Forum Discussion

SocInABox's avatar
SocInABox
Iron Contributor
Mar 14, 2021
Solved

Need a query for OMS agents NOT sending logs in the past 24 hours.

Hi there, I have a watchlist of my oms agents. I'd like to use DeviceProcessEvents to list agents that have NOT reported any processes in the past 24 hours. I don't want to use the Heartbeat table...
  • GaryBushey's avatar
    GaryBushey
    Mar 15, 2021

    SocInABox The main problem is that you won't know if one is missing unless it has sent data in the past.  So no matter whether you choose 7, 14, or 90 days, if the device has never sent data you won't know about it.

     

    I would do a comparison with the Heartbeat table and see if the devices that are not sending data show up more in there and if so do a join with that table to get a listing of the server and see if they show up in the DeviceProcessEvents table.

GaryBushey's avatar
GaryBushey
Bronze Contributor
Mar 15, 2021

SocInABox The main problem is that you won't know if one is missing unless it has sent data in the past.  So no matter whether you choose 7, 14, or 90 days, if the device has never sent data you won't know about it.

 

I would do a comparison with the Heartbeat table and see if the devices that are not sending data show up more in there and if so do a join with that table to get a listing of the server and see if they show up in the DeviceProcessEvents table.

SocInABox's avatar
SocInABox
Iron Contributor
Mar 20, 2021
you're correct Gary, thanks, I hadn't thought it through all the way.
much appreciated!

Resources