I just fought this for a couple days. Part of my issue was that I broke the Local Profile Service in Windows, so if you've got users getting logged into TEMP profiles, that seems to break things.
Second, I found that the Windows Service Manager could start/stop the MSSQL Auditor service, and I would see logs and data getting created. You may see if that works.
Third, does domain/user have rights to the C:\Program Files (x86)\SolarWinds Log and Event Manager MSSQL Auditor\logs directory? If you start the Service in Windows, do you see logs in this directory?
Fourth, in that MSSQL Auditor folder is MSSQLAuditor.config. Are your servers and all getting saved to that file? (I had to manually edit mine with Notepad++ to get things to stick)