SolarWinds Orion

Filter Syntax Guide

FILTER SYNTAX GUIDE

SolarWinds Orion Filter Syntax Guide Administrator Guide

Copyright 1995-2010 SolarWinds, Inc. all rights reserved worldwide. No part of this document may be reproduced by any means nor modified, decompiled, disassembled, published or distributed, in whole or in part, or translated to any electronic medium or other means without the written consent of SolarWinds All right, title and interest in and to the software and documentation are and shall remain the exclusive property of SolarWinds and its licensors. SolarWinds Orion, SolarWinds Cirrus, and SolarWinds Toolset are trademarks of SolarWinds and SolarWinds.net and the SolarWinds logo are registered trademarks of SolarWinds All other trademarks contained in this document and in the Software are the property of their respective owners. SOLARWINDS DISCLAIMS ALL WARRANTIES, CONDITIONS OR OTHER TERMS, EXPRESS OR IMPLIED, STATUTORY OR OTHERWISE, ON SOFTWARE AND DOCUMENTATION FURNISHED HEREUNDER INCLUDING WITHOUT LIMITATION THE WARRANTIES OF DESIGN, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL SOLARWINDS, ITS SUPPLIERS OR ITS LICENSORS BE LIABLE FOR ANY DAMAGES, WHETHER ARISING IN TORT, CONTRACT OR ANY OTHER LEGAL THEORY EVEN IF SOLARWINDS HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. Microsoft, Windows 2000 Server, Windows 2003 Server, and Windows 208 Server are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries. Graph Layout Toolkit and Graph Editor Toolkit 1992 - 2001 Tom Sawyer Software, Oakland, California. All Rights Reserved. Portions Copyright ComponentOne, LLC 1991-2002. All Rights Reserved. Orion Filter Syntax Guide, Revised 8.19.2010

ii SolarWinds Orion Network Performance Monitor Documentation Library

SolarWinds Orion Filter Syntax Guide Administrator Guide

About SolarWinds
SolarWinds, Inc develops and markets an array of network management, monitoring, and discovery tools to meet the diverse requirements of todays network management and consulting professionals. SolarWinds products continue to set benchmarks for quality and performance and have positioned the company as the leader in network management and discovery technology. The SolarWinds customer base includes over 45 percent of the Fortune 500 and customers from over 90 countries. Our global business partner distributor network exceeds 100 distributors and resellers.

Contacting SolarWinds
You can contact SolarWinds in a number of ways, including the following: Team Contact Information sales@solarwinds.com www.solarwinds.com 1.866.530.8100 +353.21.5002900 www.solarwinds.com/support www.thwack.com

Sales

Technical Support User Forums

About SolarWinds iii

SolarWinds Orion Filter Syntax Guide Administrator Guide

Conventions
The documentation uses consistent conventions to help you identify items throughout the printed and online library. Convention Bold Italics Specifying Window items, including buttons and fields. Book and CD titles, variable names, new terms File and directory names, commands and code examples, text typed by you Optional command parameters Required command parameters Exclusive command parameters where only one of the options can be specified

Fixed font
Straight brackets, as in [value] Curly braces, as in {value} Logical OR, as in value1|value2

iv SolarWinds Orion Network Performance Monitor Documentation Library

SolarWinds Orion Filter Syntax Guide Administrator Guide

Contents
About SolarWinds ........................................................................................... iii Contacting SolarWinds ................................................................................... iii Conventions .................................................................................................... iv
Chapter 1

Introduction to Resource Filtering ............................................................... 7 Filter Syntax ..................................................................................................... 7 SWQL Filter Syntax Examples .................................................................... 8 SQL Filter Syntax Examples ....................................................................... 9
Chapter 2

SWQL Resource Matrix ............................................................................... 11 Orion EOC Filters .......................................................................................... 12 Orion IVIM Filters ........................................................................................... 18 Orion APM Filters .......................................................................................... 20

Contents v

SolarWinds Orion Filter Syntax Guide Administrator Guide

vi Contents

SolarWinds Orion Filter Syntax Guide Administrator Guide

Chapter 1

Introduction to Resource Filtering

When managing large numbers of network devices with Orion NPM, resources that list Orion objects such as nodes and volumes can easily become very large and difficult to navigate. To help you more easily navigate the contents of your resources, we allow you to create filters. Filters are optional database queries that you can add limit the Orion objects listed inside a resource. You can apply filters based on any Orion object property, be it custom or pre-defined within a resource, to help you better interpret the monitoring data shown in the resources. To apply a resource filter: 1. Click Edit in any resource that lists Orion objects. 2. Click Show Filter Examples > Show List of Properties to list the properties you can use for the filter criteria 3. Provide appropriate filter criteria in the Filter Nodes field and then click Submit.

Filter Syntax
There are two slightly different filter syntax types: Structured Query Language (SQL) syntax and SolarWinds Query Language (SWQL) syntax. The two main differences between SQL and SWQL are: The SWQL wildcard character is %. The SQL wildcard character is *. If the resource you are trying to filter creates its list by joining two tables together that contain properties that share the same name, you cannot filter on that property unless you attach a particular SQL table name to the beginning of the property name. The same is true also for SWQL queries, except you must look up the SWQL name and use that as a prefix insteadof a SQL table name.

SQL or SWQL? It is not always obvious whether a resource requires SQL syntax or SWQL syntax filters. Generally, the resources that have most recently been added to SolarWinds Orion use SWQL syntax, while the oldest ones require SQL syntax. Look for additional guidance at the bottom of the Edit Resource page in the form of words such as "SWQL query" or "SQL query".
Orion NPM Features 7

SolarWinds Orion Filter Syntax Guide Administrator Guide

SWQL Filter Syntax Examples

Wildcards The wildcard character in SWQL syntax is: %. Example: Node.Caption Like 'AX3%' Filtering by Custom Property The property syntax to filter by custom property is: dataType.CustomProperties.propertyName Example filter to only show nodes with the custom property City that matches Atlanta:
Node.CustomProperties.City = 'Atlanta'

Filtering by Built-in Properties Use the SWQL table name for selecting properties for your queries. Examples Example filter to show data from Cisco devices:
Node.Vendor = 'Cisco'

Example filter to show data from Windows Server 2003-2008 applications:

Application.Name = 'Windows Server 2003-2008'

Example filter to show data from devices beginning with "AX3":

Node.Caption Like 'AX3%'

Example filter to show data from Process Monitor SNMP type component monitors:
Monitor.ComponentType = 8

8 Orion NPM Features

SolarWinds Orion Filter Syntax Guide Administrator Guide

Filtering by Status To filter by the status property, you must know the valid status levels.
Level 0 1 2 3 14 Status Unknown Up Down Warning Critical

Example filter to only show monitors that are not down:

MonitorStatus.Availability<>2

SQL Filter Syntax Examples

Wildcards The wildcard character in SQL syntax is: *. Example: Node.Caption Like 'AX3*' Filtering by Custom Property The property syntax to filter by custom property is: dataType.CustomProperty.propertyName Example filter to only show nodes with the custom property City that matches Atlanta:
Node.CustomProperty.City = 'Atlanta'

Examples Example filter to show only Cisco devices:

Vendor = 'Cisco'

Example filter to show data only from component monitors named Server Load Monitor:
Monitor.Name like 'Server Load Monitor'

Example filter to show data from devices beginning with "AX3":

Node.Caption Like 'AX3*' Orion NPM Features 9

SolarWinds Orion Filter Syntax Guide Administrator Guide

Example filter to show only Nortel devices that are Down:

Vendor Like 'Nortel*' AND Status=2

Filtering by Status To filter by the status, you must know the valid status levels.
Level 0 1 2 3 14 Status Unknown Up Down Warning Critical

Example filter to only show monitors that are not down:

MonitorStatus.Availability<>2

10 Orion NPM Features

SolarWinds Orion Filter Syntax Guide Administrator Guide

Chapter 2

SWQL Resource Matrix

The resource matrix helps you find the SWQL table names you need to create filter criteria for your resources. The SQL table names are provided so that you know exactly how the SWQL name map to the SQL tables in your SolarWinds Orion database. Orion EOC Filters Orion IVIM Filters Orion APM Filters

Orion NPM Features 11

SolarWinds Orion Filter Syntax Guide Administrator Guide

Orion EOC Filters

All Orion Enterprise Operations Console (EOC) resources use SWQL filtering. Alert Resource Filters
Resource Global Last XX Active Alerts SQL Table Name EOC.Alert2 EOC.Orion SWQL Name Alert Orion

Orion APM Resource Filters

Resource SQL Table Name EOC.APM.Application EOC.APM.ApplicationTemplate EOC.APM.CurrentApplicationStatus EOC.Node EOC.Orion EOC.APM.CurrentApplicationStatus EOC.Orion EOC.APM.Application EOC.APM.ApplicationTemplate EOC.APM.CurrentApplicationStatus EOC.Node EOC.Orion EOC.APM.Application EOC.APM.ApplicationTemplate EOC.APM.CurrentApplicationStatus EOC.Node EOC.Orion EOC.APM.Application EOC.APM.ApplicationTemplate EOC.APM.CurrentApplicationStatus EOC.Node EOC.Orion EOC.APM.Application EOC.APM.ApplicationTemplate EOC.APM.CurrentApplicationStatus EOC.Node EOC.Orion EOC.APM.Application EOC.APM.CurrentApplicationStatus EOC.Node EOC.Orion EOC.APM.Application EOC.APM.ApplicationTemplate EOC.APM.CurrentApplicationStatus EOC.APM.CurrentStatistic EOC.Node SWQL Name A AT CAS N Orion Status Orion A AT CASN. N Orion A AT CAS N Orion A AT CAS N Orion A AT CAS N Orion A CAS N Orion A AT CAS CS N

Global All Applications

Global Application Health Overview

Global Applications by Status

Global Applications with High Process CPU Load

Global Applications with High Process Memory Used

Global Applications with High Response Time

Global Down Applications

Global Top XX Monitors by Response Time

12 Orion NPM Features

SolarWinds Orion Filter Syntax Guide Administrator Guide

Resource SQL Table Name EOC.Orion EOC.APM.Application EOC.APM.CurrentComponentStatus EOC.APM.CurrentStatistic EOC.Node EOC.Orion EOC.APM.Application EOC.APM.CurrentComponentStatus EOC.APM.CurrentStatistic EOC.Node EOC.Orion EOC.APM.Application EOC.APM.CurrentComponentStatus EOC.APM.CurrentStatistic EOC.Node EOC.Orion EOC.APM.ApplicationTemplate EOC.Orion SWQL Name Orion A CCS CS N Orion A CCS CS N Orion A CCS CS N Orion AT O

Global Top XX Process Monitors by CPU Load

Global Top XX Process Monitors by Physical Memory

Global Top XX Process Monitors by Virtual Memory Total Application by Type for Each Local Orion

Events Filters
Resource Global Events Summary SQL Table Name EOC.Event EOC.EventType EOC.Orion EOC.Event EOC.EventType EOC.Node EOC.Orion SWQL Name Event EventType Orion Event EventType Node Orion

Global Last XX Events

Inventory Filters
Resource Number of Interfaces by Type Number of Nodes by Device Type Number of Nodes by IOS/OS SQL Table Name EOC.Interface EOC.Node EOC.Orion EOC.Node EOC.Orion EOC.Node EOC.Orion SWQL Name I Node Orion Node Orion Node Orion

Orion NPM Features 13

SolarWinds Orion Filter Syntax Guide Administrator Guide

Orion EOC Filters

Resource Global Top XX Errors & Discards This Hour Global Top XX Error & Discards Today Global Top XX Interfaces by percent utilization Global Top XX Interfaces by Relative Multicast Packet Rate Global Top XX Interfaces by Traffic Global Top XX Nodes by Average Response Time Global Top XX Nodes by CPU Load Global Top XX Nodes by Current Response Time Global Top XX Nodes by Percent Memory Used Global Top XX Nodes by Percent Packet Loss Global Top XX Volumes by Disk Space Used SQL Table Name EOC.Interface EOC.Node EOC.Orion EOC.Interface EOC.Node EOC.Orion EOC.Interface EOC.Node EOC.Orion EOC.Interface EOC.Node EOC.Orion EOC.Interface EOC.Node EOC.Orion EOC.Node EOC.Orion EOC.Node EOC.Orion EOC.Node EOC.Orion EOC.Node EOC.Orion EOC.Node EOC.Orion EOC.Node EOC.Orion EOC.Volume.Stats SWQL Name I N Orion I N Orion I Node Orion I N Orion I Node Orion Node Orion Node Orion Node Orion Node Orion Node Orion N Orion VS

14 Orion NPM Features

SolarWinds Orion Filter Syntax Guide Administrator Guide

Orion IP SLA Filters

Resource SQL Table Name EOC.AlertStatus EOC.AlertDefinition EOC.IpSla.Operation EOC.IpSla.OperationType EOC.Orion EOC.AlertStatus EOC.AlertDefinition EOC.IpSla.Operation EOC.IpSla.OperationStatus EOC.IpSla.OperationType EOC.IpSla.Site EOC.IpSla.Site EOC.Node EOC.Orion EOC.Node EOC.Node EOC.Orion EOC.Voip.Link EOC.Voip.Site EOC.Voip.Site EOC.Voip.UdpResultDetail EOC.Node EOC.Node EOC.Orion EOC.Voip.Link EOC.Voip.Site EOC.Voip.Site EOC.Voip.UdpResultDetail EOC.Node EOC.Node EOC.Orion EOC.Voip.Link EOC.Voip.Site EOC.Voip.Site EOC.Voip.UdpResultDetail EOC.Node EOC.Node EOC.Orion EOC.Voip.Link EOC.Voip.Site EOC.Voip.Site EOC.Voip.UdpResultDetail EOC.Node EOC.Orion EOC.Voip.CCMStatistic EOC.Node EOC.Node EOC.Orion SWQL Name AlertStatus AlertDefinition IpSlaOperation IpSlaOperationType Orion AlertStatus AlertDefinition IpSlaOperation ipSlaOperationStatus IpSlaOperationType SourceSite TargetSite Node Orion N1 N2 O L S1 S2 D N1 N2 O L S1 S2 D N1 N2 O L S1 S2 D N1 N2 O L S1 S2 D N O C N1 N2 O

Global Active IP SLA Operation Alerts

Global All IP SLA Operations

Global Top XX Call Paths by Jitter

Global Top XX Call Paths by Latency

Global Top XX Call Paths by MOS

Global Top XX Call Paths by Packet Loss

Global VoIP Call Managers

Global VoIP Call Paths

Orion NPM Features 15

SolarWinds Orion Filter Syntax Guide Administrator Guide

Resource SQL Table Name EOC.Voip.Link EOC.Voip.Site EOC.Voip.Site EOC.Voip.UdpResultDetail Global VoIP Collector Services EOC.Orion EOC.Voip.Engine EOC.Node EOC.Node EOC.Orion EOC.Voip.Link EOC.Voip.Site EOC.Voip.Site EOC.Voip.UdpResultDetail SWQL Name L S1 S2 D O S N1 N2 O L S1 S2 D

Global VoIP Sites Overview

Orion NCM Filters

Resource Global Configuration Manager Nodes SQL Table Name EOC.NCM.ConfigArchive EOC.NCM.Nodes EOC.Node EOC.Orion EOC.NCM.ConfigArchive EOC.NCM.Nodes EOC.Node EOC.Orion EOC.NCM.CacheDiffResults EOC.NCM.ComparisonCache EOC.NCM.Nodes EOC.Node EOC.Orion SWQL Name ConfigArchive NCMNode Node Orion ConfigArchive NCMNode Node Orion CacheDiffResults ComparisonCache NCMNode Node Orion

Global Devices Backed Up vs Not Backed Up

Global Last XX Config Changes

Orion NTA Filters

Resource Global Last XX Traffic Analysis Events SQL Table Name EOC.Event EOC.EventType EOC.Node EOC.Orion EOC.Interface EOC.NetFlow.Source EOC.Node EOC.Orion EOC.NetFlow.Engine EOC.Orion SWQL Name EventType Event Node Orion I S N O S O

Global NetFlow Sources NetFlow Collector Services

16 Orion NPM Features

SolarWinds Orion Filter Syntax Guide Administrator Guide

Orion Wireless Filters

Resource Global Wireless Clients SQL Table Name EOC.Node EOC.Orion EOC.Wireless.Interface EOC.Node EOC.Orion EOC.Wireless.Interface EOC.Node EOC.Orion EOC.Wireless.Client SWQL Name N O WI N O WI N O WC

Top XX Access Points by Number of Clients Top XX Wireless Clients by Traffic Rate

Summary Report Filters

Resource Global Down Interface SQL Table Name EOC.Interface EOC.Node EOC.Orion EOC.Node EOC.Orion EOC.Interface EOC.Node EOC.Orion EOC.Node EOC.Node.CustomProperty EOC.Orion EOC.Node EOC.Orion EOC.Node EOC.Orion EOC.Node EOC.Orion EOC.Node EOC.Orion EOC.Node EOC.Node.CustomProperty EOC.Orion EOC.Node EOC.Orion EOC.Volume EOC.Orion SWQL Name I Node Orion Node Orion I Node Orion Node NodeCustomProperty Orion Node Orion N Orion Node Orion Node Orion Node NodeCustomProperty Orion N Orion V O

Global Down Nodes Global High Errors & Discards Today Global Node Status by Site Global Nodes with High CPU Load Global Nodes with High Memory Utilization Global Nodes with High Packet Loss Global Nodes with High Response Time Global Top XX Nodes with Problems Global Volumes with High Percent usage Orion Summary Statistics

Orion NPM Features 17

SolarWinds Orion Filter Syntax Guide Administrator Guide

SysLog Filters
Resource SysLog Summary SQL Table Name EOC.Orion EOC.SysLog SWQL Name Orion SysLog

Trap Filters
Resource Global Trap Resource SQL Table Name EOC.Orion EOC.Trap SWQL Name Orion Trap

Orion IVIM Filters

All Orion Integrated Virtual Infrastructure Management (IVIM) resources use SWQL filtering. Virtualization Summary
Resource Top 10 VMware Hosts by Percent Memory Used Top 10 VMware Hosts by Network Utilization Top 10 VMware Hosts by CPU Load Top 10 VMware Hosts by Number of Running VMs SQL Table Name Orion.VIM.Hosts Orion.Nodes Orion.VIM.Hosts Orion.Nodes Orion.VIM.Hosts Orion.Nodes Orion.VIM.Hosts Orion.Nodes SWQL Name h n hosts n h n hosts nodes

Datacenter Details
Resource Top 10 VMware Hosts by Percent Memory Used Top 10 VMware Hosts by Network Utilization Top 10 VMware Hosts by CPU Load Top 10 VMware Hosts by Number of Running VMs SQL Table Name Orion.VIM.Hosts Orion.Nodes Orion.VIM.Hosts Orion.Nodes Orion.VIM.Hosts Orion.Nodes Orion.VIM.Hosts Orion.Nodes SWQL Name hosts nodes hosts nodes hosts nodes hosts nodes

18 Orion NPM Features

SolarWinds Orion Filter Syntax Guide Administrator Guide

Cluster Details
Resource Top 10 Managed VMware Guests by Current Response Time Top 10 Managed VMware Guests by Percent Memory Used Top 10 Managed VMware Guests by CPU Load Top 10 Managed VMware Guests by Network Usage SQL Table Name Orion.VIM.VirtualMachines Orion.VIM.Hosts Orion.Nodes Orion.NodesStats Orion.VIM.VirtualMachines Orion.VIM.Hosts Orion.Nodes Orion.VIM.VirtualMachines Orion.VIM.Hosts Orion.Nodes Orion.VIM.VirtualMachines Orion.VIM.Hosts Orion.Nodes SWQL Name vms hosts nodes stats vms hosts n vms hosts n VM H n

Orion NPM Features 19

SolarWinds Orion Filter Syntax Guide Administrator Guide

Orion APM Filters

Resources for Orion Application Performance Monitor (APM) use a mix of SWQL and SQL filters. Orion APM Resource Filters
Resource SQL Table Name Orion.APM.Application Orion.APM.ApplicationTemplate Orion.APM.CurrentApplicationStatus Orion.Nodes Orion.APM.Application Orion.APM.ApplicationTemplate Orion.APM.CurrentApplicationStatus Orion.Nodes APM_CurrentComponentStatus APM_PortEvidence APM_ComponentExt APM_Application APM_CurrentApplicationStatus APM_ThresholdsByComponent APM_ThresholdsByComponent APM_ErrorCode APM_StatusCodeType APM_StatusCode APM_CurrentComponentStatus APM_PortEvidence APM_ComponentExt APM_Application APM_CurrentApplicationStatus APM_ThresholdsByComponent APM_CurrentComponentStatus APM_PortEvidence APM_ComponentExt APM_Application APM_CurrentApplicationStatus APM_CurrentComponentStatus APM_PortEvidence APM_ComponentExt APM_Application APM_CurrentApplicationStatus APM_ThresholdsByComponent APM_CurrentComponentStatus APM_PortEvidence APM_ComponentExt APM_Application APM_CurrentApplicationStatus APM_ThresholdsByComponent SWQL Name Application ApplicationTemplate Status Nodes Application Template Status Nodes MonitorStatus pe Monitor Application ApplicationStatus thresholdRT thresholdStat ec sct sc MonitorStatus pe Monitor Application ApplicationStatus Threshold MonitorStatus pe Monitor Application ApplicationStatus MonitorStatus pe Monitor Application ApplicationStatus Threshold MonitorStatus pe Monitor Application ApplicationStatus Threshold

All Applications Tree

Applications with Problems

Top XX Components by Statistic Data

Top XX Components by Response Time

Top XX Processes by CPU Load

Top XX Processes by Physical Memory

Top XX Processes by Virtual Memory

20 Orion NPM Features