Help Needed: Interface Error/Discard % Alert Not Working (SWQL & Widget)

Hi everyone,

I’m trying to monitor interface health by calculating error and discard percentages in SolarWinds — specifically to alert when:

InErrors%, OutErrors%
InDiscards%, OutDiscards%

are greater than 1%.

I created a SWQL query to calculate these percentages using packet counters like unicast/non-unicast packets. While the logic looks solid, I’m facing two major issues:

1. The SWQL query doesn't return any results in the Custom Query or Table widget, even though I know some interfaces have error/discard issues.
2. When I try to use the same logic in a custom SWQL alert trigger, it also doesn’t trigger — even in simulation mode with known bad interfaces.

Question What I’m looking for:

Has anyone successfully implemented a percentage-based alert for interface errors/discards?

Are there known limitations with using Interface Statistics data in SWQL queries or alerts?

Should I be approaching this differently — maybe using a transform or poller-based method instead?

Any guidance on how to accurately calculate error/discard percentages in SolarWinds?

Environment:

SolarWinds NPM
Interfaces monitored: GigabitEthernet, TenGig, etc.
Would greatly appreciate any help, working examples, or pointers from your experience!

Thanks,
Kamalesh

Find more posts tagged with

interface monitoring

errors_and_discards

SWQL

percentage

solarwinds network performance monitor

npm

discards

Accepted answers

Lofstrand

Hi, I would personally just use something like this:

Alert when critical value is reach for receive or transmit errors/discards. Using the global or individual thresholds.

But I understand it as you want to use percentage instead of errors/hour. Care to share your SWQL code and I'll have a look?

All comments

Lofstrand

Hi, I would personally just use something like this:

Alert when critical value is reach for receive or transmit errors/discards. Using the global or individual thresholds.

But I understand it as you want to use percentage instead of errors/hour. Care to share your SWQL code and I'll have a look?

kamalesh.pvt

Hi @Lofstrand

Thanks for your response. I'm currently using the same parameters in my alerting mechanism — specifically the Global Thresholds.

However, the challenge I'm facing is that the threshold values vary depending on the interface type and tend to increase dynamically. So, I'm exploring whether there's a working setup that allows alerting based on percentage calculations, rather than static thresholds.

For example, something like this in SQL/SQWL:

Alert when

(Total Discards / (Total Discards + Total Received + Total Transmitted Packets)) * 100 > 1%

Thanks !

Lofstrand

Ok, understand. Try this out:

The first part is just the foundation, a SWQL that tries to display all interfaces where the percentage of issues is over 5% (just took a number, change as you wish). Also, I summarized the values from last hour, to get an average and not alert right away. Adjust if you want.

SELECT
    I.Uri
 --   ,IT2.TotalPackets
 --   ,IE2.TotalErrors
    ,(IE2.TotalErrors/IT2.TotalPackets)*100 AS PercentError  
FROM Orion.NPM.Interfaces AS I
INNER JOIN (
    SELECT 
        IT.NodeID
        ,IT.InterfaceID
        ,SUM(IT.TotalPackets) AS TotalPackets
    FROM Orion.NPM.InterfaceTraffic AS IT
    WHERE
        IT.DateTime>ADDHOUR(-1,GETUTCDATE())
        AND IT.TotalPackets>0
    GROUP BY
        IT.NodeID,IT.InterfaceID
    ) AS IT2 ON I.InterfaceID=IT2.InterfaceID
INNER JOIN (
    SELECT
        IE.NodeID
        ,IE.InterfaceID
        ,SUM(Errors)+Sum(Discards) AS TotalErrors
    FROM Orion.NPM.InterfaceErrors AS IE
    WHERE 
        IE.DateTime>ADDHOUR(-1,GETUTCDATE())
    GROUP BY
        IE.NodeID,IE.InterfaceID
    ) AS IE2 ON I.InterfaceID=IE2.interfaceID
WHERE
    (IE2.TotalErrors/IT2.TotalPackets)*100>5 --The Percentage threshold

You can test this in SWQL studio or a custom table or whatever, to see you get the correct result.

Below is the full query to add to your custom SWQL alert

-- Custom adjustable part of a custom SWQL Alert
INNER JOIN 
(
SELECT
    I.Uri
 --   ,IT2.TotalPackets
 --   ,IE2.TotalErrors
    ,(IE2.TotalErrors/IT2.TotalPackets)*100 AS PercentError  
FROM Orion.NPM.Interfaces AS I
INNER JOIN (
    SELECT 
        IT.NodeID
        ,IT.InterfaceID
        ,SUM(IT.TotalPackets) AS TotalPackets
    FROM Orion.NPM.InterfaceTraffic AS IT
    WHERE
        IT.DateTime>ADDHOUR(-1,GETUTCDATE())
        AND IT.TotalPackets>0
    GROUP BY
        IT.NodeID,IT.InterfaceID
    ) AS IT2 ON I.InterfaceID=IT2.InterfaceID
INNER JOIN (
    SELECT
        IE.NodeID
        ,IE.InterfaceID
        ,SUM(Errors)+Sum(Discards) AS TotalErrors
    FROM Orion.NPM.InterfaceErrors AS IE
    WHERE 
        IE.DateTime>ADDHOUR(-1,GETUTCDATE())
    GROUP BY
        IE.NodeID,IE.InterfaceID
    ) AS IE2 ON I.InterfaceID=IE2.interfaceID
WHERE
    (IE2.TotalErrors/IT2.TotalPackets)*100>5 --The Percentage threshold
) AS I2 ON Interfaces.Uri=I2.Uri

Will look like this then:

Does it work as you want it to?

Sivaprasad

Hi Lofstrand,

Thank you for your response and the query.

We have modified your query Discards and Errors separately and test got successful for both report and Alert condition. Below is the query

Report Query (TotalPackets- SWQL)

SELECT

I.Uri,

I.NodeID,

I.InterfaceID

,IT2.LastTrafficTime

,IE2.LastErrorsTime

,IT2.TotalPackets

,IE2.TotalErrors

,IE2.TotalDiscards

,(IE2.TotalErrors/IT2.TotalPackets)*100 AS PercentErrors

,(IE2.TotalDiscards/IT2.TotalPackets)*100 AS PercentDiscards

FROM Orion.NPM.Interfaces AS I

INNER JOIN (

SELECT

IT.NodeID

,IT.InterfaceID

,Max(DateTime) AS LastTrafficTime

,SUM(IT.TotalPackets) AS TotalPackets

FROM Orion.NPM.InterfaceTraffic AS IT

WHERE

IT.DateTime>ADDHOUR(-1,GETUTCDATE())

AND IT.TotalPackets>0

GROUP BY

IT.NodeID,IT.InterfaceID

) AS IT2 ON I.InterfaceID=IT2.InterfaceID

INNER JOIN (

SELECT

IE.NodeID

,IE.InterfaceID

,MAX(DateTime) AS LastErrorsTime

,SUM(Errors) AS TotalErrors

,Sum(Discards) AS TotalDiscards

FROM Orion.NPM.InterfaceErrors AS IE

WHERE

IE.DateTime>ADDHOUR(-1,GETUTCDATE())

GROUP BY

IE.NodeID,IE.InterfaceID

) AS IE2 ON I.InterfaceID=IE2.interfaceID

Alert Condition query with TotalPackets- SWQL

INNER JOIN

(

SELECT

I.Uri

,I.InterfaceID

,I.NodeID

,IT2.TotalPackets

,IE2.TotalErrors

,IE2.TotalBytes

,(IE2.TotalErrors/IT2.TotalBytes)*100 AS PercentErrors

,(IE2.TotalDiscards/IT2.TotalBytes)*100 AS PercentDiscards

FROM Orion.NPM.Interfaces AS I

INNER JOIN (

SELECT

IT.NodeID

,IT.InterfaceID

,SUM(IT.TotalPackets) AS TotalPackets

,SUM(IT.TotalBytes) AS TotalBytes

,Max(DateTime) AS LastTrafficTime

FROM Orion.NPM.InterfaceTraffic AS IT

WHERE

IT.DateTime>ADDHOUR(-1,GETUTCDATE())

AND IT.TotalBytes>0

GROUP BY

IT.NodeID,IT.InterfaceID

) AS IT2 ON I.InterfaceID=IT2.InterfaceID

INNER JOIN (

SELECT

IE.NodeID

,IE.InterfaceID

,SUM(Errors) AS TotalErrors

,Sum(Discards) AS TotalDiscards

,MAX(DateTime) AS LastErrorsTime

FROM Orion.NPM.InterfaceErrors AS IE

WHERE

IE.DateTime>ADDHOUR(-1,GETUTCDATE())

GROUP BY

IE.NodeID,IE.InterfaceID

) AS IE2 ON I.InterfaceID=IE2.interfaceID

WHERE

(IE2.TotalErrors/IT2.TotalBytes)*100>0.2

) AS I2 ON Interfaces.Uri=I2.Uri

FYI - Alert query test got successful

But our actual requirement should be below in SQL with In and out Separately and also TotalBytes instead of Totalpackets. Query is also working and test got successful for Report but getting error for Alert trigger condition in SQL.

Need your Help on Alert trigger condition for Query in SQL based on my below query(query is failing in trigger condition). Please provide suggestion for query in that alert condition

In_Errors , In_Discards and Out_Errors , Out_Discards

Report - SQL Query working (TotalBytes %)

SELECT

I.NodeID,

I.InterfaceID

,I.Caption

,IT2.StartTime

,IT2.EndTime

,IT2.In_TotalBytes

,IT2.Out_TotalBytes

,IE2.Total_In_Discards

,IE2.Total_Out_Discards

,(IE2.Total_In_Discards/IT2.In_TotalBytes)*100 AS PercentIn_Discards

,(IE2.Total_Out_Discards/IT2.Out_TotalBytes)*100 AS PercentOut_Discards

FROM [dbo].[Interfaces] AS I

INNER JOIN (

SELECT

IT.NodeID

,IT.InterfaceID

,MAX(DateTime) AS EndTime

,MIN(DateTime) AS StartTime

,SUM(IT.In_TotalBytes) AS In_TotalBytes

,SUM(IT.Out_TotalBytes) AS Out_TotalBytes

FROM [dbo].[InterfaceTraffic] AS IT

WHERE

IT.DateTime>DATEADD(HOUR, -1, GETUTCDATE())

AND IT.In_TotalBytes>0

AND IT.Out_TotalBytes>0

GROUP BY

IT.NodeID,IT.InterfaceID

) AS IT2 ON I.InterfaceID=IT2.InterfaceID

INNER JOIN (

SELECT

IE.NodeID

,IE.InterfaceID

,SUM(In_Discards) AS Total_In_Discards

,SUM(Out_Discards) AS Total_Out_Discards

FROM [dbo].[InterfaceErrors] AS IE

WHERE

IE.DateTime>DATEADD(HOUR,-1, GETUTCDATE())

GROUP BY

IE.NodeID,IE.InterfaceID

) AS IE2 ON I.InterfaceID=IE2.InterfaceID

Alert Trigger Condition for SQL query (Total In_Bytes %) - Not working

INNER JOIN (

SELECT

I.NodeID,

I.InterfaceID

,I.Caption

,IT2.StartTime

,IT2.EndTime

,IT2.In_TotalBytes

,IT2.Out_TotalBytes

,IE2.Total_In_Discards

,IE2.Total_Out_Discards

,(IE2.Total_In_Discards/IT2.In_TotalBytes)*100 AS PercentIn_Discards

,(IE2.Total_Out_Discards/IT2.Out_TotalBytes)*100 AS PercentOut_Discards

FROM [dbo].[Interfaces] AS I

INNER JOIN (

SELECT

IT.NodeID

,IT.InterfaceID

,MAX(DateTime) AS EndTime

,MIN(DateTime) AS StartTime

,SUM(IT.In_TotalBytes) AS In_TotalBytes

,SUM(IT.Out_TotalBytes) AS Out_TotalBytes

FROM [dbo].[InterfaceTraffic] AS IT

WHERE

IT.DateTime>DATEADD(HOUR, -1, GETUTCDATE())

AND IT.In_TotalBytes>0

GROUP BY

IT.NodeID,IT.InterfaceID

) AS IT2 ON I.InterfaceID=IT2.InterfaceID

INNER JOIN (

SELECT

IE.NodeID

,IE.InterfaceID

,SUM(In_Discards) AS Total_In_Discards

,SUM(Out_Discards) AS Total_Out_Discards

FROM [dbo].[InterfaceErrors] AS IE

WHERE

IE.DateTime>DATEADD(HOUR,-1, GETUTCDATE())

GROUP BY

IE.NodeID,IE.InterfaceID

) AS IE2 ON I.InterfaceID=IE2.InterfaceID

WHERE

(IE2.Total_In_Discards/IT2.In_TotalBytes)*100>0.2

) AS I2 ON Interfaces.InterfaceID=I2.InterfaceID