How to get the top devices sending Syslog/Trap messages for the past 24 hours

With this SQL query you can see 24 hours of data by host, MessageType, and count.
(Also applicable for Trap Tables)

select hostname, COUNT(Msgid) as total from Syslog
where DateTime>DATEADD(day, -1, GETDATE() )
group by hostname
order by total, hostname desc

select nodeid, hostname, SysLogFacility, SysLogSeverity, COUNT(Msgid) as total from Syslog
where DateTime>DATEADD(day, -1, GETDATE() )
group by nodeid, hostname, SysLogFacility,SysLogSeverity
order by total, hostname, SysLogFacility,SysLogSeverity desc

Find more posts tagged with

Accepted answers

All comments

Littlebee_26

Just an update, here is the SQL query for Trap messages:

select nodeid, IPAddress, TrapType, Message, COUNT(TrapID) as total from Traps

where DateTime>DATEADD(day, -1, GETDATE() )

group by nodeid, IPAddress, TrapType, Message

order by total, IPAddress, TrapType, Message desc

Quick Links

All Categories
Recent Posts
Activity
Unanswered
Groups
Help
Best Of