so we can always grep through that. 

    Try this search: https://thwack.solarwinds.com/search?q=audit&group=150 and then grab and import one of the reports and then just play around with the config...

    Here's a report I created to show all audit events from the last 24hrs.

    SELECT 
    AE.AuditEventID, 
    AE.AuditingActionType.ActionTypeDisplayName, 
    AE.TimeLoggedUtc, 
    AE.AccountID, 
    AE.ActionTypeID, 
    AE.AuditEventMessage
    
    FROM Orion.AuditingEvents AS AE 
    
    WHERE AE.TimeLoggedUtc >=ADDDAY(-1,GETUTCDATE())

    You could extend this to 7 days by changing the -1 to -7 and then save as a report and schedule.

  • If you did, you'd need to be sure about all devices exporting config change traps, this can be pretty heavy. If you do have that though, then just select from the syslogs/traps where changetype

    Alternately if you have them all in NCM then there's NCM change logs, totally different bit of the tool though