DB Search to find When something was deleted

stuartd

I dislike the Message Centre intensely.

Ignoring the fact that the screen refreshes and you have to re-start your searches, it just doesn't seem to go back beyond about a day when looking for the proverbial needle.

So, is there some way that I can search the database for what I want? I have an IP and I have an name of the device.

Specifically, I'm looking to see if there is a message relating to when it was deleted? I guess what I really need is to know, what section of teh DB to look in?

shuth

You won't be able to search by hostname or IP for a node that has been deleted in the Message Center but there will be an audit event for the node IP address being deleted.

You can either use the Message Center and filter by "Node deleted" audit events, or search the database with a SQL/SWQL query.

 

For SQL, you can look in the AuditingEvents table in the database.

For SWQL, you can look in the Orion.AuditingEvents table. Here is a quick query using the Custom Query resource showing just the deleted events but you can expand on it for other audit types.

Custom SWQL Query:

SELECT TOLOCAL(a.TimeLoggedUtc) AS [DateTime], a.AccountID, a.AuditEventMessage
FROM Orion.AuditingEvents a
WHERE a.AuditingActionType.ActionType = 'Orion.NodeDeleted'
ORDER BY [DateTime] DESC

 Search SWQL Query:

SELECT TOLOCAL(a.TimeLoggedUtc) AS [DateTime], a.AccountID, a.AuditEventMessage
FROM Orion.AuditingEvents a
WHERE a.AuditingActionType.ActionType = 'Orion.NodeDeleted'
AND (a.AccountID LIKE '%${SEARCH_STRING}%' OR a.AuditEventMessage LIKE '%${SEARCH_STRING}%')
ORDER BY [DateTime] DESC