Keeping track of decommissioned equipment

Is there a way to either see what nodes have been removed from the Solarwinds Database from week to week....or....a way to compare the Node List report from week to week to see what has changed?

  • I use the message center for ad hoc queries, with the Node deleted audit event. You can of course put it into a report and schedule it also. 

  • Ok, I figured out a way to get the 7 day report...but still am having issues figuring out how to join a different table to get the node caption on the report.  Here is what I have so far...

  • Personally I find it easier to work this in SWQL and also it means you aren't directly interacting with the DB and possibly could cause a mistake.

    Second, I think Orion.Events is probably a better table to query and you can query on EventType = '8' then. So, something like:

    SELECT EventID, EventTime, NetworkNode, EngineID, EventType, Message
    FROM Orion.Events
    WHERE EventType = '8'
    AND EventTime >= GETDATE()-7 

    This includes the node name in the Message, though it isn't just the node name. If you prefer to have just the node name, then you can utilise an IMPLICIT JOIN to Orion.Nodes and do this:

    SELECT EventID, EventTime, NetworkNode, EventType, e.Nodes.Caption, Message
    FROM Orion.Events AS e
    WHERE EventType = '8'
    AND EventTime >= GETDATE()-7 

  • So those are basically the breadcrumbs of deleting the node.. The caption, and any other data that normally could be joined in is now deleted. The IP I thought was all that was left (in the audit or maybe event log).

    I could be wrong and maybe there's something else?

Reply Children