This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.
You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

Keeping track of decommissioned equipment

Is there a way to either see what nodes have been removed from the Solarwinds Database from week to week....or....a way to compare the Node List report from week to week to see what has changed?

Parents
  • I use the message center for ad hoc queries, with the Node deleted audit event. You can of course put it into a report and schedule it also. 

  • Ok, I figured out a way to get the 7 day report...but still am having issues figuring out how to join a different table to get the node caption on the report.  Here is what I have so far...

  • Personally I find it easier to work this in SWQL and also it means you aren't directly interacting with the DB and possibly could cause a mistake.

    Second, I think Orion.Events is probably a better table to query and you can query on EventType = '8' then. So, something like:

    SELECT EventID, EventTime, NetworkNode, EngineID, EventType, Message
    
    FROM Orion.Events
    
    WHERE EventType = '8'
    AND EventTime >= GETDATE()-7 

    This includes the node name in the Message, though it isn't just the node name. If you prefer to have just the node name, then you can utilise an IMPLICIT JOIN to Orion.Nodes and do this:

    SELECT EventID, EventTime, NetworkNode, EventType, e.Nodes.Caption, Message
    
    FROM Orion.Events AS e
    
    WHERE EventType = '8'
    AND EventTime >= GETDATE()-7 

  • So those are basically the breadcrumbs of deleting the node.. The caption, and any other data that normally could be joined in is now deleted. The IP I thought was all that was left (in the audit or maybe event log).

    I could be wrong and maybe there's something else?

  • We use an alert to save deleted nodes info to a .csv file on a shared drive. In addition, we run a report nightly that writes a .csv file out to the same shared drive that has our complete inventory including all custom properties. Because both files are there we can go back a retrieve all the information about a node even if it has been deleted. This has been extremely helpful on several occasions.

  • Those are great ideas... love it

  • did you got the solution for this?

  • Below is the query for the node caption, you can add minute as per zone time as the time recorded in the table was in UTC. Below query is as per IST.

    SELECT eventtime, dateadd(minute,330,eventtime) as Deletion_date_IST
    ,networknode,message
    FROM [dbo].[Events]
    Where eventtype='8' and eventtime >= DATEADD (day, -30, getdate()) order by eventtime desc

Reply
  • Below is the query for the node caption, you can add minute as per zone time as the time recorded in the table was in UTC. Below query is as per IST.

    SELECT eventtime, dateadd(minute,330,eventtime) as Deletion_date_IST
    ,networknode,message
    FROM [dbo].[Events]
    Where eventtype='8' and eventtime >= DATEADD (day, -30, getdate()) order by eventtime desc

Children
No Data