Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

Nodes added (last 24h)

Hi folks,

Trying to run a SWQL query to list all the nodes have been added for the last 24hrs, but I can't find any column under Orion.Nodes with nodes creation date!

How can we list the nodes with their creation date?

Thanks!

Find more posts tagged with

Accepted answers

Lofstrand

Something like this maybe

SELECT

E.EventTime

,Message

FROM Orion.Events AS E

WHERE

E.EventTypeProperties.Name='Node Added'

AND E.EventTime>ADDHOUR(-24,GETUTCDATE())

fchaman

Thanks for the query! @Lofstrand

HerrDoktor

as @Lofstrand mentioned the Audit Table is only available for admins.

This would be my query for "non admins"

Add the EventTypes you want to the list in the Where clause

SELECT E.EventTime

        ,E.Message      

        ,E.EventTypeProperties.Name

FROM Orion.Events AS E


WHERE E.EventTypeProperties.EventType IN (8,9,16,17,40,41,56,57,140,141,201,202,203,502,503,511,512,920,921)

  AND E.EventTime>ADDHOUR(-24,GETUTCDATE())

All comments

HerrDoktor

you need to base the query off of the events table. Maybe I can find an example query I did in the past…

fchaman

@HerrDoktor This is what we see in the events table and don't see anything related to a timestamp for a device being added:

donrobert5

How about the 4th line called EventTime? how about the 8th line(timestamp)?

Lofstrand

Something like this maybe

SELECT

E.EventTime

,Message

FROM Orion.Events AS E

WHERE

E.EventTypeProperties.Name='Node Added'

AND E.EventTime>ADDHOUR(-24,GETUTCDATE())

fchaman

Thanks for the query! @Lofstrand

HerrDoktor

you can also check the AuditingEvents Table:

SELECT  Audit.TimeLoggedUtc

        ,Audit.AccountID

        ,Audit.ActionTypeID

        ,Audit.AuditEventMessage

        ,Audit.DisplayName

FROM Orion.AuditingEvents AS Audit

WHERE Audit.ActionTypeID in (33,34) 

       AND Audit.TimeLoggedUtc >ADDHOUR(-24,GETUTCDATE())

this also includes deleted nodes. if you only want added nodes you modify the where clause to this

WHERE Audit.ActionTypeID = 33

fchaman

Excellent! This is great info! So when I ran the following query, it listed all the audit events with their Action Type for the last 30 days:

SELECT DISTINCT Audit.TimeLoggedUtc,Audit.AccountID,Audit.ActionTypeID,Audit.AuditEventMessage,Audit.DisplayName
FROM Orion.AuditingEvents AS Audit WHERE Audit.TimeLoggedUtc >ADDHOUR(-745,GETUTCDATE())

I can use the above SWQL query to display it on dashboard with any changes done to our platform! All I need to do now, is to figure out those digits associated with the change in ActionTypeID and we have a comprehensive dashboard on any changes done to our platform for the last 30 days!

What do you think?

HerrDoktor

I don’t know if you want to use a DISTINCT here. I would use the Action types to filter for events you want to see.
There is a Table with all ActionTypes I just need to find it again.

Lofstrand

Note that non-admins don't have access to the Audit tables. (At least not other accounts actions) So for non-admins a report/table with a query against the auditingevents-table will be empty or very limited.

The events-table is available though.

HerrDoktor

SELECT ActionTypeID, ActionType, ActionTypeDisplayName, OperationStatus

FROM Orion.AuditingActionTypes

This should give you all possible Audit Types.

HerrDoktor

SELECT EventType, Name, Bold, BackColor, Icon, Sort, Notify, Record, Sound, Mute, NotifyMessage, NotifySubject, OrionFeatureName

FROM Orion.EventTypes

and this should give you all possible eventTypes

HerrDoktor

as @Lofstrand mentioned the Audit Table is only available for admins.

This would be my query for "non admins"

Add the EventTypes you want to the list in the Where clause

SELECT E.EventTime

        ,E.Message      

        ,E.EventTypeProperties.Name

FROM Orion.Events AS E


WHERE E.EventTypeProperties.EventType IN (8,9,16,17,40,41,56,57,140,141,201,202,203,502,503,511,512,920,921)

  AND E.EventTime>ADDHOUR(-24,GETUTCDATE())

alphabits

I've had problems before with using "Node Added" due to it resetting when you move a node to a different polling engine. For example: Node xesx-test-sw01 added to swpol-03

When all that was done was move the node from swpol-02 to swpol-03.