Report showing user who unmanaged elements and muted alerts

Question

I have found a few threads on a similar subject, but nothing that is exactly what I want. I need a report that shows the following in a single query, or in 2 separate queries if necessary:

1. Nodes CURRENTLY Unmanaged showing when they were unmanaged, when they will be re-managed if available, and WHO did it.

2. List nodes that currently have their alerts muted, also along with who muted the alerts and when.

In each case, I need to be able to filter the report by using a particular node custom property.

Will this be a custom SWQL or SQL report? I cannot see how to include all the needed fields using Manage Reports.

Thanks for any help.

m-milligan · Accepted Answer

Great. So if you run the original query to show muted nodes, but you refer to EventTypes 55 and 56, does that produce the results you expected? Here's the revised query using your EventTypeIDs: Edited 2018-05-03 to account for variation in Orion.AuditingActionTypes.ActionTypeID across installations. Select N.Caption, Supp.SuppressFrom, Supp.SuppressUntil, LastMuteEvent.TimeLoggedUtc, AE.AccountID   from Orion.Nodes N   INNER JOIN Orion.AlertSuppression Supp on Supp.EntityUri = N.Uri   LEFT OUTER JOIN (   SELECT NetObjectID, Max(AuditEventID) as [AuditEventID], Max(TimeLoggedUtc) as [TimeLoggedUtc]   FROM Orion.AuditingEvents   where ActionTypeID in (  SELECT ActionTypeID  FROM Orion.AuditingActionTypes  where ActionType = 'Orion.AlertSuppressionAdded'  or ActionType = 'Orion.AlertSuppressionChanged'  )   group by NetObjectID   ) AS [LastMuteEvent] on LastMuteEvent.NetObjectID = N.NodeID   LEFT OUTER JOIN Orion.AuditingEvents AE on AE.AuditEventID = LastMuteEvent.AuditEventID   ORDER BY N.Caption

Report showing user who unmanaged elements and muted alerts

Top Replies