create SWQL query for syslog messages

here is my example of SWQL query for fetching syslog message for my switches, my switech name is start with "SW*"

SELECT TOP 25
Level AS [Severity]
,nod.Caption AS [Node]
,nod.DetailsUrl AS [_linkfor_node]
,'/Orion/images/StatusIcons/Small-' + nod.StatusIcon AS[_iconfor_node]
,TOLOCAL(DateTime) AS [Log Time]
,SUBSTRING(Message,1,100) AS Message
,CONCAT('https://solar.ficld.ir','/ui/orionlog/logviewer/now/1hours/',${NodeID},'/syslog') AS _linkfor_Message
FROM Orion.OLM.LogEntry le
JOIN Orion.OLM.LogEntryType let ON le.LogEntryTypeID = let.LogEntryTypeID
JOIN Orion.Nodes nod ON le.NodeID = nod.NodeID
where Node LIKE 'sw%' AND level not LIKE 'Notice' --match to my switch name
ORDER BY DateTime DESC

i will be happy anyone complete this code

Find more posts tagged with

swql query

syslogs

Comments

adam.beedell

In my experience SWQL is too slow to get much useful from logs. Perhaps that's just my environment

bobmarley

Thank you, I did save the query as we are upgrading soon and will need to add the new database. Will need to change some of our custom SWQL alerts to read from this one.

shuth

I found similar a while ago but haven't tried it recently. Messages from an individual node (e.g. on a Node Details view) seemed to work OK. However when trying to get summary data (e.g. counts of received messages) it was very different.

Running a SQL query for Syslog data from the OLV database would take seconds.

Running an equivalent query using SWQL would take over a minute or timeout.