Keeping track of decommissioned equipment

I use the message center for ad hoc queries, with the Node deleted audit event. You can of course put it into a report and schedule it also. 

Yeah, I was just looking at that options.  It hit me after I posted the question.  I guess thinking out loud sometimes helps.  But in case that does not work for the Customer, I would still like to know if anyone might have a PowerShell script that could be used to compare our Node List reports? 

OK, I tried none of this, but this is close to what you are thinking. 

First you want to export the node list, either a scheduled report that saves a csv off to a file share (daily, weekly, monthly whatever you need), or you can run PowerShell like: 

Import-Module SwisPowerShell
$creds = Get-Credential
$csvdata = Get-SwisData (Connect-Swis -Hostname 'Orion' -Credential $creds) -Query 'SELECT NodeID, ObjectSubType, IPAddress, Caption, Vendor FROM Orion.Nodes' -Parameters @{}
$csvdata | Export-Csv -Path '<output file path>' 

Once you have data to compare, load the csv into objects and use the compare. 

$csv1 = Import-Csv '<path to old csv>'
$csv2 = Import-Csv '<path to new csv>'
$diff = Compare-Object -ReferenceObject $csv1 -DifferenceObject $csv2
$diff | Export-Csv -Path '<output file path>'

You will obviously want to tweak it all to fit your needs. 

Docs on how the compare works can be found at: Compare-Object (Microsoft.PowerShell.Utility) - PowerShell | Microsoft Docs since they can explain it better than I can. We only use Orion for current state data, we store historical data in the CMDB, so for us that is the best location to report from for retired assets. 

We do have an open enhancement request to have a "trash bin" like function for deleted entities including the ability to remove something from trash bin if accidentally deleted. 

So is there a way to create a report based on the message center messages?  I dont see the options in the report creator and I am not that savy in SWQL script yet. 

I have been able to create an SQL that will give me the deleted nodes in a report...but I need to know how to make it for just the last 7 days and also how to get the Node ID incorporated into the report.

Ok, I figured out a way to get the 7 day report...but still am having issues figuring out how to join a different table to get the node caption on the report.  Here is what I have so far...

Personally I find it easier to work this in SWQL and also it means you aren't directly interacting with the DB and possibly could cause a mistake.

Second, I think Orion.Events is probably a better table to query and you can query on EventType = '8' then. So, something like:

SELECT EventID, EventTime, NetworkNode, EngineID, EventType, Message

FROM Orion.Events

WHERE EventType = '8'
AND EventTime >= GETDATE()-7 

This includes the node name in the Message, though it isn't just the node name. If you prefer to have just the node name, then you can utilise an IMPLICIT JOIN to Orion.Nodes and do this:

SELECT EventID, EventTime, NetworkNode, EventType, e.Nodes.Caption, Message

FROM Orion.Events AS e

WHERE EventType = '8'
AND EventTime >= GETDATE()-7 

So those are basically the breadcrumbs of deleting the node.. The caption, and any other data that normally could be joined in is now deleted. The IP I thought was all that was left (in the audit or maybe event log).

I could be wrong and maybe there's something else?

bshopp, e.g. do you mean there's existing feature requests for this or that its being actively developed?