Writing a daily report off a specific syslog message.

bouchm

Hi,

I'm trying to determine the best approach for generating a daily report off of syslogs with the specific keyword of 'snow' in it.

Ideally the logic flow would be:

-> Syslog in -> Write to Report -> Run report from 6pm the day prior to 6am of the day of the report

If anyone has any ideas that'd be appreciated greatly.

i_like_eggs

you could use this Query i have put together just create a new report and add the below SWQL, you may want to change the headers. this query will retive the the last 24 hours worth of logs that contain the message 'snow'

SELECT 
s.Hostname as [OBJECT], 
'/Orion/images/StatusIcons/Small-' + n.StatusIcon  AS [_IconFor_OBJECT],
DateTime, 
Message,
'Syslog Chart' as [PerfStack],
n.Detailsurl as [_linkfor_OBJECT]
,'/ui/perfstack/?presetTime=last12Hours&charts=0_Orion.Nodes_' + TOSTRING(n.NodeID) + '-Orion.PerfStack.Syslog;' AS [_LinkFor_PerfStack]
FROM Orion.SysLog s
LEFT JOIN Orion.Nodes n ON n.NodeID =  s.NodeID 
WHERE s.Message LIKE '%SNOW%'  AND
datetime >= ADDHOUR(-24, GETUTCDATE())

if intrerested you can take advantage of the query in a Custom Query Widget where i have included a Syslog Chart from perfstack

once you have the report set up you can simply add the report into a schedule Creating A New Report Schedule While Creating or Editing a Report