This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.

You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

Pulling node info directly from DB

cdooer over 3 years ago

Hello. Our NPM/NTA environment has been taken completely offline by our SecOps team while they investigate the possible implications of the hack. We need to get to every device that was managed by our deployment, and change the credentials that might have been leaked. Does anyone know what SQL command might show me the node name and IP address of every device NPM was monitoring?

Also, our SecOps team has taken our databases offline...I'm not an expert in chasing malware, but is it even possible there could be anything malicious stored in the DB?

0 patrick.hubbard over 3 years ago

That's a great question, and you should be able to get the list, with the exception of passwords which are encrypted in the DB. Two questions:

1) Do you have NCM? If so those will be the network devices where Orion is backing up and/or managing the config via SSH.

2) For Nodes, are you monitoring applications as well, or just devices via SNMP?
Cancel
Vote Up 0 Vote Down

Cancel
0 cdooer over 3 years ago in reply to patrick.hubbard

Thx for the reply. No NCM, and no application monitoring. Strictly looking to get a list of node names and IP's for routers, switches, load balancers, UPS' s and PDU's.
Cancel
Vote Up 0 Vote Down

Cancel
0 vinay.by over 3 years ago

Here you go.
Connect to your SQL Box and run the below query.
SELECT Caption AS NodeName, IPAddress FROM Orion.Nodes
Export it to csv or text file, this should contain all devices that are monitored in your enviroment.
Cancel
Vote Up 0 Vote Down

Cancel
0 cdooer over 3 years ago in reply to vinay.by

Getting this error...I know nothing about SQL;
Msg 208, Level 16, State 1, Line 1
Invalid object name 'Orion.Nodes'.
Advice?
Cancel
Vote Up 0 Vote Down

Cancel
0 patrick.hubbard over 3 years ago in reply to cdooer
Perfect. This could be all you need:

SELECT NodeID, ObjectSubType, IP_Address, Caption, DNS, [SysName], Vendor, MachineType from Nodes
Cancel
Vote Up 0 Vote Down

Cancel
0 vinay.by over 3 years ago in reply to cdooer

SELECT Caption AS NodeName, IPAddress FROM Nodes
Cancel
Vote Up 0 Vote Down

Cancel