Export Syslog Entries

We have NPM only.

We have nodes sending a lot of syslog data to Orion. I can view this data in a screen-by-screen way using the Alerts & Activity menu at the top, and then choosing "Syslogs"

So, we have an interface flapping (quickly). Event Viewer shows the interface flap six times even though - over a period the same thirty days - the interface actually flapped thousands of times.

The syslog data shows this.

I want to export the syslog data. I know it's in the Orion or OrionLog database.

Can I export it with MSSQL? I tried doing this but was not able to find the relevant data.

Find more posts tagged with

syslog

npm

Accepted answers

jm_sysadmin

Edit: Bad link, copying the info from another thread here by @dgsmith80 and @omavel

SWQL for report or widget to try

SELECT
nod.Caption AS [Node]
,let.name AS [Message Type]
,SUBSTRING(Message,1,100) AS Message
,CONCAT('https://swm.veeam.local/Orion','/.../syslog') AS _linkfor_Message
,TOLOCAL(DateTime) AS [Log Time]

FROM Orion.OLM.LogEntry le
JOIN Orion.OLM.LogEntryType let ON le.LogEntryTypeID = let.LogEntryTypeID
JOIN Orion.Nodes nod ON le.NodeID = nod.NodeID
WHERE
Message LIKE '%login failed%'
and Node LIKE '%tac%'

ORDER BY DateTime DESC

jm_sysadmin

If you want the last day try something like:
and DateTime > ADDDAY(-1,GETDATE)

in the where statement. Other datetime functions at:

SWQL Functions · solarwinds/OrionSDK Wiki · GitHub

All comments

jm_sysadmin

Edit: Bad link, copying the info from another thread here by @dgsmith80 and @omavel

SWQL for report or widget to try

SELECT
nod.Caption AS [Node]
,let.name AS [Message Type]
,SUBSTRING(Message,1,100) AS Message
,CONCAT('https://swm.veeam.local/Orion','/.../syslog') AS _linkfor_Message
,TOLOCAL(DateTime) AS [Log Time]

FROM Orion.OLM.LogEntry le
JOIN Orion.OLM.LogEntryType let ON le.LogEntryTypeID = let.LogEntryTypeID
JOIN Orion.Nodes nod ON le.NodeID = nod.NodeID
WHERE
Message LIKE '%login failed%'
and Node LIKE '%tac%'

ORDER BY DateTime DESC

Chris-S

Thank you jm!! This is the kind of thing I am looking for, however in the SWQL studio (and in a custom report object), I get the following error, probably due to too much data.... what would be the field parameters to add a date range?

2023-03-13 13:44:17,280 [113] ERROR SolarWinds.InformationService.DataProviders.SqlQueryRelation - SWQL Studio (null) An SqlException occurred.
Message: Execution Timeout Expired. The timeout period elapsed prior to completion of the operation or the server is not responding.

Chris-S

Thanks again, jm.... I added a DateTime range and was able to pull the data I needed.

jm_sysadmin

If you want the last day try something like:
and DateTime > ADDDAY(-1,GETDATE)

in the where statement. Other datetime functions at:

SWQL Functions · solarwinds/OrionSDK Wiki · GitHub