We have realtime detection enabled as recommended by Solarwinds (via syslog). When the alert is generated, the alert contains the before and after snapshot of the configuration. The first line of each configuration contains the line !Last configuration change at HH:MM:SS <timezone> <dayof week> MON DD YYYY by <username>.
↧