This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.
You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

Report on Muted and Unmanaged Entities

FormerMember
FormerMember

I'm looking for an SQL/SWQL query or Report that will  show all muted and/or unmanaged entities in Orion with from and to dates and the user name that has made this configuration.  Currently I have two separated reports. One provides all the audit events for unmanaged and muted entities for the last year.  The other report identifies all unmanaged nodes, interfaces and applications from Orion.  What is really needed is a way to create a single view / join to take the current unmanaged / muted inventory an add the user detail from audit to output.  If this report exists already somewhere in Orion, or if someone has solved this already please point me in the right direction.  It would seem that a report showing all muted entities and by whom. would be something all Orion Admins would find beneficial.  Thanks!  As a side note, my current unmanaged device and application report has my entities grouped by the custom field Department.  

Parents
  • This is the query I use for that,

    pastedImage_0.png

    SELECT

    'Unmanaged' as [Status]

    ,n.Caption AS [Node]

    ,tostring(tolocal(n.UnManageFrom)) AS [From]

    ,case when n.UnManageUntil is null or n.UnManageUntil = '9999-01-01 00:00:00' then 'Not set'

    else tostring(tolocal(n.UnManageUntil)) end AS [Until]

    ,case when n.UnManageUntil is null or n.UnManageUntil = '9999-01-01 00:00:00' then '-'

    else tostring(daydiff(getutcdate(), n.unmanageuntil)) end as [Days Left]

    ,n.DetailsURL AS [_LinkFor_Node]

    ,'/Orion/images/StatusIcons/Small-' + n.StatusLED AS [_IconFor_Node]

    ,CASE

    WHEN ae.accountID IS NULL THEN 'Audit Log Not Found'

    ELSE ae.AccountID

    END AS [Account]

    FROM

    Orion.Nodes n

    JOIN (

        SELECT rec.NetObjectID, max(rec.timeloggedutc) as recent

        FROM Orion.AuditingEvents rec

        WHERE rec.auditingactiontype.actiontype = 'Orion.NodeUnmanaged'

        group BY rec.NetObjectID) mostrecent ON mostrecent.NetObjectID = n.NodeID

    JOIN (

        SELECT ae.NetObjectID, ae.AccountID, ae.timeloggedutc

        FROM Orion.AuditingEvents ae

        WHERE ae.auditingactiontype.actiontype = 'Orion.NodeUnmanaged') ae ON ae.NetObjectID = n.NodeID and ae.timeloggedutc=mostrecent.recent

    WHERE n.Status = 9

    and (n.caption like '%${SEARCH_STRING}%' or ae.accountid like '%${SEARCH_STRING}%')

    union all

    (SELECT

    'Muted' as [Status]

    ,n.caption

    ,tostring(tolocal(SuppressFrom)) as [From]

    ,case when SuppressUntil is null or SuppressUntil = '9999-01-01 00:00:00' then 'Not set'

    else tostring(tolocal(SuppressUntil )) end AS [Until]

    ,case when SuppressUntil is null or SuppressUntil = '9999-01-01 00:00:00' then '-'

    else tostring(daydiff(getutcdate(), asup.SuppressUntil)) end as [Days Left]

    ,n.DetailsURL AS [_LinkFor_Node]

    ,'/Orion/images/StatusIcons/Small-' + n.StatusLED AS [_IconFor_Node]

    , ae.AccountID AS [Account]

    FROM Orion.AlertSuppression asup

    join orion.nodes n on asup.entityuri=n.uri

    join (

        SELECT ae.NetObjectID, max(ae.timeloggedutc) as recent

        FROM Orion.AuditingEvents ae

        WHERE ae.auditingactiontype.actiontype in ('Orion.AlertSuppressionChanged','Orion.AlertSuppressionAdded')

        group BY ae.netobjectid) mostrecent ON mostrecent.NetObjectID = n.NodeID

    join (

        SELECT ae.NetObjectID, ae.AccountID, ae.timeloggedutc

        FROM Orion.AuditingEvents ae

        WHERE ae.auditingactiontype.actiontype in ('Orion.AlertSuppressionChanged','Orion.AlertSuppressionAdded')

        Order BY ae.TimeLoggedUtc desc) ae ON ae.NetObjectID = n.NodeID and ae.timeloggedutc=mostrecent.recent

    where (n.caption like '%${SEARCH_STRING}%' or ae.accountid like '%${SEARCH_STRING}%')

    )

    ORDER BY [node] asc, [status] desc

  • FormerMember
    0 FormerMember in reply to mesverrum

    Super, thanks a lot! I wll definietly give this a shot!

    Typo disclaimer: Sent from my Samsung tablet

    Greg Forsthoefel

    Gforsthoefel@roomstogo.com

    Home / Office: 941-493-1300

    Mobile: 941-705-1387

Reply Children
No Data