Trace the user login activity in SolarWinds Platform Web Console using Audit Trails

11/15/2018 3:13 PM

7/15/2025 10:24 PM

Determine the user login and logout activity using the AuditingEvents Table in Database Manager.

Orion Platform

Web Console View

1. Log in to the SolarWinds Platform Web Console using an account with administrator privileges.
2. Go to Settings > All Settings.
3. Click Web Console Settings.
4. Verify if Audit Trails is set to Enabled.
5. Navigate to Alerts & Activity > Message Center.

Database View

1. RDP to the SolarWinds Platform Server.
2. Launch the Database Manager.
   Note: Before you proceed with the Database Changes, verify that you have a backup of your SolarWinds Platform Database.
3. Locate and double click the table below:

   AuditingActionsTypes

   Refer to the following image:

8. Note the ActionTypeID (1 and 2 for the user login and user logout respectively).
9. For example, we would like to trace the login activity of the 'Admin' account. Execute on the following query:

   -- Scripts are not supported under any SolarWinds support program or service.
   -- Scripts are provided AS IS without warranty of any kind. SolarWinds further
   -- disclaims all warranties including, without limitation, any implied warranties
   -- of merchantability or of fitness for a particular purpose. The risk arising
   -- out of the use or performance of the scripts and documentation stays with you.
   -- In no event shall SolarWinds or anyone else involved in the creation,
   -- production, or delivery of the scripts be liable for any damages whatsoever
   -- (including, without limitation, damages for loss of business profits, business
   -- interruption, loss of business information, or other pecuniary loss) arising
   -- out of the use of or inability to use the scripts or documentation.
   
   SELECT TOP 1000 * FROM [dbo].[AuditingEvents]
   where actiontypeid = 1 or actiontypeid = 2 and accountid = 'admin'
   order by timeloggedutc desc

10. All activity of that particular user should be displayed as shown in the screenshot, latest first.