Solarwinds : Audit Log not Updating

If the audit logs are not updating in Solarwinds this will signify a problem between the "Windows Message Queueing" service and RabbitMQ, this can be proved if you stop Solarwinds and restart this service then upon starting Solarwinds the audit log comes back to life for a short time.

If this is the situation then you need to follow this guide to get it back online permanently:

1. Stop all services using the Orion Service Manager (Default location: C:\Program Files (x86)\SolarWinds\Orion\StopNetPerfMon.exe) on all Orion servers  (including the 
2. Open the Database Manager (Default Location: C:\Program Files (x86)\SolarWinds\Orion\DatabaseManager.exe)
   
   Execute the following query:
   
   UPDATE [Limitations] SET WhereClause = REPLACE(REPLACE(REPLACE(CAST(WhereClause AS varchar(max)), '( (', ' ( ( '), '((', ' ( ( '),'))',' ) ) ')
   DELETE FROM [Limitations] WHERE WhereClause = '1=1'
   DELETE FROM [LimitationSnapShots]
   DELETE FROM [ContainerMemberSnapshots]
   DELETE FROM [PendingNotifications]
   DELETE FROM [SubscriptionTags]
   DELETE FROM [Subscriptions] WHERE EndpointAddress NOT LIKE 'http%'
   
   
3. Rename the following folder from db to old_db: C:\ProgramData\Solarwinds\Orion\RabbitMQ\db\
   
4. Run the Configuration Wizard
   
5. When the wizard completes, the RabbitMQ service will start automatically.

Issue still present?

When the process completes the audit log will now be resolved and will continue to work, however if this does not resolve the issue them you may be on Solarwinds 2025.1 which means you may be hitting a RabbitMQ v2 bug to resolve that you need these instructions.

This will switch you back to RabbitMQ v1 while this issue is fixed:

Note : With the variable %ProgramFiles% this will assume Solarwinds is installed to "C:\Program Files" however if Solarwinds is installed to "C:\Program Files x86" then you need the variable %ProgramFiles(x86)%

"%ProgramFiles%\SolarWinds\Orion\RabbitMQ\sbin\rabbitmqctl.bat" set_policy orion-v1 ".*" "{\"ha-mode\":\"all\",\"ha-sync-mode\":\"automatic\",\"message-ttl\":86400000,\"expires\":86400000,\"queue-version\":1}" --priority 100 --apply-to queues

"%ProgramFiles%\SolarWinds\Orion\RabbitMQ\sbin\rabbitmqctl.bat" set_policy orion-shortliving-v1 "(.@./w3wp_.)|(._Database-Maint.exe)" "{\"ha-mode\":\"all\",\"ha-sync-mode\":\"automatic\",\"message-ttl\":86400000,\"expires\":3600000,\"queue-version\":1}" --priority 110 --apply-to queues

net stop rabbitmq

rd "%ProgramData%\SolarWinds\Orion\RabbitMQ\db\rabbit@%COMPUTERNAME%-mnesia\msg_stores" /s /q

net start rabbitmq

When you have run the RabbitMQ commands do not forget to restart the Solarwinds service then your audit logs will be back online.