First, I would suggest for you to:
- Confirm that the Enable audit trails box is checked under the Auditing Settings (Web Settings link on Admin page)
- Check on the number of days that events remain until removed. For this, go to the Polling Settings link and check the Events Retention under the Database Settings section.
Also, to prevent from missing other removals, I would suggest for you to download the Nodes Removed From Orion report to your Orion server on Thwack. Unfortunately, the report only tells you which node was removed and when. It does not tell you the username for the person who removed the node. For testing purposes, I removed node that I was testing from our Orion server.
Again, the node does not appear on the report. But, if I go to the Message Center, I can locate the name of node removed, when it was removed and who removed it (in this case, myself). So, if the Message Center does hold this information (until purged), you may want to check it out on your Orion instanace. Also, there must be a way to create a report that shows who deleted a node. I will keep checking on this, since I have a vested interest myself.
I hope this helps,