-
1. Re: Old discovered servers
Lisa KeelerNov 9, 2017 3:02 PM (in response to Matias Malpica)
oops, formatting problems in previous answer:
This query shows Hosts that have not been scanned in the past 30 days:
Search Host where last_update_success < (currentTime() - 30*24*3600*10000000)
show name, os, last_update_success, age_countChange the 30 to the number of days you want.
Lisa
-
2. Re: Old discovered servers
Andrew WatersNov 10, 2017 1:45 AM (in response to Lisa Keeler)
No that is not what the query does. What is does is show the Hosts that have not be successfully scanned in the last 30 days.
-
3. Re: Old discovered servers
Andrew WatersNov 10, 2017 1:51 AM (in response to Matias Malpica)
Why do you care about skipped if you want a list of servers not scanned in the last 7 weeks?
-
4. Re: Old discovered servers
Matias Malpica Nov 10, 2017 8:44 AM (in response to Matias Malpica)I dont, i am saying that when i pull the information from that field it seems like ADDM does not count skipped as the last time a server was scanned...
-
5. Re: Old discovered servers
manu mshm Nov 16, 2017 7:39 AM (in response to Matias Malpica)Hi Andrew,
Is it possible to use the last_update_success attribute with the discovery access? I am trying to pull a report where Discovery Access result was success anytime in last 3 days, not necessarily the last access.
Regards,
Manu
-
6. Re: Old discovered servers
Andrew WatersNov 16, 2017 8:07 AM (in response to manu mshm)
But last_update_success is the last success. You should be able to just use that.
-
7. Re: Old discovered servers
manu mshm Nov 16, 2017 8:33 AM (in response to Andrew Waters)thanks Andrew. How do I restrict my search where Discovery access is Success in the last three days?
Regards,
Manu
-
8. Re: Old discovered servers
Andrew WatersNov 16, 2017 9:30 AM (in response to manu mshm)
This is almost exactly the same as the query earlier in this thread. Just reverse the direction of the test, i.e. < becomes >
-
9. Re: Old discovered servers
manu mshm Nov 16, 2017 10:29 AM (in response to Andrew Waters)Hi Andrew,
search DiscoveryAccess where last_update_success > (currentTime() - 3*24*3600*10000000) - This doesn't fetch any results for me although there are more than 5000 plus discovery access with result as Success from yesterday's scan. Any pointers where I am going wrong?
Regards,
Manu
-
10. Re: Old discovered servers
Andrew WatersNov 16, 2017 11:13 AM (in response to manu mshm)
3 of 3 people found this helpfulI assumed you meant Hosts not DiscoveryAccesses.
Then just search DiscoveryAcccess
SEARCH DiscoveryAccess
WHERE end_state = 'GoodAccess'
AND starttime > (currentTime() - 3*24*3600*10000000)
-
11. Re: Old discovered servers
Brice-Emmanuel LoiseauxNov 16, 2017 11:41 AM (in response to Andrew Waters)
2 of 2 people found this helpfulSimilar query is:
SEARCH DiscoveryAccess
WHERE result = 'Success'
AND starttime > (currentTime() - 3*24*3600*10000000)
-
12. Re: Old discovered servers
Andrew WatersNov 16, 2017 12:07 PM (in response to Brice-Emmanuel Loiseaux)
2 of 2 people found this helpfulIt really depends upon what you are after.
The problem / advantage of checking result is that ECAErrors from patterns will not be found. GoodAccess means it basically found enough to be scanning the device.
-
13. Re: Old discovered servers
manu mshm Nov 17, 2017 12:28 AM (in response to Andrew Waters)Thanks Andrew and Brice.
Regards,
Manu
-
14. Re: Old discovered servers
manu mshm Dec 7, 2017 2:53 AM (in response to manu mshm)Hi Andrew/Brice,
While I use this query it is giving me all the success results for a endpoint in last 3 days.so if a host is all success in last 3 days it gives me 3 entries against that host.Is there a way to get just one entry against each endpoint, just the latest success ? I tried using countUnique but I have multiple columns in my query.
regards,
Manu