System Center Orchestrator – SQL Query to show log file data
If you are using System Center Orchestrator (SCORCH) Runbooks then you may have run into issues where the database is increasing in size due to the large amount of log files being created. This typically occurs when monitoring event logs on servers amongst some other runbook options in SCORCH.
If you want to check how many log files are in existence per each individual runbook that you have, then you can run the following SQL query on your SCORCH database.
SELECT COUNT(OBJECTS.Name) AS Instances,
POLICIES.Name AS Runbook,
INNER JOIN OBJECTINSTANCES ON OBJECTINSTANCEDATA.ObjectInstanceID = OBJECTINSTANCES.UniqueID
INNER JOIN OBJECTS ON OBJECTINSTANCES.ObjectID = OBJECTS.UniqueID
INNER JOIN POLICIES ON OBJECTS.ParentID = POLICIES.UniqueID
GROUP BY Policies.Name,
ORDER BY Instances DESC
Running this will bring back a list of your existing runbooks and the total amount of logs against each one. You can then purge logs manually or re-evaluate your automated log purge settings within the Runbook Designer Console.
If you have any questions on this guide or any feedback you wish to share, then please feel free to leave a message below and we will try to get back to you as soon as we can.