This content has been marked as final. Show 5 replies
try to create a query for these events and filter them so they only apply to computers that are in group global root or so.
than create a scheduled server task with the action Purge Events. In this task you can choose to purge only the events that are part of a query of your choice, so the just created query.
think that should help.
Thanks for your reply. I've tried setting up what you described and I think I'm lost. I created a query that only lists systems in the Global Root. Then I went to the server tasks and created a new task. I don't see a Purge Events. The Purge tasks I have are
Purge Audit Log
Purge Compliance History
Purge Event Log
Purge Notification Log
Purge Rolled-up Compliance history
Purge rolled-up Systems
Purge Server Task Log
The purge event log only has an option of how old do you want to keep the log. So I tried the Run Query action and picked the query that I created and then picked delete systems. It gave an error
"Task validation failure:
Unable to create Command ComputerMgmt.delete.system in task Global Root [null] "
Am I doing something wrong? Running that query showed me that any system that I have deleted in the past has ended up there. I was only aware of 2 or 3 (that I deleted yesterday) and there are actually 19 systems in the Global Root.
Thanks for your help.
The action you choose should be of type Purge Event Log.
There you have two suboptions:
- Purge records older than 1 days
- Purge by query
Choose the latter. Than select the query you just created, and all should be working just fine.
The query i created to run is as follows:
- Result Type: Events
- Chart: Table
- Columns: Leave Default
- Filter: Assignment Path ... Equals ... GlobalRoot
I exported the query to .xml. Below are the contents of that .xml file. Copy and paste them into notepad and save the file as whatever.xml. You will than be able to import it.
Events of Deleted Systems:
<name language="nl">Events of Deleted Systems</name>
Thanks. That got rid of the events by the machines in the global root, but it didn't get rid of the machines themselves. I did however figure out why it was doing that. I found that if you delete a system and check the Remove Agent it moves the system to Global Root until the system checks in and uninstalls the agent then it deletes it completely.
Thanks for your help.
A I can imagine that!
you can offcourse use the same implementation for removing those systems as for the events using the scheduled server task "Run Query". Specify a query of choice (the one showing computers in global root), than choose Delete System as the subaction.
The downside offcourse is that the agent removal task will be deleted as well than happy