I see the Syslog tab log viewer. Can the items be sent to a csv file. I'm looking for a weekly consolidated report of admin actions of all devices (config changes, login successes and failures and commands used etc..). Is this possible?
I see the Syslog tab log viewer. Can the items be sent to a csv file. I'm looking for a weekly consolidated report of admin actions of all devices (config changes, login successes and failures and commands used etc..). Is this possible?
You can certainly create a report to show all your audit stuff but be warned the list can get sizeable so best to try and restrict in some manner. As an e.g. I discovered only a week or so back that SW audits group access - as in anybody that clicks on a group name. But the way it phrases it makes it sound like someone is changing stuff.
Personally I've never tried creating a report for the syslog for one prime reason - the built-in 'free' version of OLA is about as useful as a chocolate teapot. Any device changes we push off to an external syslog server so we can always grep through that.
Try this search: https://thwack.solarwinds.com/search?q=audit&group=150 and then grab and import one of the reports and then just play around with the config...
Here's a report I created to show all audit events from the last 24hrs.
SELECT AE.AuditEventID, AE.AuditingActionType.ActionTypeDisplayName, AE.TimeLoggedUtc, AE.AccountID, AE.ActionTypeID, AE.AuditEventMessage FROM Orion.AuditingEvents AS AE WHERE AE.TimeLoggedUtc >=ADDDAY(-1,GETUTCDATE())
You could extend this to 7 days by changing the -1 to -7 and then save as a report and schedule.
If you did, you'd need to be sure about all devices exporting config change traps, this can be pretty heavy. If you do have that though, then just select from the syslogs/traps where changetype
Alternately if you have them all in NCM then there's NCM change logs, totally different bit of the tool though
SolarWinds solutions are rooted in our deep connection to our user base in the THWACK® online community. More than 200,000 members are here to solve problems, share technology and best practices, and directly contribute to our product development process.