Is there a way to either see what nodes have been removed from the Solarwinds Database from week to week....or....a way to compare the Node List report from week to week to see what has changed?
I use the message center for ad hoc queries, with the Node deleted audit event. You can of course put it into a report and schedule it also.
Yeah, I was just looking at that options. It hit me after I posted the question. I guess thinking out loud sometimes helps. But in case that does not work for the Customer, I would still like to know if anyone might have a PowerShell script that could be used to compare our Node List reports?
OK, I tried none of this, but this is close to what you are thinking.
First you want to export the node list, either a scheduled report that saves a csv off to a file share (daily, weekly, monthly whatever you need), or you can run PowerShell like:
Import-Module SwisPowerShell$creds = Get-Credential$csvdata = Get-SwisData (Connect-Swis -Hostname 'Orion' -Credential $creds) -Query 'SELECT NodeID, ObjectSubType, IPAddress, Caption, Vendor FROM Orion.Nodes' -Parameters @{}$csvdata | Export-Csv -Path ''
Once you have data to compare, load the csv into objects and use the compare.
$csv1 = Import-Csv ''$csv2 = Import-Csv ''$diff = Compare-Object -ReferenceObject $csv1 -DifferenceObject $csv2$diff | Export-Csv -Path ''
You will obviously want to tweak it all to fit your needs.
Docs on how the compare works can be found at: Compare-Object (Microsoft.PowerShell.Utility) - PowerShell | Microsoft Docs since they can explain it better than I can. We only use Orion for current state data, we store historical data in the CMDB, so for us that is the best location to report from for retired assets.
We do have an open enhancement request to have a "trash bin" like function for deleted entities including the ability to remove something from trash bin if accidentally deleted.
So is there a way to create a report based on the message center messages? I dont see the options in the report creator and I am not that savy in SWQL script yet.
I have been able to create an SQL that will give me the deleted nodes in a report...but I need to know how to make it for just the last 7 days and also how to get the Node ID incorporated into the report.
@bshopp, e.g. do you mean there's existing feature requests for this or that its being actively developed?
