kal0el

As I said, SolarWinds will not provide support until they get our PO. I'm basically dead in the water.

Thanx, Phil. I would, if our PO wasn't stuck in our purchasing department. I'll try the trailing wildcard. I doubt I'll reply to this thread any more. You've been a great help, but obviously LEM is not the right tool for user audit trails.

Phil, Well, there are over 333,000 pages of results, and the one I did check had no highlighted entries. Anything else I can try? Thanx Stephen

OK - this is getting weird, or should I say stupid. I used kenneer without wildcards, and, no surprise, it said no matches. The weird thing is the username count is still 100.

Excellent. Thanx. Here's the watchlog. It didn't seem to me to give any helpful information. (Thu Feb 13 17:56:45 EST 2014) EE:ERR [RawDataServer v25600] {pool-13-thread-1:244} nDepth ManagerOutput remote socket connect failure to 10.254.10.14 Connection refused host=10.254.10.14 port=10102 proto=TCP; (Thu Feb 13 17:57:48…

Hm - I have <blue_filter_icon> User Name = <pencil_icon> *kenneer*, but when I get the blue arrow back I still have 100 usernames. ??????

We're making progress - thanx. However, it lists me out 100 usernames, and the one I'm looking for isn't there. Dragging a different username & trying to modify it doesn't work. How do I get it to list all the usernames, or just the one I want? BTW, I don't have the exact username, just part of it - I was going to use…

I thought I'd put this in a separate reply, rather than add to the last from a few minutes ago, to draw attention to it. I just had the idea to run a report to see if data is still being collected. It is. So, this looks like just an authentication issue, then. Thanx

BTW, I have "Make this Report available from the Orion website" checked.

That sounds perfect, curtisi. I'll give it a try. Thanx

OK - thank you. I am officially an idiot. I thought, when the pointer turned to double-arrows, that it was to adjust the overall window size.

Thanx for your response. Yes, you correctly understand the situation, except that support has already expired (end of January - I may have misstated that). Yes, I can get to the login page on a browser, and on SIM I see the list of appliances, but the lower right indicator says "disconnected". In fact, I can navigate to…

Thanx - didn't think of that, but, no, there are no scheduled reports. Ticket time ...

Thanx, Phil, but I'm new at this. I've tried accessing "Auditable Events (All)", "UserLogon.SourceLogonID" & "UserLogon.DestinationLogonID", using wildcards around the username, and nothing comes up. Any ideas?

DH, Yeah, pretty much. Thanx Stephen

lol - yes, I know, but while the report shows up via the website under the "Reports" option, it does not show up in the list of selectable reports for a view. First image: reports show up under Reports ("ESI-Nodes Custom Properties (blanks)" not visible) Second image: report not in Report Writer left screen ("ESI-Nodes…

Thanx for the detailed response. Unfortunately, as per my original message, when I try to select the report I want, it is not in the list of available reports. Similarly, as also stated, I imagine it's tied to the fact that when I save the report, in Report Writer, it goes to a file, instead of adding it to the left-hand…

Thanx for this. Can you point me to the documentation that instructs how to use XML in SolarWinds?

First, I want to thank all of you for your help. Second - I'm an idiot. It turns it's an old rule (written before I was brought in), and the message was from the "Reset Actions". I don't use that for anything I've created, so it never occurred to me, until this morning, to check there. Thanx again.