Keeping track of decommissioned equipment

I use the message center for ad hoc queries, with the Node deleted audit event. You can of course put it into a report and schedule it also. 

Ok, I figured out a way to get the 7 day report...but still am having issues figuring out how to join a different table to get the node caption on the report.  Here is what I have so far...

Ok, I figured out a way to get the 7 day report...but still am having issues figuring out how to join a different table to get the node caption on the report.  Here is what I have so far...

Personally I find it easier to work this in SWQL and also it means you aren't directly interacting with the DB and possibly could cause a mistake.

Second, I think Orion.Events is probably a better table to query and you can query on EventType = '8' then. So, something like:

SELECT EventID, EventTime, NetworkNode, EngineID, EventType, Message

FROM Orion.Events

WHERE EventType = '8'
AND EventTime >= GETDATE()-7 

This includes the node name in the Message, though it isn't just the node name. If you prefer to have just the node name, then you can utilise an IMPLICIT JOIN to Orion.Nodes and do this:

SELECT EventID, EventTime, NetworkNode, EventType, e.Nodes.Caption, Message

FROM Orion.Events AS e

WHERE EventType = '8'
AND EventTime >= GETDATE()-7 

So those are basically the breadcrumbs of deleting the node.. The caption, and any other data that normally could be joined in is now deleted. The IP I thought was all that was left (in the audit or maybe event log).

I could be wrong and maybe there's something else?

We use an alert to save deleted nodes info to a .csv file on a shared drive. In addition, we run a report nightly that writes a .csv file out to the same shared drive that has our complete inventory including all custom properties. Because both files are there we can go back a retrieve all the information about a node even if it has been deleted. This has been extremely helpful on several occasions.

Those are great ideas... love it

did you got the solution for this?

Below is the query for the node caption, you can add minute as per zone time as the time recorded in the table was in UTC. Below query is as per IST.

SELECT eventtime, dateadd(minute,330,eventtime) as Deletion_date_IST
,networknode,message
FROM [dbo].[Events]
Where eventtype='8' and eventtime >= DATEADD (day, -30, getdate()) order by eventtime desc