This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.
You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

Exchange Event Log data in SWQL/SQL

I'm trying to create a daily report for a client that has all of the Warning and Error Exchange Event Logs for the last day on it.  I know I can put the Exchange Event Log detail resource on a report, but unfortunately you have to interact with it to get it to work.  The most it can display at once is 100 events and you also can't have it pre-configured to filter the events to only the types you want.  I would like to be able to just create a custom table (it can be SWQL or just an advanced query through the Custom Table GUI if possible) that has all of the info pre-configured and grouped by Node.  I have dug through SQL and SWQL and cannot find where the actual event messages are held.  I've found the component statistics but not the messages themselves.  Does anyone know where they are held?  (preferably in SWQL, but I'll take SQL if that's all I can get).

Thanks,


Jordan Hume

Field Systems Engineer

Loop1 Systems, Inc.

  • Wow... I found it literally seconds after posting this.  I was so busy looking in the Orion.APM.Exchange. entity tables that I didn't even notice the little old APM.WindowsEvent entity down at the bottom of the APM section of the SWQL tables...  Anyways, there it is if anybody else ever looks right over it a million times like I did.