See which events are being collected and from where - useful for diagnosing which agents are flooding VSA with log entries, or could be refined to pick out individual events for reporting.
The reporting function within VSA can show this data but not very well so it's much easier to view it directly from the DB and format the results however you choose.
The query below selects only the latest 30,000 log entries from the last 1 hour and combines the Machine Name and Group Name into a single entry:
SELECT TOP 30000 [machName]+'.'+[groupName] AS MachineAndGroup,[eventTime],eventId,EventCategory,NEWID() AS id
FROM [ksubscribers].[dbo].[vNtEventLog]
WHERE [eventTime] >= DATEADD(hh,-1,GETDATE())
Comments
0 comments