solarwinds-orion-filtersyntaxguide

FILTER SYNTAX GUIDE

SolarWinds® Orion® Filter Syntax Guide

SolarWinds Orion Filter Syntax Guide Administrator Guide

ii SolarWinds Orion Network Performance Monitor Documentation Library

Copyright© 1995-2010 SolarWinds, Inc. all rights reserved worldwide. No part of this document may be reproduced by any means nor modified, decompiled, disassembled, published or distributed, in whole or in part, or translated to any electronic medium or other means without the written consent of SolarWinds All right, title and interest in and to the software and documentation are and shall remain the exclusive property of SolarWinds and its licensors. SolarWinds Orion™, SolarWinds Cirrus™, and SolarWinds Toolset™ are trademarks of SolarWinds and SolarWinds.net® and the SolarWinds logo are registered trademarks of SolarWinds All other trademarks contained in this document and in the Software are the property of their respective owners. SOLARWINDS DISCLAIMS ALL WARRANTIES, CONDITIONS OR OTHER TERMS, EXPRESS OR IMPLIED, STATUTORY OR OTHERWISE, ON SOFTWARE AND DOCUMENTATION FURNISHED HEREUNDER INCLUDING WITHOUT LIMITATION THE WARRANTIES OF DESIGN, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL SOLARWINDS, ITS SUPPLIERS OR ITS LICENSORS BE LIABLE FOR ANY DAMAGES, WHETHER ARISING IN TORT, CONTRACT OR ANY OTHER LEGAL THEORY EVEN IF SOLARWINDS HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. Microsoft®, Windows 2000 Server®, Windows 2003 Server®, and Windows 208 Server® are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries. Graph Layout Toolkit and Graph Editor Toolkit © 1992 - 2001 Tom Sawyer Software, Oakland, California. All Rights Reserved. Portions Copyright © ComponentOne, LLC 1991-2002. All Rights Reserved. Orion Filter Syntax Guide, Revised 8.19.2010


About SolarWinds iii

About SolarWinds SolarWinds, Inc develops and markets an array of network management, monitoring, and discovery tools to meet the diverse requirements of today’s network management and consulting professionals. SolarWinds products continue to set benchmarks for quality and performance and have positioned the company as the leader in network management and discovery technology. The SolarWinds customer base includes over 45 percent of the Fortune 500 and customers from over 90 countries. Our global business partner distributor network exceeds 100 distributors and resellers.

Contacting SolarWinds You can contact SolarWinds in a number of ways, including the following:

Team Contact Information

Sales

[email protected] www.solarwinds.com 1.866.530.8100 +353.21.5002900

Technical Support www.solarwinds.com/support

User Forums www.thwack.com

http://www.solarwinds.net/�

http://www.solarwinds.net/support�

http://www.thwack.com/�


iv SolarWinds Orion Network Performance Monitor Documentation Library

Conventions The documentation uses consistent conventions to help you identify items throughout the printed and online library.

Convention Specifying

Bold Window items, including buttons and fields.

Italics Book and CD titles, variable names, new terms

Fixed font File and directory names, commands and code examples, text typed by you

Straight brackets, as in [value] Optional command parameters

Curly braces, as in {value} Required command parameters

Logical OR, as in value1|value2

Exclusive command parameters where only one of the options can be specified


Contents v

Contents About SolarWinds ........................................................................................... iii

Contacting SolarWinds ................................................................................... iii

Conventions .................................................................................................... iv

Chapter 1 Introduction to Resource Filtering ............................................................... 7 Filter Syntax ..................................................................................................... 7

SWQL Filter Syntax Examples .................................................................... 8 SQL Filter Syntax Examples ....................................................................... 9

Chapter 2 SWQL Resource Matrix ............................................................................... 11 Orion EOC Filters .......................................................................................... 12

Orion IVIM Filters ........................................................................................... 18

Orion APM Filters .......................................................................................... 20


vi Contents


Orion NPM Features 7

Chapter 1

Introduction to Resource Filtering

When managing large numbers of network devices with Orion NPM, resources that list Orion objects such as nodes and volumes can easily become very large and difficult to navigate. To help you more easily navigate the contents of your resources, we allow you to create filters.

Filters are optional database queries that you can add limit the Orion objects listed inside a resource. You can apply filters based on any Orion object property, be it custom or pre-defined within a resource, to help you better interpret the monitoring data shown in the resources.

To apply a resource filter:

1. Click Edit in any resource that lists Orion objects.

2. Click Show Filter Examples > Show List of Properties to list the properties you can use for the filter criteria

3. Provide appropriate filter criteria in the Filter Nodes field and then click Submit.

Filter Syntax There are two slightly different filter syntax types: Structured Query Language (SQL) syntax and SolarWinds Query Language (SWQL) syntax. The two main differences between SQL and SWQL are:

• The SWQL wildcard character is %. The SQL wildcard character is *.

• If the resource you are trying to filter creates its list by joining two tables together that contain properties that share the same name, you cannot filter on that property unless you attach a particular SQL table name to the beginning of the property name. The same is true also for SWQL queries, except you must look up the SWQL name and use that as a prefix insteadof a SQL table name.

SQL or SWQL? It is not always obvious whether a resource requires SQL syntax or SWQL syntax filters. Generally, the resources that have most recently been added to SolarWinds Orion use SWQL syntax, while the oldest ones require SQL syntax.

Look for additional guidance at the bottom of the Edit Resource page in the form of words such as "SWQL query" or "SQL query".


8 Orion NPM Features

SWQL Filter Syntax Examples

Wildcards The wildcard character in SWQL syntax is: %.

Example: Node.Caption Like 'AX3%'

Filtering by Custom Property The property syntax to filter by custom property is:

dataType.CustomProperties.propertyName

Example filter to only show nodes with the custom property City that matches Atlanta:

Node.CustomProperties.City = 'Atlanta'

Filtering by Built-in Properties Use the SWQL table name for selecting properties for your queries.

Examples Example filter to show data from Cisco devices:

Node.Vendor = 'Cisco'

Example filter to show data from Windows Server 2003-2008 applications:

Application.Name = 'Windows Server 2003-2008'

Example filter to show data from devices beginning with "AX3":

Node.Caption Like 'AX3%'

Example filter to show data from Process Monitor – SNMP type component monitors:

Monitor.ComponentType = 8



Filtering by Status To filter by the status property, you must know the valid status levels.

Level Status

0 Unknown

1 Up

2 Down

3 Warning

14 Critical

Example filter to only show monitors that are not down:

MonitorStatus.Availability<>2

SQL Filter Syntax Examples

Wildcards The wildcard character in SQL syntax is: *.

Example: Node.Caption Like 'AX3*'

Filtering by Custom Property The property syntax to filter by custom property is:

dataType.CustomProperty.propertyName

Example filter to only show nodes with the custom property City that matches Atlanta:

Node.CustomProperty.City = 'Atlanta'

Examples Example filter to show only Cisco devices:

Vendor = 'Cisco'

Example filter to show data only from component monitors named Server Load Monitor:

Monitor.Name like 'Server Load Monitor'

Example filter to show data from devices beginning with "AX3":

Node.Caption Like 'AX3*'



Example filter to show only Nortel devices that are Down:

Vendor Like 'Nortel*' AND Status=2

Filtering by Status To filter by the status, you must know the valid status levels.

Level Status

0 Unknown

1 Up

2 Down

3 Warning

14 Critical

Example filter to only show monitors that are not down:

MonitorStatus.Availability<>2



Chapter 2

SWQL Resource Matrix

The resource matrix helps you find the SWQL table names you need to create filter criteria for your resources. The SQL table names are provided so that you know exactly how the SWQL name map to the SQL tables in your SolarWinds Orion database.

• Orion EOC Filters

• Orion IVIM Filters

• Orion APM Filters



Orion EOC Filters All Orion Enterprise Operations Console (EOC) resources use SWQL filtering.

Alert Resource Filters Resource SQL Table Name SWQL Name

Global Last XX Active Alerts

EOC.Alert2 EOC.Orion

Alert Orion

Orion APM Resource Filters Resource SQL Table Name SWQL Name

Global All Applications

EOC.APM.Application EOC.APM.ApplicationTemplate EOC.APM.CurrentApplicationStatus EOC.Node EOC.Orion

A AT CAS N Orion

Global Application Health Overview

EOC.APM.CurrentApplicationStatus EOC.Orion

Status Orion

Global Applications by Status


A AT CASN. N Orion

Global Applications with High Process CPU Load


A AT CAS N Orion

Global Applications with High Process Memory Used


A AT CAS N Orion

Global Applications with High Response Time


A AT CAS N Orion

Global Down Applications

EOC.APM.Application EOC.APM.CurrentApplicationStatus EOC.Node EOC.Orion

A CAS N Orion

Global Top XX Monitors by Response Time

EOC.APM.Application EOC.APM.ApplicationTemplate EOC.APM.CurrentApplicationStatus EOC.APM.CurrentStatistic EOC.Node

A AT CAS CS N



Resource SQL Table Name SWQL Name

EOC.Orion Orion

Global Top XX Process Monitors by CPU Load

EOC.APM.Application EOC.APM.CurrentComponentStatus EOC.APM.CurrentStatistic EOC.Node EOC.Orion

A CCS CS N Orion

Global Top XX Process Monitors by Physical Memory


A CCS CS N Orion

Global Top XX Process Monitors by Virtual Memory


A CCS CS N Orion

Total Application by Type for Each Local Orion

EOC.APM.ApplicationTemplate EOC.Orion

AT O

Events Filters Resource SQL Table Name SWQL Name

Global Events Summary

EOC.Event EOC.EventType EOC.Orion

Event EventType Orion

Global Last XX Events

EOC.Event EOC.EventType EOC.Node EOC.Orion

Event EventType Node Orion

Inventory Filters Resource SQL Table Name SWQL Name

Number of Interfaces by Type

EOC.Interface EOC.Node EOC.Orion

I Node Orion

Number of Nodes by Device Type

EOC.Node EOC.Orion

Node Orion

Number of Nodes by IOS/OS

EOC.Node EOC.Orion

Node Orion



Orion EOC Filters Resource SQL Table Name SWQL Name

Global Top XX Errors & Discards This Hour


I N Orion

Global Top XX Error & Discards Today


I N Orion

Global Top XX Interfaces by percent utilization


I Node Orion

Global Top XX Interfaces by Relative Multicast Packet Rate


I N Orion

Global Top XX Interfaces by Traffic


I Node Orion

Global Top XX Nodes by Average Response Time

EOC.Node EOC.Orion

Node Orion

Global Top XX Nodes by CPU Load

EOC.Node EOC.Orion

Node Orion

Global Top XX Nodes by Current Response Time

EOC.Node EOC.Orion

Node Orion

Global Top XX Nodes by Percent Memory Used

EOC.Node EOC.Orion

Node Orion

Global Top XX Nodes by Percent Packet Loss

EOC.Node EOC.Orion

Node Orion

Global Top XX Volumes by Disk Space Used

EOC.Node EOC.Orion EOC.Volume.Stats

N Orion VS



Orion IP SLA Filters Resource SQL Table Name SWQL Name

Global Active IP SLA Operation Alerts

EOC.AlertStatus EOC.AlertDefinition EOC.IpSla.Operation EOC.IpSla.OperationType EOC.Orion

AlertStatus AlertDefinition IpSlaOperation IpSlaOperationType Orion

Global All IP SLA Operations

EOC.AlertStatus EOC.AlertDefinition EOC.IpSla.Operation EOC.IpSla.OperationStatus EOC.IpSla.OperationType EOC.IpSla.Site EOC.IpSla.Site EOC.Node EOC.Orion

AlertStatus AlertDefinition IpSlaOperation ipSlaOperationStatus IpSlaOperationType SourceSite TargetSite Node Orion

Global Top XX Call Paths by Jitter

EOC.Node EOC.Node EOC.Orion EOC.Voip.Link EOC.Voip.Site EOC.Voip.Site EOC.Voip.UdpResultDetail

N1 N2 O L S1 S2 D

Global Top XX Call Paths by Latency


N1 N2 O L S1 S2 D

Global Top XX Call Paths by MOS


N1 N2 O L S1 S2 D

Global Top XX Call Paths by Packet Loss


N1 N2 O L S1 S2 D

Global VoIP Call Managers

EOC.Node EOC.Orion EOC.Voip.CCMStatistic

N O C

Global VoIP Call Paths EOC.Node EOC.Node EOC.Orion

N1 N2 O



Resource SQL Table Name SWQL Name

EOC.Voip.Link EOC.Voip.Site EOC.Voip.Site EOC.Voip.UdpResultDetail

L S1 S2 D

Global VoIP Collector Services

EOC.Orion EOC.Voip.Engine

O S

Global VoIP Sites Overview


N1 N2 O L S1 S2 D

Orion NCM Filters Resource SQL Table Name SWQL Name

Global Configuration Manager Nodes

EOC.NCM.ConfigArchive EOC.NCM.Nodes EOC.Node EOC.Orion

ConfigArchive NCMNode Node Orion

Global Devices Backed Up vs Not Backed Up

EOC.NCM.ConfigArchive EOC.NCM.Nodes EOC.Node EOC.Orion

ConfigArchive NCMNode Node Orion

Global Last XX Config Changes

EOC.NCM.CacheDiffResults EOC.NCM.ComparisonCache EOC.NCM.Nodes EOC.Node EOC.Orion

CacheDiffResults ComparisonCache NCMNode Node Orion

Orion NTA Filters Resource SQL Table Name SWQL Name

Global Last XX Traffic Analysis Events

EOC.Event EOC.EventType EOC.Node EOC.Orion

EventType Event Node Orion

Global NetFlow Sources

EOC.Interface EOC.NetFlow.Source EOC.Node EOC.Orion

I S N O

NetFlow Collector Services

EOC.NetFlow.Engine EOC.Orion

S O



Orion Wireless Filters Resource SQL Table Name SWQL Name

Global Wireless Clients EOC.Node EOC.Orion EOC.Wireless.Interface

N O WI

Top XX Access Points by Number of Clients

EOC.Node EOC.Orion EOC.Wireless.Interface

N O WI

Top XX Wireless Clients by Traffic Rate

EOC.Node EOC.Orion EOC.Wireless.Client

N O WC

Summary Report Filters Resource SQL Table Name SWQL Name

Global Down Interface EOC.Interface EOC.Node EOC.Orion

I Node Orion

Global Down Nodes EOC.Node EOC.Orion

Node Orion

Global High Errors & Discards Today


I Node Orion

Global Node Status by Site

EOC.Node EOC.Node.CustomProperty EOC.Orion

Node NodeCustomProperty Orion

Global Nodes with High CPU Load

EOC.Node EOC.Orion

Node Orion

Global Nodes with High Memory Utilization

EOC.Node EOC.Orion

N Orion

Global Nodes with High Packet Loss

EOC.Node EOC.Orion

Node Orion

Global Nodes with High Response Time

EOC.Node EOC.Orion

Node Orion

Global Top XX Nodes with Problems

EOC.Node EOC.Node.CustomProperty EOC.Orion

Node NodeCustomProperty Orion

Global Volumes with High Percent usage

EOC.Node EOC.Orion EOC.Volume

N Orion V

Orion Summary Statistics EOC.Orion O



SysLog Filters Resource SQL Table Name SWQL Name

SysLog Summary EOC.Orion EOC.SysLog

Orion SysLog

Trap Filters Resource SQL Table Name SWQL Name

Global Trap Resource EOC.Orion EOC.Trap

Orion Trap

Orion IVIM Filters All Orion Integrated Virtual Infrastructure Management (IVIM) resources use SWQL filtering.

Virtualization Summary Resource SQL Table Name SWQL Name

Top 10 VMware Hosts by Percent Memory Used

Orion.VIM.Hosts Orion.Nodes

h n

Top 10 VMware Hosts by Network Utilization


hosts n

Top 10 VMware Hosts by CPU Load


h n

Top 10 VMware Hosts by Number of Running VMs


hosts nodes

Datacenter Details Resource SQL Table Name SWQL Name

Top 10 VMware Hosts by Percent Memory Used


hosts nodes

Top 10 VMware Hosts by Network Utilization


hosts nodes

Top 10 VMware Hosts by CPU Load


hosts nodes

Top 10 VMware Hosts by Number of Running VMs


hosts nodes



Cluster Details Resource SQL Table Name SWQL Name

Top 10 Managed VMware Guests by Current Response Time

Orion.VIM.VirtualMachines Orion.VIM.Hosts Orion.Nodes Orion.NodesStats

vms hosts nodes stats

Top 10 Managed VMware Guests by Percent Memory Used

Orion.VIM.VirtualMachines Orion.VIM.Hosts Orion.Nodes

vms hosts n

Top 10 Managed VMware Guests by CPU Load


vms hosts n

Top 10 Managed VMware Guests by Network Usage


VM H n



Orion APM Filters Resources for Orion Application Performance Monitor (APM) use a mix of SWQL and SQL filters.

Orion APM Resource Filters Resource SQL Table Name SWQL Name

All Applications Tree

Orion.APM.Application Orion.APM.ApplicationTemplate Orion.APM.CurrentApplicationStatus Orion.Nodes

Application ApplicationTemplate Status Nodes

Applications with Problems

Orion.APM.Application Orion.APM.ApplicationTemplate Orion.APM.CurrentApplicationStatus Orion.Nodes

Application Template Status Nodes

Top XX Components by Statistic Data

APM_CurrentComponentStatus APM_PortEvidence APM_ComponentExt APM_Application APM_CurrentApplicationStatus APM_ThresholdsByComponent APM_ThresholdsByComponent APM_ErrorCode APM_StatusCodeType APM_StatusCode

MonitorStatus pe Monitor Application ApplicationStatus thresholdRT thresholdStat ec sct sc

Top XX Components by Response Time

APM_CurrentComponentStatus APM_PortEvidence APM_ComponentExt APM_Application APM_CurrentApplicationStatus APM_ThresholdsByComponent

MonitorStatus pe Monitor Application ApplicationStatus Threshold

Top XX Processes by CPU Load

APM_CurrentComponentStatus APM_PortEvidence APM_ComponentExt APM_Application APM_CurrentApplicationStatus

MonitorStatus pe Monitor Application ApplicationStatus

Top XX Processes by Physical Memory



Top XX Processes by Virtual Memory



solarwinds-orion-filtersyntaxguide

Documents