Submit a ticketCall us

Solarwinds & Cisco Live! Barcelona
Join us from the 29th of January to the 2nd of February at Cisco Live 2018 in Barcelona, where we will continue to show how monitoring the network with SolarWinds will keep you ahead of the game. At our booth (WEP 1A), we will demonstrate how SolarWinds network solutions can help. As a bonus, we are also hosting a pre-event webinar - Blame the Network, Hybrid IT Edition with our SolarWinds Head Geek™, Patrick Hubbard on January 24th - GMT (UTC+0): 10:00 a.m. to 11:00 a.m. There's still time to RSVP.

Home > Success Center > Network Performance Monitor (NPM) > Create scheduled report for audit events

Create scheduled report for audit events

Table of contents
Created by Roie.Exconde, last modified by MindTouch on Jun 23, 2016

Views: 1,357 Votes: 1 Revisions: 3


This article provides steps to create a scheduled report for audit events and identify who among the Orion users deleted nodes/interfaces/volumes.


All NPM versions


Create Scheduled Reports for Event Auditing:
1. Log in to your Orion SolarWinds Web Console as an administrator.
2. Under Home tab, select Reports.
3. Click the Manage Report icon (Green Pen Icon).
4. Click Schedule Manager then click Create new Schedule.
5. Assign a Schedule name (For example, audit report) .
6. Click assign report then enter audit on the search box.
7. Select the Last 100 Audit Events, then click Assign Report.
8. Click Next and Add frequency (For example, Every Friday, Weekly).
9. Under Action, select your target action (For example, email, Print or Save to a disk).
10. Once done, click Create Schedule under Summary.

Note: This report will include all the auditing activities on your Orion web console.

You can use the query below if you need to check the Orion accounts within database:

1. Open Database Manager on your Orion server.
2. Click Add default Server.
3. Expand SOLARWINDS_ORION instance.
4. Right-click on SolarWindsOrion and select New Query.
5. Paste the query below and execute:

SELECT TOP 1000 * FROM [dbo].[AuditingEvents]
where auditeventmessage like '%deleted%'

Note: Auditing event table is  [dbo].[AuditingEvents], account who performed the action is under the column AccountID.




Last modified