System Center Orchestrator SQL: Querying Runbook Log Data

If you are using System Center Orchestrator (SCORCH)  Runbooks then you may have run into issues where the database is increasing in size due to the large amount of log files being created. This typically occurs when monitoring event logs on servers amongst some other runbook options in SCORCH.

If you want to check how many log files are in existence per each individual runbook that you have, then you can run the following SQL query on your SCORCH database.

SQL Query

SELECT COUNT(OBJECTS.Name) AS Instances,
POLICIES.Name AS Runbook, 
Objects.Name 
FROM OBJECTINSTANCEDATA
INNER JOIN OBJECTINSTANCES ON OBJECTINSTANCEDATA.ObjectInstanceID = OBJECTINSTANCES.UniqueID
INNER JOIN OBJECTS ON OBJECTINSTANCES.ObjectID = OBJECTS.UniqueID
INNER JOIN POLICIES ON OBJECTS.ParentID = POLICIES.UniqueID
GROUP BY Policies.Name,
Objects.Name
ORDER BY Instances DESC

Running this will bring back a list of your existing runbooks and the total amount of logs against each one. You can then purge logs manually or re-evaluate your automated log purge settings within the Runbook Designer Console.

More Queries

Our full range of SQL and WQL Collection queries are available our SQL & WQL query library.

Feedback

If you have any questions or feedback about this post, or if you would like us to create any queries for you, please go ahead and leave us a message below in the comments section and we will get back to you as quick as we can.

More Guides You Might Have Missed

• Resolving SCOM Console Alert Clearing Issues
• How to migrate a SCSM database
• System Center Operations Manager Invalid Management Group Removal
• Migrate a System Center Orchestrator database to a different SQL Server
• Service Manager Database Using High RAM
• SCSM – Deleting Individual Items
• SCORCH runbooks not showing in SCCM or SCSM
• Bulk Remove SCOM Management Packs
• Operations Manager – Enable agent proxy on all agents
• System Center Service Manager Data Warehouse Analysis Services installation error
• Bulk Delete Multiple Operations Manager Management Packs [2020 Updated]
• System Center Operations Manager – Apply Licence using PowerShell
• System Center Operations Manager – Pre-Requisites Powershell Script
• SCSM – How to generate a strong name signature key file to seal a Management Pack
• SCSM – How to delete all incidents