I am trying to find an SWQL report that I can use in widget that will display all the current muted interfaces. I have been researching past threads heavily on this topic and found many where the scripts/authors had this functionality working but for some reason it no longer does. This thread for example https://thwack.solarwinds.com/t5/SAM-Discussions/Report-on-Muted-and-Unmanaged-Entities/m-p/347895/page/4
I have tried several different SWQL scripts and they all worked for muted nodes, unmanaged nodes and unmanaged interfaces, however I cant seem to find one that works for muted interfaces. This is the one I am current utilizing for unmanaged interfaces and it appears that it should report muted interfaces as well, however it fails to do so. When I mute an interface in NPM, it is not displayed as such. When I unmanage an interface it is properly displayed.
This is not my script. I am running NPM 12.4. Any help is appreciated.
SELECT
'Unmanaged' as [Status]
,n.Caption AS [Node]
,i.interfacename as [Interface]
,tostring(tolocal(i.UnManageFrom)) AS [From]
,case when i.UnManageUntil is null or i.UnManageUntil = '9999-01-01 00:00:00' then 'Not set'
else tostring(tolocal(i.UnManageUntil)) end AS [Until]
,case when i.UnManageUntil is null or i.UnManageUntil = '9999-01-01 00:00:00' then '-'
else tostring(daydiff(getutcdate(), i.unmanageuntil)) end as [Days Left]
,n.DetailsURL AS [_LinkFor_Node]
,i.DetailsURL AS [_LinkFor_Interface]
,'/Orion/images/StatusIcons/Small-' + n.StatusLED AS [_IconFor_Node]
,'/Orion/images/StatusIcons/Small-' + i.StatusLED AS [_IconFor_Interface]
,CASE
WHEN ae.accountID IS NULL THEN 'Audit Log Not Found'
ELSE ae.AccountID
END AS [Account]
FROM
Orion.npm.interfaces i
join orion.nodes n on n.nodeid=i.nodeid
JOIN (SELECT rec.NetObjectID, max(rec.timeloggedutc) as recent
FROM Orion.AuditingEvents rec
WHERE rec.AuditingActionType.ActionType = 'Orion.InterfaceUnManaged'
GROUP BY rec.NetObjectID) mostrecent ON mostrecent.NetObjectID = i.interfaceid
JOIN (SELECT ae.NetObjectID, ae.AccountID, ae.timeloggedutc
FROM Orion.AuditingEvents ae
WHERE ae.AuditingActionType.ActionType = 'Orion.InterfaceUnManaged') ae ON
ae.NetObjectID = i.interfaceid and ae.timeloggedutc=mostrecent.recent
WHERE i.Status = 9 and n.status != 9
union all
(SELECT
'Muted' as [Status]
,n.caption
,i.interfacename as [Interface]
,tostring(tolocal(SuppressFrom)) as [From]
,case when SuppressUntil is null or SuppressUntil = '9999-01-01 00:00:00' then 'Not set'
else tostring(tolocal(SuppressUntil )) end AS [Until]
,case when SuppressUntil is null or SuppressUntil = '9999-01-01 00:00:00' then '-'
else tostring(daydiff(getutcdate(), asup.SuppressUntil)) end as [Days Left]
,n.DetailsURL AS [_LinkFor_Node]
,i.DetailsURL AS [_LinkFor_Interface]
,'/Orion/images/StatusIcons/Small-' + n.StatusLED AS [_IconFor_Node]
,'/Orion/images/StatusIcons/Small-' + i.StatusLED AS [_IconFor_Interface]
, ae.AccountID AS [Account]
FROM Orion.AlertSuppression asup
join orion.npm.interfaces i on asup.entityuri=i.uri
join orion.nodes n on n.nodeid=i.nodeid
join (
SELECT ae.NetObjectID, max(ae.timeloggedutc) as recent
FROM Orion.AuditingEvents ae
WHERE ae.auditingactiontype.actiontype in ('Orion.AlertSuppressionChanged','Orion.AlertSuppressionAdded')
group BY ae.netobjectid) mostrecent ON mostrecent.NetObjectID = i.NodeID
join (
SELECT ae.NetObjectID, ae.AccountID, ae.timeloggedutc
FROM Orion.AuditingEvents ae
WHERE ae.auditingactiontype.actiontype in ('Orion.AlertSuppressionChanged','Orion.AlertSuppressionAdded')
Order BY ae.TimeLoggedUtc desc) ae ON ae.NetObjectID = i.NodeID and ae.timeloggedutc=mostrecent.recent
)
ORDER BY [node] asc, [status] desc
