Scheduled unmanage history

Hi All,

I have been searching all over for an answer, and have not been able to find one.

Is it possible to somehow see previous or old scheduled unmanaging for nodes. If for example I have a node that was scheduled for maintenance a couple of days ago, and I want to see when it started and when it ended? I have been querying our database, but without luck. In the webconsole I can see that the node was unmanaged and the remanaged by the user SYSTEM, is it possible to say with certainty that it was the scheduled job then?

Hope to get an answer here, otherwise I think I will have to create a case in the customer portal.

Find more posts tagged with

maintenance

schedule

manage

Unmanage

Accepted answers

bobmarley

Comment out the existing Where by using -- in front of it and try changing it to what is shown below to show only actions taken by the System account.

Optionally comment the Where out entirely so you get all of your events and build a new Where that fits what you need.

--WHERE AuditEventMessage LIKE '%Unmanaged node%' --AND Unmanaged = 'TRUE'

WHERE AuditEventMessage LIKE '%User system%'

All comments

bobmarley

Here is one I use, I never put the ToLocal in so the time is in UTC bit this should get you started.

SELECT TOP 100 Caption, AuditEventMessage, UnManageFrom, UnManageUntil, TimeLoggedUtc, unmanaged, NetworkNode
FROM Orion.AuditingEvents CP
INNER JOIN Orion.nodes nd on cp.NetworkNode = nd.NodeID

WHERE AuditEventMessage LIKE '%Unmanaged node%' AND Unmanaged = 'TRUE'
ORDER BY TimeLoggedUtc DESC

bobmarley

Here is with Tolocal, includes nodes that were remenaged and sorted by when it was unmanged.

SELECT TOP 100 Caption, AuditEventMessage, UnManageFrom, UnManageUntil, ToLocal (TimeLoggedUtc) as LocalTime, unmanaged, NetworkNode
FROM Orion.AuditingEvents CP
INNER JOIN Orion.nodes nd on cp.NetworkNode = nd.NodeID

WHERE AuditEventMessage LIKE '%Unmanaged node%' --AND Unmanaged = 'TRUE'
ORDER BY UnManageFrom DESC

AmSteiner

Thank you for both of those. Weirdly it does not work for showing actions done by the system account. Maybe that is on purpose.
Have you got any idea how to have that shown?

bobmarley

Comment out the existing Where by using -- in front of it and try changing it to what is shown below to show only actions taken by the System account.

Optionally comment the Where out entirely so you get all of your events and build a new Where that fits what you need.

--WHERE AuditEventMessage LIKE '%Unmanaged node%' --AND Unmanaged = 'TRUE'

WHERE AuditEventMessage LIKE '%User system%'