Deleting Dead nodes...

Question

Hi,

Still onboarding but trying to capture everything, but as that will include over time laptops etc that only visited a sites once when it was being scanned, we will collect dead node.

Is there a easy way to set up auto deleting of nodes that have been down for x period of time?

Regards,

Tony.

sum_giais · Answer

I’ve implemented something similar where it was common for devices to get decommissioned and the monitoring team was always the last to know.

Nodes reporting down for greater than 7 days (that’s the alert condition) would start a ‘decommission’ process alert. The alert itself would only need to run once or maybe twice a day depending.

* Alert action (email) - notify the node has been down for 7+ days and the decommission process has started (node will be unmanaged in 7 days)
* Escalation 2:: (after 3 more days)
* Alert action (email) - notify the node has been down for 10+ days and the node will be unmanaged after 14+ days being down.
* Escalation 3:: (after 4 more days)
* Alert action (email) - notify the node has been down for 14+ days and is now unmanaged
* Alert action (run external script) - unmanage the node and set the nodes custom property ‘decommissioned_date’ to the current time/date.
* Reset condition would be a simple node is up and the reset action would be a notify that the node is up and the decommission process has been canceled

You could clearly alter the timeline and also implementation I noted above but its how we chose to get it done. We unmanaged because we wanted to ensure anything falling through that process should be removed and it wasn’t just an ignored issue.

Good luck..

bobmarley · Answer

You could use the Orion SDK and create a script to delete the nodes then use an alert action to delete them after they have been down for x number of days