Node Remove from SolarWinds Monitoring Environment

Question

Hi Team, 
 
 Greetings...!!! 
 Is there anyway to find that by whom (user) the specific nodes are removed from the SolarWinds monitoring environments. I receive an alert yesterday, which i check that i found this as shown in the snapshot below. When i tried to search the specific mentioned IP 172.25.0.1 am unable to find it in our environment.

bobmarley · Accepted Answer

You could create a report or widget using the SWQL below 
 SELECT TOP 1000 AuditEventID, ToLocal (TimeLoggedUtc) as LocalTime, AccountID, AuditEventMessage
FROM Orion.AuditingEvents
Where AuditEventMessage LIKE '%deleted node%'
Order BY TimeLoggedUTC desc

bobmarley · Answer

SELECT TOP 1000 AuditEventID, ToLocal (TimeLoggedUtc) as LocalTime, AccountID, AuditEventMessage
FROM Orion.AuditingEvents
Where AuditEventMessage LIKE '%deleted node%' AND TimeLoggedUTC < ADDDAY(+30, GETDATE())
Order BY TimeLoggedUTC desc

donrobert5 · Answer

Check Audit logs. solarwindscore.my.site.com/.../Viewing-and-reporting-audit-events

l.mendoza · Answer

Hope this helps: 
 ** 
 DECLARE @StartDate DateTime 
 DECLARE @EndDate DateTime 
 
 -- dynamic time constraints 
 SET @StartDate = CAST (DATEADD(hour, -2160, getdate()) as datetime) 
 SET @EndDate = GetDate() 
 
 -- SQL query 
 SELECT DATEADD(hh, DATEDIFF(hh, GETUTCDATE(), GETDATE()) , AuditingEvents.TimeLoggedUtc) AS Time_Logged_Utc, AuditingEvents.AuditEventMessage AS Audit_Event_Message, AuditingActionTypes.ActionType AS Action_Type FROM AuditingActionTypes INNER JOIN AuditingEvents ON ( AuditingActionTypes.ActionTypeID = AuditingEvents.ActionTypeID ) WHERE 
 ( 
 (AuditingActionTypes.ActionType LIKE '%Orion.NodeDeleted%') 
 ) 
 AND ( TimeLoggedUtc BETWEEN @StartDate AND @EndDate ) ORDER BY 3 ASC

l.mendoza · Answer

Try this please using SQL. 
 -2160 refers to last 3 months 
 **** 
 DECLARE @StartDate DateTime 
 DECLARE @EndDate DateTime 
 
 -- dynamic time constraints 
 SET @StartDate = CAST (DATEADD(hour, -2160, getdate()) as datetime) 
 SET @EndDate = GetDate() 
 
 -- SQL query 
 SELECT DATEADD(hh, DATEDIFF(hh, GETUTCDATE(), GETDATE()) , AuditingEvents.TimeLoggedUtc) AS Time_Logged_Utc, AuditingEvents.AuditEventMessage AS Audit_Event_Message, AuditingActionTypes.ActionType AS Action_Type FROM AuditingActionTypes INNER JOIN AuditingEvents ON ( AuditingActionTypes.ActionTypeID = AuditingEvents.ActionTypeID ) WHERE 
 ( 
 (AuditingActionTypes.ActionType LIKE '%Orion.NodeDeleted%') 
 ) 
 AND ( TimeLoggedUtc BETWEEN @StartDate AND @EndDate ) ORDER BY 3 ASC

Node Remove from SolarWinds Monitoring Environment

Top Replies