10 Replies Latest reply on May 21, 2018 1:45 AM by raaga

What is the report to know about removed nodes.

raaga May 17, 2018 9:46 AM

Hello,

I have added some nodes to a group, some of them are missing now. I would like to know whether do we have any audit report to know the removed/missing nodes.

Thanks,

Raaga

Re: What is the report to know about removed nodes.

Mark Roberts May 17, 2018 2:48 PM (in response to raaga)

If you go to Message Centre and select Audit, you will find an entry for Group member deleted/changed/added, which should help.

General piece of advice - use Dynamic queries in groups wherever possible and where I say where ever possible, I actually mean rarely should you use static selection.
Like (0)

Actions
- Re: What is the report to know about removed nodes.
  
  raaga May 17, 2018 10:51 PM (in response to Mark Roberts)
  
  Hello Roberts,
  
  Actually to find the removed nodes by anyone from the team, we use audit events. But when I gave all the required input to find, there were zero results.
  
  Please let me know if you have any idea.
  
  Thanks,
  Raaga
  
  image001.jpg 1.4 KB
  
  Like (0)
  
  Actions
  - Re: What is the report to know about removed nodes.
    
    Mark Roberts May 18, 2018 3:27 AM (in response to raaga)
    
    Do you have other audit events being shown?
    
    If not go to Settings > Web Settings and enable auditing in there.
    
    If you have other audit events showing then may require a support case being raised.
    
    Like (0)
    
    Actions
    - Re: What is the report to know about removed nodes.
      
      raaga May 18, 2018 5:15 AM (in response to Mark Roberts)
      
      In the settings page I could see that particular option as enabled. I am not able to see not even one audit event.
      
      Thanks,
      Raaga
      
      Like (0)
      
      Actions
      - Re: What is the report to know about removed nodes.
        
        yaquaholic May 18, 2018 6:18 AM (in response to raaga)
        
        Raaga,
        
        Have a look in the database, this SQL query (when run against your SolarWinds DB) will show all the node related events, the when, who, what and which device.
        
        SELECT aat.ActionTypeDisplayName
              ,TimeLoggedUtc
              ,AccountID
              ,aud.ActionTypeID
              ,AuditEventMessage
              ,NetworkNode
              ,N.Caption
        FROM [SolarWinds].[dbo].[AuditingEvents] aud
        INNER JOIN AuditingActionTypes aat
                  ON aat.ActionTypeID = aud.ActionTypeID
        INNER JOIN Nodes n
                  ON n.NodeID = aud.NetworkNode
        --Look in the ActionTypeDisplayName for Group related events and then filter them down by adding a WHERE clause--
        WHERE aat.ActionTypeDisplayName LIKE '%group%'
        
        That should show you what you are looking for, if it doesn't ensure that your Web Console Settings has the following enabled (as per m_roberts suggestion):
        
        AUDITING SETTINGS
        ENABLE AUDIT TRAILS Maintain a record of web console user actions for auditing purposes.
        
        I hope it helps
        
        Rich
        
        Like (0)
        
        Actions
        
        Re: What is the report to know about removed nodes.
        
        raaga May 18, 2018 6:34 AM (in response to yaquaholic)
        
        Thanks for the help but still I donot see any event in database manager but nodes are missing from the group.
        
        Thanks,
        
        Raaga
        
        Like (0)
        
        Actions
        
        Re: What is the report to know about removed nodes.
        
        yaquaholic May 18, 2018 7:15 AM (in response to raaga)
        
        If you run:
        SELECT aat.ActionTypeDisplayName
              ,TimeLoggedUtc
              ,AccountID
              ,aud.ActionTypeID
              ,AuditEventMessage
              ,NetworkNode
              ,N.Caption
        FROM [SolarWinds].[dbo].[AuditingEvents] aud
        INNER JOIN AuditingActionTypes aat
                  ON aat.ActionTypeID = aud.ActionTypeID
        INNER JOIN Nodes n
                  ON n.NodeID = aud.NetworkNode
        
        What do you see?
        
        If you see nothing, then try:
        
        SELECT aat.ActionTypeDisplayName
              ,TimeLoggedUtc
              ,AccountID
              ,aud.ActionTypeID
              ,AuditEventMessage
              ,NetworkNode
        FROM [SolarWinds].[dbo].[AuditingEvents] aud
        INNER JOIN AuditingActionTypes aat
                  ON aat.ActionTypeID = aud.ActionTypeID
        
        This should list all the audit events, if you are still not seeing any, then it might be time to make contact with SolarWinds Support.
        
        Like (0)
        
        Actions
    - Re: What is the report to know about removed nodes.
      
      raaga May 18, 2018 6:14 AM (in response to Mark Roberts)
      
      Through database manager and from "last 100 audit events" in report writer I could see the audit messages but not from console. What would be the issue. Please let me know.
      
      Thanks,
      
      Raaga
      
      Like (0)
      
      Actions
Re: What is the report to know about removed nodes.

Mark Roberts May 18, 2018 7:39 AM (in response to raaga)

Check the account you are logged in is an Admin, as this account permission is necessary to see audit events. If you are not, then this is probably why.
Like (1)

Actions
- Re: What is the report to know about removed nodes.
  
  raaga May 21, 2018 1:45 AM (in response to Mark Roberts)
  
  Thanks for the shared information. I am an admin and I do login as an admin into the application. Need to consult with Solarwinds support people.
  
  Thanks,
  Raaga
  
  image001.jpg 1.4 KB
  
  Like (0)
  
  Actions

Go to original post

AUDITING SETTINGS
ENABLE AUDIT TRAILS		Maintain a record of web console user actions for auditing purposes.

AUDITING SETTINGS