How to pipe the Node Unmanaged "reason" onto the Dashboard

Question

Hello,

On our Solarwinds dashboard we have a window which shows all currently unmanaged nodes. The table looks like the below.

Recently Solarwinds added a feature whereby the reason for unmanaging a server is recorded and can be seen when clicking on the node and viewing node details.

Is there a way to include the unmanaged reason into a dashboard window to save people from drilling into the node?

Thanks

Chris

js_ascen · Answer

Capturing the reason for unmanaging a node directly in the node's details is very helpful.  Having a single view (widget/report) of the unmanaged node(s) and their reason(s) supports audits and governance processes.  Any unmanaged node without a documented reason will trigger deeper review and corrective actions (policy being to include a reason such as a change control number when unmanaging a given node).  Thanks!

designation7of9 · Answer

Hello - Firstly thank you ever so much for the response, hugely appreciated.

I presume I just need to paste this into a Custom SWQL window? I have done that and it doesn't like something because it won't output

Is there a property that I might need to adjust for my environment or does it need formatting slightly different?

Apologies, I'm not hugely SQL savy. Thanks again for the speedy response.

bobmarley · Answer

SELECT    n.NodeID,    n.Caption,    n.IP_Address,    n.UnManaged,    n.UnManageFrom,    n.UnManageUntil,    r.ReasonFROM Orion.Nodes nLEFT OUTER JOIN(    SELECT        x.NetworkNode,        x.Reason    FROM    (        SELECT            e.NetworkNode,            e.TimeLoggedUtc,            a.ArgsValue AS Reason        FROM Orion.AuditingEvents e        INNER JOIN Orion.AuditingArguments a            ON a.AuditEventID = e.AuditEventID        WHERE a.ArgsKey = 'Reason'    ) x    INNER JOIN    (        SELECT            e2.NetworkNode,            MAX(e2.TimeLoggedUtc) AS MaxTimeLoggedUtc        FROM Orion.AuditingEvents e2        INNER JOIN Orion.AuditingArguments a2            ON a2.AuditEventID = e2.AuditEventID        WHERE a2.ArgsKey = 'Reason'        GROUP BY e2.NetworkNode    ) mx        ON mx.NetworkNode = x.NetworkNode       AND mx.MaxTimeLoggedUtc = x.TimeLoggedUtc) r    ON r.NetworkNode = n.NodeIDWHERE n.UnManaged = 1ORDER BY n.UnManageFrom DESC