Alert for when devices haven't sent logs for 7 consecutive days

Strux

We discovered that some of our switches had an internal error, resulting in them not generation or sending logs for months. We would like SW to monitor this somehow.

I first tried creating an alert, but that requires a field with a date of last received log from a device, which - to my knowledge - does not exist.

Then i tried creating a report with a custom query, with help from ChatGPT, but did not succeed.

I imagine we're not the only ones with this need, so i'm wondering how others have solved this.

Thank you in advance

Lofstrand

Hi @Strux

I have such an alert ready for you. You need to use a "Custom SWQL alert" for that. Looks like this:

The code in be customizable part looks like this:

INNER JOIN

(

    SELECT

        N.Uri

    FROM Orion.Nodes as N

    WHERE

        N.CustomProperties.City='Örebro'

        AND N.NodeID NOT IN (

            SELECT

                L.NodeID

            FROM Orion.OLM.LogEntry as L

            WHERE

                L.MessageDateTime>ADDHOUR(-1,GETUTCDATE())

            GROUP BY

                L.NodeID

        )

) AS T ON Nodes.uri=T.uri

Note that this query also looks at the custom property "City", and alerts if no logs have been received for just an hour, but that you can change