-
Re: What is the report to know about removed nodes.
Mark RobertsMay 17, 2018 2:48 PM (in response to raaga)
If you go to Message Centre and select Audit, you will find an entry for Group member deleted/changed/added, which should help.
General piece of advice - use Dynamic queries in groups wherever possible and where I say where ever possible, I actually mean rarely should you use static selection.
-
Re: What is the report to know about removed nodes.
raaga May 17, 2018 10:51 PM (in response to Mark Roberts)Hello Roberts,
Actually to find the removed nodes by anyone from the team, we use audit events. But when I gave all the required input to find, there were zero results.
Please let me know if you have any idea.
Thanks,
Raaga
-
image001.jpg 1.4 KB
-
Re: What is the report to know about removed nodes.
Mark RobertsMay 18, 2018 3:27 AM (in response to raaga)
Do you have other audit events being shown?
If not go to Settings > Web Settings and enable auditing in there.
If you have other audit events showing then may require a support case being raised.
-
Re: What is the report to know about removed nodes.
raaga May 18, 2018 5:15 AM (in response to Mark Roberts)In the settings page I could see that particular option as enabled. I am not able to see not even one audit event.
Thanks,
Raaga
-
Re: What is the report to know about removed nodes.
yaquaholic May 18, 2018 6:18 AM (in response to raaga)Raaga,
Have a look in the database, this SQL query (when run against your SolarWinds DB) will show all the node related events, the when, who, what and which device.
SELECT aat.ActionTypeDisplayName
,TimeLoggedUtc
,AccountID
,aud.ActionTypeID
,AuditEventMessage
,NetworkNode
,N.Caption
FROM [SolarWinds].[dbo].[AuditingEvents] aud
INNER JOIN AuditingActionTypes aat
ON aat.ActionTypeID = aud.ActionTypeID
INNER JOIN Nodes n
ON n.NodeID = aud.NetworkNode
--Look in the ActionTypeDisplayName for Group related events and then filter them down by adding a WHERE clause--
WHERE aat.ActionTypeDisplayName LIKE '%group%'
That should show you what you are looking for, if it doesn't ensure that your Web Console Settings has the following enabled (as per m_roberts suggestion):
AUDITING SETTINGS
ENABLE AUDIT TRAILS Maintain a record of web console user actions for auditing purposes. I hope it helps
Rich
-
Re: What is the report to know about removed nodes.
raaga May 18, 2018 6:34 AM (in response to yaquaholic)Thanks for the help but still I donot see any event in database manager but nodes are missing from the group.
Thanks,
Raaga
-
Re: What is the report to know about removed nodes.
yaquaholic May 18, 2018 7:15 AM (in response to raaga)If you run:
SELECT aat.ActionTypeDisplayName
,TimeLoggedUtc
,AccountID
,aud.ActionTypeID
,AuditEventMessage
,NetworkNode
,N.Caption
FROM [SolarWinds].[dbo].[AuditingEvents] aud
INNER JOIN AuditingActionTypes aat
ON aat.ActionTypeID = aud.ActionTypeID
INNER JOIN Nodes n
ON n.NodeID = aud.NetworkNode
What do you see?
If you see nothing, then try:
SELECT aat.ActionTypeDisplayName
,TimeLoggedUtc
,AccountID
,aud.ActionTypeID
,AuditEventMessage
,NetworkNode
FROM [SolarWinds].[dbo].[AuditingEvents] aud
INNER JOIN AuditingActionTypes aat
ON aat.ActionTypeID = aud.ActionTypeID
This should list all the audit events, if you are still not seeing any, then it might be time to make contact with SolarWinds Support.
-
-
-
-
Re: What is the report to know about removed nodes.
raaga May 18, 2018 6:14 AM (in response to Mark Roberts)Through database manager and from "last 100 audit events" in report writer I could see the audit messages but not from console. What would be the issue. Please let me know.
Thanks,
Raaga
-
-
-
-
Re: What is the report to know about removed nodes.
Mark RobertsMay 18, 2018 7:39 AM (in response to raaga)
Check the account you are logged in is an Admin, as this account permission is necessary to see audit events. If you are not, then this is probably why.
-
Re: What is the report to know about removed nodes.
raaga May 21, 2018 1:45 AM (in response to Mark Roberts)Thanks for the shared information. I am an admin and I do login as an admin into the application. Need to consult with Solarwinds support people.
Thanks,
Raaga
-
image001.jpg 1.4 KB
-
-