Ability to Identify Which Devices Are Not Sending Syslogs

Question

Hello! 
 I have spent the last week attempting to comb through Thwack forums as well as create a custom SQL/SWQL script that will provide me with a list of nodes that have not reported any Syslog messages in 7 days. I had opened up a ticket with Solarwinds, and they told me that my only option was to create a script. 
 I cannot imagine that I am the only one that would like to see this sort of information. Does there exist a way to do this other than a SQL/SWQL script? 
 Thank you!

abakus · Accepted Answer

This SWQL query should work as you need, you can use it e.g. in a report: 
 SELECT NodeID, IPAddress, Caption FROM Orion.Nodes WHERE NodeID NOT IN (SELECT DISTINCT le.NodeID FROM Orion.OLM.LogEntry le JOIN Orion.OLM.LogEntryType let ON le.LogEntryTypeID = let.LogEntryTypeID WHERE let.Type = 'Syslog' AND le.DateTime BETWEEN ADDDAY(-7, GETUTCDATE()) AND GETUTCDATE()) 
 The query checks syslogs in the database, which means that the result will be nodes which either haven't sent any syslog in the last 7 days or they are not monitored by Orion (and then it doesn't matter if they have or haven't sent anything).

k_barton · Answer

I truthfully cannot thank you enough. Using your query and modifying it slightly to include some custom properties, I finally am able to report on exactly what I am looking for. Hopefully other people can find this as well, as I think it's incredibly useful.

Ability to Identify Which Devices Are Not Sending Syslogs

Top Replies