Perahps I am missing something obvious ... but where would I look to see when a node went unmanaged and who unmanaged it?
I'd like to add my two cents for this feature to be added too... especially when it comes to regulatory compliance. PCI, SOX, and all the other horrible abbreviations.
Knowing who what and when is a huge bonus that's just not there right now. :-)
There is an Event created when a node is managed/unmanaged, but no user detail appended.
It's an open enhancement request ().
As suggested in that thread, even appending the user name to the Event log messages (add node, delete node manage, unmanage etc) would be a great start.
Dave.
I created a report -> see attached, for unmanaged nodes. I then put this report in a view and put it in my top 10 page. you could also put it in its own view and create a menu bar option for that...I think I'm going to move to that and do a nodes and interfaces report.
only thought on the user would be very manual and procedural until ER completed...use notes in custom field and include on reports...
will add file in sec.
<Report Version="1.0" Group="Custom SQL" Title="Unmanaged Devices" Type="SQL" TypeDescription="" Icon="SQL" Schema="" SubTitle="" Description="" Footer="" Time_Frame="Named" Named_Time_Frame="Last 30 Days" Relative_Time_Frame="24 Hours" Starting_DateTime="11/15/2009 0:0:0" Ending_DateTime="12/16/2009 0:0:0" Grouping="Date" Group_Position="Beginning" SQL="Select HName, unmanagefrom, UnmanageUntil From Nodes Where Unmanaged=1 order by UnManageUntil ASC" TopX="All" TopXCount="10" TopXPercent="10" Orientation="Landscape" CookedData="TRUE" Web="TRUE" ShowFolders=""><QueryBuilder><Fields></Fields><Filter></Filter></QueryBuilder><LayoutGroups></LayoutGroups><Fields><Field Name="HName" Header="HName" Range="ALL" Parser="None" Format="" Width="0" Units="" Hidden="False" WebURL=""></Field><Field Name="unmanagefrom" Header="unmanagefrom" Range="ALL" Parser="DateTime" Format="" Width="0" Units="" Hidden="False" WebURL=""></Field><Field Name="UnmanageUntil" Header="UnmanageUntil" Range="ALL" Parser="DateTime" Format="" Width="0" Units="" Hidden="False" WebURL=""></Field></Fields></Report>
change attached from .txt to .orionreport
Hello,
I created a new view for unamanged node and use the query to get the list of unmanaged node, but error is Custom SQL filter is incorrectly formatted.
could you please suggest me where i am wrong in query to find unamaged node in new View.
Really late, but I ran into the same problem. The following can be pasted into Data Source > Advanced DataBase Query (SQL, SWQL). Select SQL. The WHERE and SORT clauses can be modified to fit your needs.
SELECT Audit.[AuditEventID]
,Audit.[TimeLoggedUtc]
,Audit.[AccountID]
,Audit.[ActionTypeID]
,ActionType.[ActionTypeDisplayName]
,Audit.[AuditEventMessage]
,Audit.[NetworkNode]
,Audit.[NetObjectID]
,Node.[DNS]
,Node.[IP_Address]
,Node.[UnManaged]
,Node.[UnManageFrom]
,Node.[UnManageUntil]
FROM [NetPerfMon].[dbo].[AuditingEvents] Audit
LEFT JOIN [NetPerfMon].[dbo].[AuditingActionTypes] As ActionType
ON Audit.[ActionTypeID] = ActionType.[ActionTypeID]
RIGHT JOIN [NetPerfMon].[dbo].[NodesData] AS Node
ON Audit.[NetworkNode] = Node.[NodeID]
WHERE
Node.[UnManaged] = '1' AND Audit.[ActionTypeID] = '27' /* Only UnManaged Nodes */
/* UnManaged Until: A look into the future */
-- UnManageUntil >= DateAdd(dd, 0, Getdate()) /* Adjust dates to review. */
-- AND (Audit.[ActionTypeID] = '26' OR Audit.[ActionTypeID] = '27') /* Managed: 26 - Unmanaged: 27 */
/* UnManaged From: A look at the past. */
-- UnManageFrom >= DateAdd(dd, -7, Getdate()) /* Adjust dates to review. */
ORDER BY Node.[UnManaged] DESC, Node.[UnManageUntil] DESC
I use a canned report for this, and put it on the front page of my NPM Summary. Change "OrionServerLocation" in the URL below to your NPM server's name/IPaddress and see if you can see what you want. You can filter from the resulting pretty intuitively.
https://OrionServerLocation/Orion/NetPerfMon/OrionMessages.aspx?ShowOrionMessageTypes=audit;
Or go to your NPM home page, Hover over Alerts & Activity, and then select the Message Center. Filter for Audit Events from your favorite time period and device/network object.
We could use something similar, but want to get only the unmanaged interfaces. Any ideas on this?
If you aren't up to modifying the SQL described here to work on the interfaces table then as an easier solution you can just use the custom table resource to show interfaces where unmanaged is true
It doesn't include the user info but if you add a "Last xx Audit Events" to your interface details page it should record that kind of thing for you, not quite as convenient as having it show up on the summary page but it's livable for people that aren't strong on the database.
I suppose that's the long way of me wanting to give you a solution without having to vpn into my lab to test SWQL haha. I might circle back to this later when I get around to connecting it again.
Thanks, very helpful. I'm going to have to play around with this for sure.
I'm trying to get my Unmanage Resource to sort by Unmanaged From. I've tried different things and it keeps erroring out. Can anyone take a look and see if they can assist?
SELECT
NodeName AS [Node Name],
'/Orion/images/StatusIcons/Small-' + StatusIcon AS [_IconFor_Node Name],
DetailsUrl AS [_LinkFor_Node Name], MAX(ToLocal(Nodes.UnmanageFrom)) AS [Unmanaged From], MAX(ToLocal(Nodes.UnmanageUntil)) AS [Unmanaged Until]
FROM Orion.Nodes
WHERE UNMANAGED = 1
GROUP BY NodeName, StatusIcon, DetailsUrl, Nodes.CustomProperties.Alert_Team, Nodes.CustomProperties.Business_Function
ORDER BY NodeName
