Re: Finding out who removed a Node from NPM, when there is no log in the events, and node is not present in NCM anymore

Thanks for the compliments.  By the way, I do not think you'll be able to get a Node Name.  To confirm, do the following:

1. Login onto your Orion server and select Start-->All Programs-->SolarWinds Orion-->Advanced Features-->Database Manager
2. From the Database Manager applet, click the Add default server option on the menu
3. Expand the tree until you find the database name (i.e. SolarWindsOrion)
4. Expand the Orion database and locate the AuditingEvents table
5. Right-click on the AuditingEvents table and scroll until you find the nodes additions or deletions (ActionTypeID24 and 25, respectively)

If you cannot see any nodes added or deleted, I'd suggest for you to add a node to NPM and delete it shortly after.  Then, you will notice that, for nodes deleted, the AuditEventMessage field does not show the Node Name, only the IP address.  I believe that there is a request already for Orion to keep history of nodes even after their deletion.  Until that happens, unfortunately, all you'll be able to do is look at IP addresses.