Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

List of Muted Applications Report?

Hello all -

I have a custom dashboard that lists all currently muted nodes. I'd like this exact same functionality for muted application monitors.

Does anyone have a SQL/SWQL query that pulls this info?

Thanks,

Find more posts tagged with

Accepted answers

All comments

Jason.Henson

Any chance you figured out this query?

SteveK

This is what we are using. It gives the information for both maintenance mode and muted. It also queries the logs to try and record who did it.

SELECT [A].Name As Application
    , [A].DetailsUrl As ApplicationURL
    , [A].Status As ApplicationStatus
    , [N].Caption As Node
    , [N].DetailsUrl As NodeURL
    , [N].Status As NodeStatus
    , [A].UnManaged
    , CASE
        WHEN ([A].UnManaged = 'TRUE' AND [M].SuppressFrom IS Not Null) THEN 'Muted,Unmanaged'
        WHEN ([A].UnManaged = 'TRUE' AND [M].SuppressFrom IS Null) THEN 'Unmanaged'
        WHEN ([A].UnManaged = 'FALSE' AND [M].SuppressFrom IS Not Null) THEN 'Muted'
        END AS Status
    , CASE
        WHEN [A].UnManaged = 'TRUE' THEN TOLocal([A].UnmanageFrom)
        ELSE NULL
        END As Unmanage_Start
    , CASE
        WHEN [A].UnManaged = 'TRUE' THEN TOLocal([A].UnManageUntil)
        ELSE NULL
        END As Unmanage_End
    , [M].SuppressFrom As Mute_Start
    , [M].SuppressUntil AS Mute_End
    , CASE
        WHEN [AEMute].accountID IS NULL AND [AEUnmanage].accountID IS NULL THEN 'Audit Log Not Found'
        WHEN [A].UnManaged = 'TRUE' AND [M].SuppressFrom IS Not Null THEN CONCAT([AEMute].AccountID, '|',[AEUnmanage].accountID)
        WHEN [A].UnManaged = 'TRUE' AND [M].SuppressFrom IS Null THEN [AEUnmanage].accountID
        ELSE [AEMute].AccountID
    END AS [Account]
FROM Orion.APM.Application [A]
    Left OUTER JOIN Orion.Nodes [N] on [A].NodeID = [N].NodeID
    LEFT OUTER JOIN Orion.AlertSuppression [M] on [A].Uri = [M].EntityUri
LEFT OUTER JOIN (
    SELECT 
    [AE].NetObjectID
    , case 
        when CHARINDEX('unmanaged application',[AE].AuditEventMessage) > 0 then
            substring([AE].AuditEventMessage,CHARINDEX('unmanaged application',[AE].AuditEventMessage) + 22, CHARINDEX('on node',[AE].AuditEventMessage) - CHARINDEX('unmanaged application',[AE].AuditEventMessage) - 23) 
        else [AE].AuditEventMessage 
    end as ApplicationName
    , max([AE].timeloggedutc) as recent
    FROM Orion.AuditingEvents [AE]
    WHERE [AE].NetObjectType = 'N' AND [AE].auditingactiontype.actiontype in ('Orion.APM.ApplicationUnmanaged')
    GROUP BY 
    [AE].netobjectid
    , case 
        when CHARINDEX('unmanaged application',[AE].AuditEventMessage) > 0 then
            substring([AE].AuditEventMessage,CHARINDEX('unmanaged application',[AE].AuditEventMessage) + 22, CHARINDEX('on node',[AE].AuditEventMessage) - CHARINDEX('unmanaged application',[AE].AuditEventMessage) - 23) 
        else [AE].AuditEventMessage 
    end) [mostrecentunmanage] ON [mostrecentunmanage].NetObjectID = [N].NodeID AND [mostrecentunmanage].ApplicationName = [A].Name
LEFT OUTER JOIN (
    SELECT [AE].NetObjectID, [AE].AccountID, [AE].timeloggedutc, [AE].AuditEventMessage
    FROM Orion.AuditingEvents [AE]
    WHERE [AE].NetObjectType = 'N' AND [AE].auditingactiontype.actiontype in ('Orion.APM.ApplicationUnmanaged')
    ORDER BY [AE].TimeLoggedUtc desc) [AEUnmanage] ON [AEUnmanage].NetObjectID = [N].NodeID and [AEUnmanage].timeloggedutc=[mostrecentunmanage].recent
LEFT OUTER JOIN (
    SELECT [AE].NetObjectID, max([AE].timeloggedutc) as recent
    FROM Orion.AuditingEvents [AE]
    WHERE [AE].NetObjectType = 'AA' AND [AE].auditingactiontype.actiontype in ('Orion.AlertSuppressionChanged','Orion.AlertSuppressionAdded')
    GROUP BY [AE].netobjectid) [mostrecentmute] ON [mostrecentmute].NetObjectID = [A].ApplicationID
LEFT OUTER JOIN (
    SELECT [AE].NetObjectID, [AE].AccountID, [AE].timeloggedutc, [AE].AuditEventMessage
    FROM Orion.AuditingEvents [AE]
    WHERE [AE].NetObjectType = 'AA' AND [AE].auditingactiontype.actiontype in ('Orion.AlertSuppressionChanged','Orion.AlertSuppressionAdded')
    ORDER BY [AE].TimeLoggedUtc desc) [AEMute] ON [AEMute].NetObjectID = [A].ApplicationID and [AEMute].timeloggedutc=[mostrecentmute].recent

WHERE 1 = 1
    AND (
            [A].UnManaged = 'TRUE'
            OR [M].SuppressFrom IS NOT NULL
        )
    AND [N].UnManaged = 'False'
    And 2=2
ORDER BY Unmanage_Start, Mute_Start