How to map an NCM audit-event GUID to a node and review script details

NCM audit events for script execution can display an internal node GUID and the generic message executes script instead of the friendly node name and script name. The GUID must be correlated with the NCM node record, while retained script results are reviewed from Transfer Status.

Note:

The GUID is the NCM node identifier, not a NodeGuid column in the main Nodes table. NCM uses a separate node identifier that maps to the SolarWinds Platform node through CoreNodeID.

1. Copy the GUID from the audit event.

2. Use SWQL Studio or Orion API Explorer to map the NCM GUID to the friendly node name:

   -- Scripts are not supported under any SolarWinds support program or service.
   -- Scripts are provided AS IS without warranty of any kind. SolarWinds further
   -- disclaims all warranties including, without limitation, any implied warranties
   -- of merchantability or of fitness for a particular purpose. The risk arising
   -- out of the use or performance of the scripts and documentation stays with you.
   -- In no event shall SolarWinds or anyone else involved in the creation,
   -- production, or delivery of the scripts be liable for any damages whatsoever
   -- (including, without limitation, damages for loss of business profits, business
   -- interruption, loss of business information, or other pecuniary loss) arising
   -- out of the use of or inability to use the scripts or documentation.
   
   SELECT n.NodeID,
          n.Caption,
          n.IPAddress
   FROM Cirrus.Nodes AS cn
   INNER JOIN Orion.Nodes AS n
           ON cn.CoreNodeID = n.NodeID
   WHERE cn.NodeID = 'GUID_FROM_AUDIT_EVENT'

The Caption value is the friendly node name. If the entity names differ in your environment, use SWQL Studio → Object Explorer and search for the NCM or Cirrus node entity. This is a sample query and should be validated before use.

3. To review the script execution details, go to My Dashboards → Network Configuration → Configuration Management → Transfer Status. Locate the Execute Script record and click Show script results in the Status/Details column.

4. Use the audit-event username, approximate timestamp, and mapped node name to identify the corresponding transfer record.

5. If the record is no longer available, review the retention settings for the Default Database and Archive Maintenance job:

   • Go to My Dashboards → Network Configuration → Jobs.
   • Select Default Database and Archive Maintenance.
   • Review the Purge config transfer requests option and its age threshold.

   Older transfer requests can be removed by this maintenance job. If changes are required, duplicate the default job first because changes to the default job cannot be reverted.

Note:

• The NCM audit entry does not currently include the friendly node name or script name inline; manual correlation may therefore be required.