How can I set nodes back to Default for Log Analyzer?

Question

Hi, 
 I am looking to enable All Nodes in my environment for Log Analyzer, BUT I have a few concerns: 
 If I ever want to reduce my license count I have no idea which nodes are NOT sending me logs, and therefore could be disabled. 
 How do I know when devices stop sending me logs for any reason, we are building more alert logic based on Syslog & Traps, and if a device stops sending messages for any reason that would be a concern. 
 Thoughts? 
 Currently, I could remove Nodes that don't send any logs in 15 Days (The current retention period) but depending on the logging level that might not be a true picture, as some devices will be configured only to send when required.

taylor.crowley · Answer

Hi dgsmith80 , I think I have created what you need. The following SWQL query will look for any nodes in the last 15 days where Logging is enabled on them and they have not received any logs. If a node has logging enabled but has never received any logs, the LastLogDate column will show null next to the node SELECT n.NodeID, n.Caption, o.LicenseStatus, l.LastLogDate
FROM Orion.OLM.Nodes o
INNER JOIN Orion.Nodes n ON n.NodeID = o.NodeID
LEFT JOIN (
 SELECT l.NodeID, MAX(l.DateTime) AS LastLogDate
 FROM Orion.OLM.LogEntry l
 GROUP BY l.NodeID
) l ON n.NodeID = l.NodeID
WHERE o.LicenseStatus = 'Enabled'
 AND (l.LastLogDate IS NULL OR l.LastLogDate < ADDDAY(-15, GetDate()))