Observability
Audit Events for Muting / Maintenance Actions Show “system” Instead of the Actual User After SolarWinds Platform 2025.4+ Upgrade
This article provides information about a behavioral change in the SolarWinds Platform 2025.4 release where audit events for Muting Alerts or Maintenance Mode (Unmanage/Schedule Maintenance) actions display AccountID = "system" instead of the actual user who performed the configuration. This can impact custom SQL/SWQL-based reports used for auditing user activity.
First published date
Last published date
Overview
After upgrading to SolarWinds Platform 2025.4, customers may observe that reports or queries referencing Orion.AuditingEvents show entries where the AccountID for specific maintenance-related operations appears as “system”, even when the action was initiated by a user.
This is typically seen in custom reports querying audit data for:
- Muting alerts on nodes, interfaces, or applications
- Unmanaging objects
- Changing or adding maintenance schedules
- Assigning entities to a maintenance schedule
Expected Behavior (pre-2025.4)
Audit entries such as Orion.AlertSuppressionAdded or Orion.EntityUnmanaged recorded the UserID of the person who performed the mute/unmanage action.
Observed Behavior (2025.4+)
Audit entries for maintenance execution show:
AccountID = "system"even when a user scheduled or initiated the change.
Example Customer Symptom
- Reports previously showing the user who muted a node now show “system”.
- Custom SQL/SWQL queries that correlate mute events to users return unexpected results.
Related Audit Event Action Types (examples):
When reviewing Orion.AuditingActionTypes, the following event types may be observed:
|
ActionType |
Example Behavior |
|
Orion.ScheduleAdded |
User created a maintenance schedule |
|
Orion.ScheduleChanged |
User changed a maintenance schedule |
|
Orion.ScheduleDeleted |
User deleted a schedule |
|
Orion.ScheduleExecuted |
System executed a scheduled maintenance window |
|
Orion.ScheduleAssignmentAdded |
User assigned an entity to a schedule |
|
Orion.AlertSuppressionAdded |
System applied alert suppression during a scheduled window |
|
Orion.EntityUnmanaged |
System unmanaged an entity during a scheduled window |
These reflect the updated auditing model in 2025.4.
Product section
Cause
Beginning in SolarWinds Platform 2025.4, the auditing system for Maintenance Mode and Muting Alerts was enhanced. These changes include:
- Recurring Maintenance Windows execute as automated system tasks.
- When a scheduled mute/unmanage executes automatically, the actor is correctly recorded as “system”, since the system—not the user—performed the action.
- New or modified audit event types were introduced.
- More granular events (e.g., schedule creation, assignment, execution) were added.
- ActionTypeID values differ per environment.
- ActionTypeID values are not universal and must be checked in each environment via Orion.AuditingActionTypes.
- Custom SQL/SWQL queries may no longer align with the updated audit model.
- Queries written for pre-2025.4 auditing behavior may not correctly attribute the user because the workflow is different.
This is expected behavior in 2025.4 and later and is not a product defect.
Resolution
1. Adjust Custom SQL/SWQL Queries to Account for Updated Auditing Behavior
Because auditing behavior changed, reports built on custom queries must be updated to:
- Distinguish user-initiated configuration from system-executed maintenance
- Correlate audit events such as
- Orion.ScheduleAssignmentAdded (user assigned the entity)
- Orion.AlertSuppressionAdded (system executed the mute)
Important Notes:
- Support does not provide or troubleshoot custom SQL/SWQL scripts or reports.
- The examples below are for reference only to illustrate the updated audit behavior.
- Customers must validate ActionTypeID values in their own environment.
View ActionType mappings (SQL example):
-- Scripts are not supported under any SolarWinds support program or service.
-- Scripts are provided AS IS without warranty of any kind. SolarWinds further
-- disclaims all warranties including, without limitation, any implied warranties
-- of merchantability or of fitness for a particular purpose. The risk arising
-- out of the use or performance of the scripts and documentation stays with you.
-- In no event shall SolarWinds or anyone else involved in the creation,
-- production, or delivery of the scripts be liable for any damages whatsoever
-- (including, without limitation, damages for loss of business profits, business
-- interruption, loss of business information, or other pecuniary loss) arising
-- out of the use of or inability to use the scripts or documentation.
SELECT ActionTypeID, ActionType, ActionTypeDisplayName
FROM AuditingActionTypes
ORDER BY ActionTypeID;Customers should update their queries to map the ActionTypeID values specific to their installation.
2. Determine “Who Muted the Node” Using Updated Events
To understand who is responsible for a mute, customers should check:
- User-initiated schedule assignment
(Orion.ScheduleAssignmentAdded) – indicates who configured the maintenance - System-executed mute/unmanage
(Orion.AlertSuppressionAdded, Orion.EntityUnmanaged) – indicates the automation
This is the new intended audit flow.
3. Support Scope Clarification
SolarWinds Support cannot:
- Modify, debug, or rewrite customer-created SQL/SWQL queries or reports
- Guarantee that custom queries continue functioning across product upgrades
For help adjusting custom reports:
Recommended Resources
- THWACK Community (preferred for SWQL assistance)
https://thwack.solarwinds.com/categories/solarwinds-sdk/p1 - SolarWinds Partners / Professional Services
For complex or business-critical reporting customization. - SolarWinds SDK & SWQL Studio
Useful for exploring updated entities.
https://support.solarwinds.com/SuccessCenter/s/article/Download-the-SolarWinds-Orion-SDK
Additional Notes:
- This behavioral change is expected in 2025.4 and upcoming versions, including 2026.x.
- Future releases may introduce additional audit model refinements.
- Customers should test custom reports after upgrades to ensure compatibility.