Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

How to monitor Bandwidth utilization on IP address basis

I have an existing query that looks at application specific bandwidth utilization alerts, I want this to be modified so as to set alerting based on IP address bandwidth utilization on the selected interface. Here is the existing query predefined on Solar Winds

SELECT Interfaces.Uri, Interfaces.DisplayName FROM Orion.NPM.Interfaces AS Interfaces
INNER JOIN
(
SELECT InterfaceID
FROM Orion.Netflow.FlowsByInterface
WHERE
(TimeStamp >= AddMinute(-5, DateTrunc('minute', GetUtcDate())) AND TimeStamp <= AddMinute(-1, DateTrunc('minute', GetUtcDate())))
AND InterfaceID IN (4697)
AND (ApplicationID IN (106235,104310,104312,100351) AND ApplicationID != 0)
GROUP BY InterfaceID
HAVING ((SUM(IngressBytes)*8) / (5*60)) > 50000000
) AS Flows
ON Flows.InterfaceID = Interfaces.InterfaceID

Is it possible to edit this to look at an IP address segment instead of based on application, for bandwidth utilization alerting.

Find more posts tagged with

Accepted answers

All comments

vrkvvj

Hi Charan-

i do not see any IP Address associatd to Interface in SW.

And BW util is related to interfaces, so it is impossible to have it.

So please let me know if it is otherwise.

Regards

vrkvvj

sum_giais

Flow data includes IP addresses. It looks like the query that you're posting is one of the auto-generated SWQL query alerts that NTA creates.

In the SWQL table 'Orion.Netflow.FlowsByInterface', it has the SourceIP, and DestinationIP columns which you should be able to use to get what you need to adjust the alert for just a specific IP address.

Here's an example of a line to add that will get that:

AND (SourceIP = 'x.x.x.x' OR DestinationIP = 'x.x.x.x')

This example would be a condition that would trigger if any traffic goes to, or from this x.x.x.x address. This logic can clearly be altered for your preference. Below is your query with the updated AND statement, just update x.x.x.x with your IP address. Could even make it an 'IN (x.x.x.x, y.y.y.y)' etc., if you have multiple addresses you need to look at.

SELECT Interfaces.Uri, Interfaces.DisplayName FROM Orion.NPM.Interfaces AS Interfaces
INNER JOIN
(
SELECT InterfaceID
FROM Orion.Netflow.FlowsByInterface
WHERE
(TimeStamp >= AddMinute(-5, DateTrunc('minute', GetUtcDate())) AND TimeStamp <= AddMinute(-1, DateTrunc('minute', GetUtcDate())))
AND InterfaceID IN (4697)
AND (ApplicationID IN (106235,104310,104312,100351) AND ApplicationID != 0)
AND (SourceIP = 'x.x.x.x' OR DestinationIP = 'x.x.x.x')
GROUP BY InterfaceID
HAVING ((SUM(IngressBytes)*8) / (5*60)) > 50000000
) AS Flows
ON Flows.InterfaceID = Interfaces.InterfaceID

Everything above would be if you need to trigger the alert looking at specific addresses. You could (in theory... I haven't tested it) remove the ApplicationID match and just look at a subset of addresses that may be hitting over your bandwidth limit for any application.

jreves

Have a look at:https://thwack.solarwinds.com/t5/NTA-Documents/Introducing-the-NTA-2020-2-Release-Candidate-IPAM-IP-Group/ta-p/590017

In this release, we're picking up either endpoints, or IP Groups with the NetFlow alerts. Does that do the job?

#jreves