Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

What SWQL table is the Maintenance mode "Reason" saved?

I just noticed where I can fill in a "Reason" field for when putting a node Maintenance mode to mute alerts or stop managing the node.

I'd like to include that field value in some of my custom SWQL queries.

Where is it exposed via SWQL so I can find it using SWQL Studio?

Find more posts tagged with

SWQL

Accepted answers

All comments

cnorborg

Orion.ScheduleTaskDefinition under the column "Reason"

brianbooher

Thanks so much. I found it. Now to figure out how to associate that table with the node to which it applies.

-Brian

brianbooher

I'm kinda stumped. I do a daily report showing what nodes are muted or management is disabled and I'd like to include the contents of this "Reason" column. But I cannot for the life of me figure out how to link this value back to the node.

cnorborg

Hmm… That is rather confusing. The only way I can think of doing it is to use the EntityURI in the ScheduleEntityAssignments and delete everything up to and including the "=" which will leave you with the NodeID. You can probably do this easier by doing a string comparison and looking for something like '%=12345" where 12345 is the NodeID. There is a join already there in the ScheduleTaskDefinition, so you can just use that link to get there. Something like this seems to return all the Nodes that have a "Reason" in this table. Should help a bit?

SELECT N.NodeID, N.Caption, STD.Reason, STD.Assignments.EntityUri

FROM Orion.Nodes N

JOIN Orion.ScheduleTaskDefinition STD ON (STD.Assignments.EntityUri LIKE ('%=' + ToString(N.NodeID)))

brianbooher

Here's the custom query I use to show all the nodes that have been muted (we would mute and forget to unmute so we were missing alerts)

SELECT T2.Caption AS [Node],'/Orion/images/StatusIcons/Small-' + T2.statusIcon as [_IconFor_Node], T2.detailsurl as [_LinkFor_Node], T2.IPAddress, CASE WHEN t1.SuppressUntil IS NULL THEN 'Forever' ELSE concat(Month(T1.SuppressUntil),'/',Day(T1.SuppressUntil),'/',YEAR(T1.SuppressUntil)) END AS MuteUntil
FROM Orion.AlertSuppression T1
join Orion.Nodes T2
on T1.entityuri= T2.Uri
Order by T2.caption

and here is a custom query for unmanaged nodes. Here I can simply look in the orion.Nodes table:

SELECT T2.Caption AS [Node],'/Orion/images/StatusIcons/Small-' + T2.statusIcon as [_IconFor_Node], T2.detailsurl as [_LinkFor_Node], T2.IPAddress,
CASE when YearDiff(GetDate(),T2.UnManageUntil) >5000 then 'Forever'
ELSE ToString(T2.UnManageUntil)
end AS [UnManage Until]
FROM Orion.Nodes T2
where T2.UnManaged != False
Order by T2.caption

In both cases I'd like to put the reason in an additional column but it's gonna be a stinky query.

bourlis

I don't know how far you are on your journey, but I shared a modern dashboard for suppressed alerts that you might want to look at.

Global Suppressed Alerts Dashboard - THWACK

I also posted to this thread where I supplied info on a Node Details widget that shows the start|end dates of the muted|unmanaged node

"Nodes Currently Muted" report broke after 2025.4.0 upgrade - THWACK

FYI.. you can easily take the SQWL query from the dashboard and turn it into a daily report.

brianbooher

Thanks for the input. This Custom Query lives on my main dashboard which isn't yet a "Modern Dashboard" so I must use a Custom Query object and put a SWQL query into it. I'll try and extract the SWQL from the text file you shared.

For the 2nd report, you. didn't include the Reason, which I believe is new as of 2025.4.1 (at least I only just noticed it).

Thanks again for your information.

-Brian

cnorborg

This question brought up a lot more questions for me. I currently have 6 devices unmanaged, which all show up in my query, but only 2 show up using your query. I think it has to do with your base table, the one that isn't joined, is an Alert table. I think the other nodes that are unmanaged in mine never generated an alert, so they don't show up using your query. If that's what you want, cool, but you might be missing things.

I did modify your query to incorporate mine, not too hard. I had to do a LEFT OUTER JOIN because none of the 2 nodes that show up in your query have Reasons or entries in the table I was using.

SELECT T2.Caption AS [Node],'/Orion/images/StatusIcons/Small-' + T2.statusIcon as [_IconFor_Node], T2.detailsurl as [_LinkFor_Node], T2.IPAddress, CASE WHEN t1.SuppressUntil IS NULL THEN 'Forever' ELSE concat(Month(T1.SuppressUntil),'/',Day(T1.SuppressUntil),'/',YEAR(T1.SuppressUntil)) END AS MuteUntil, STD.Reason
FROM Orion.AlertSuppression T1
join Orion.Nodes T2 on T1.entityuri= T2.Uri
LEFT OUTER JOIN Orion.ScheduleTaskDefinition STD ON (STD.Assignments.EntityUri LIKE ('%=' + ToString(T2.NodeID)))
Order by T2.caption

brianbooher

Let me check that out. I had separate custom queries, one for muted and one for unmanaged. While it's possible to both "unmange" and "mute" nodes, if you unmanaged a node it is also muted. I like how your query combined both into a single table and I plan to implement that in the single custom query rather than the two I do now.

I wonder if you both mute and unmanaged some of your objects but not others. The query of mine that you showed above would only find muted nodes.

-Brian

cnorborg

Let us know your results! Note, that since this results field just sprouted up not too long ago, I'm thinking there is a chance in the next SDK that they might try and make this easier. Or, you could always point out to support how difficult it is to relate this and see if they give us a nice NodeID or something to make things easier in the future..

brianbooher

So I have a new query, based on yours, that does what I want and includes the Reason for muting or unmanaging:

SELECT
n.Caption AS [Node],'/Orion/images/StatusIcons/Small-' + n.statusIcon as [_IconFor_Node], n.detailsurl as [_LinkFor_Node],
CASE

when s.ScheduleTask.AccountID is NULL then ''

ELSE s.ScheduleTask.AccountID 

END as [Supressed By]

, CASE

WHEN n.UnManaged != 'False' then 'Unmanaged'

ELSE ''

END as [Unmanaged]

, CASE

WHEN n.UnManaged <> 'False' then TOSTRING(TOLOCAL(n.UnManageFrom))

ELSE ''

END as [Start Unmanage]

, CASE
WHEN YearDiff(GetDate(),n.UnManageUntil) >5000 then 'Forever'
WHEN YearDiff(GetDate(),n.UnManageUntil) <50 then ''

ELSE TOSTRING(TOLOCAL(n.UnManageUntil))

END as [End Unmanage]

, CASE

when z.ID like '%' then 'Muted'

ELSE ''

END as [Muted]

, CASE

when z.SuppressFrom is NULL then ''

ELSE TOSTRING(TOLOCAL(z.SuppressFrom))

End AS [Start Mute]

, CASE

WHEN z.SuppressUntil is NULL then 'Forever'

ELSE TOSTRING(TOLOCAL(z.SuppressUntil))

End AS [End Mute]

,CASE
WHEN s.ScheduleTask.Reason IS NULL THEN ''
ELSE TOSTRING(S.ScheduleTask.Reason)
END AS [Reason]

FROM Orion.Nodes AS n

left join Orion.ScheduleEntityAssignment s on n.uri = s.EntityUri

left JOIN orion.AlertSuppression z on N.Uri = Z.EntityUri

WHERE NodeID=${nodeid}

and (s.ScheduleTask.Enabled = 'TRUE'

and (s.ScheduleTask.NextRun is NOT NULL) 

or (n.UnManaged != 'False') 

or (z.ID like '%'))

order by n.Caption

Thank you very much for your ideas and suggestions in this.

-Brian

cnorborg

Awesome! I think we both learned a bit on this one…