Custom SWQL Alert : meaning of each DB field ?

Folks :

I am quite new in Solarwinds, and I need to create an ALERT using a Custom SWQL Query. We have the lattest versions of Orion (2018.4), NPM (12.4), SAM (6.7.1) and a few other modules (not relevant here)

However, when I started testing the SWQL queries (following the advice from a lot of customer suggestions in THWACK) in SWQL Studio, I bumped into this huge Database structure, with no map on what to look for or where, nor the meaning of each field in the database :

SolarWinds Information Service v3.0 Schema Documentation Index

In our case, I need to monitor an HPc7000 (enclosure), and I find in the NODE VIEW the following information automatically filled (magically) by Solarwinds:

Which is great ... however, further down (in the same NODE VIEW) it seems that either Solarwinds can't find some information or the device SNMP agent could be reporting misleading information :

So, I have TWO questions :

1) How can I fix this "OTHER" information in Solarwinds ? I guess this magic is perfomed by some automation in Solarwinds that should be getting from the Enclosure something that Solarwinds translates as "OTHER". I need to understand what is it and how to make it right.

2) How / where I can find a decent explanation on the meaning of each field in the SWQL tables that I need to query in order to trigger an ALERT ? WHAT I NEED is to creat an ALERT based on the status of each HW component of the Enclosure. Since this status is already in Solarwinds (Node View) I don't need to create a Poller, right ?, so SWQL query seems the way to go ...

After a bit of testing with SWQL, I found this table "Orion.HardwareHealth.HardwareItem" that, apparently (my asumption, since there is no documentation on this), contains part of the information magically gathered by Solarwinds of my enclosure. In this table, the field "Value" seems to contain the Temperature measured (when the sensor is Temperature) or the WATTS (in the case of the Power Supply) and "OriginalStatus" seems to contain the "OK" status (when the sensor is OK).

Another table "Orion.HardwareHealth.HardwareInfo" includes the field "CategoriesWithStatus" includes a fairly long summary of the status of each component :

"Chassis (Up): Blade Chassis overall condition (Up)

CMC (Up): Enclosure Manager 4.85 sensor 1 (Up), Enclosure Manager 4.85 sensor 2 (Up)

Fan (Up): Enclosure Fan sensor 1 (Up), Enclosure Fan sensor 10 (Up), Enclosure Fan sensor 2 (Up), Enclosure Fan sensor 3 (Up), Enclosure Fan sensor 4 (Up), Enclosure Fan sensor 5 (Up), Enclosure Fan sensor 6 (Up), Enclosure Fan sensor 7 (Up), Enclosure Fan sensor 8 (Up), Enclosure Fan sensor 9 (Up)

Power Supply (Up): Enclosure Power Supply sensor 1 (Up), Rack Power Supply sensor 1 (Up), Rack Power Supply sensor 2 (Up), Rack Power Supply sensor 3 (Up), Rack Power Supply sensor 4 (Up), Rack Power Supply sensor 5 (Up), Rack Power Supply sensor 6 (Up)

Temperature (Up): Blade Bay sensor 12 (Unknown), Blade Bay sensor 13 (Unknown), Blade Bay sensor 14 (Unknown), Blade Bay sensor 4 (Unknown), Blade Bay sensor 5 (Unknown), Blade Bay sensor 6 (Unknown), Chassis sensor 1 (Up), Interconnect Tray sensor 52 (Unknown), Interconnect Tray sensor 53 (Unknown), Interconnect Tray sensor 54 (Unknown), Interconnect Tray sensor 55 (Unknown), Interconnect Tray sensor 56 (Unknown), Interconnect Tray sensor 57 (Unknown), System sensor 2 (Up), System sensor 3 (Up)"

An another field "CategoriesWithProblems" is empty, and I assume that this field could be populated by Solarwinds when "a problem with one of the sensors presents"

QUESTION : Is it so ? Are my assumptions correct ?

Where can I find some pointers on how to proceed to fix 1) and find a solution for 2) ?

Regards

Arturo

Find more posts tagged with

swql query

hardware sensors

node view

hardware status

advanced alerting

Accepted answers

All comments

mesverrum

There is no public documentation of how solarwinds populates any of the values in there, you just learn it by trial and error if you are brave enough to go in there mucking around. I would say that in this case I would be reluctant to even attempt a SQL/SWQL based resolution to the issue you are seeing because that data is polled every few minutes, whatever you cooked up would just get replaced at the next interval unless you got really into the weeds with doing things like setting up database triggers to overwrite the data every time it gets updated, and that kind of stuff is extremely hackish.

So if I recognize your screenshots correctly i believe thats from the new UCS integration. I'd START my investigation by doing an SNMP walk of the management controller itself and identifying which OID gets you these temperature readings and confirm that whatever you get in SNMP matches more or less with what Solarwinds is showing you. If SNMP shows those sensors in some kind of unknown/other state the SW is just showing you whats going on IRL and you would have to investigate with Cisco regarding what might cause a the blade bay temp sensors to report those conditions. If they are reporting back legit values then I would take that SNMP walk and open a ticket with SW and just have the fix it in the next release.

I've worked with SW products for a long while now and in NEARLY every case that I have seen weird stuff in Solarwinds it came back to the device in question reporting garbage in SNMP and Solarwinds just passing along the data that they get. They seem to adhere pretty strictly to a philosophy of not trying to interpret things in the software, they just relay whatever Cisco or HP or whoever shows them in SNMP. That way they are not on the hook for "misinterpreting" the data.

arturom

Thanks Mesverrum !

In this case, the screenshots are from an HPc7000 Enclosure, but the idea is the same.

So I guess your suggestion is "don't create ALERTS based on SWQL, since that is not documented & could change from release to release" ? Correct ?

If it is : What would be the alternative to monitor / ALERT those values ? Create a Poller with the Poller Studio, using the SNMP values from the enclosure ? I thought duplicating the SNMP query wasn't right, but it is what it is !

Cheers

mesverrum

Actually swql is intentionally set up as an abstraction layer between the users and the database, so they can change the back end as much as need between releases and the SWQL equivalent objects will just get remapped to wherever things end up in SQL.

When it comes to hardware alerts there is a pretty reasonable out of the box alert on hardware sensors that are either critical or warning. I would most likely take that as my starting point and then tweak it to suit the environment. I am pretty seriously inclined to not spend time chasing down sensors that don't report their data, but if you do then like I said, SNMP walk the device and validate the raw results to decide what the course of action should be.

arturom

Thanks mate !

- I already did the SNMP Walk on the device, and yes, you are correct that he HPc7000 SNMP Agent is reporting garbage (lack of configuration, something I am fixing in the HP SNMP agent, as it should be done), so that is fine : once I fix that on the HP SNMP Agent, SW should have that status information properly in the NODE VIEW (as in the images attached), right ?

My question now is : what would you suggest to do in order to have ALERTS set up based on the Monitored status of this box ?

1.- Should try to avoid doing in SW "my own SNMP Poller" for my HP Enclosure to gather the SNMP status and alert on them ? (since that information is already polled by SW) or

2.- Should I try to create the ALERT via an SWQL query to gather the "OK/NOT OK" information on each sensor (already in the Orion DB) ?

Also, the lack of formal documentation from SW on what each table/field means makes total sense with your comments (i.e. SW doesn't want people creating actions / ALERTS based on changes on certain tables/fields, since that can change from release to release), however I wonder : why then SW includes as an alternative to create ALARMs "Custome SQL / SWQL query" ? Does that makes sense ?

Cheers

arturom

Thanks again for your comments and suggestions.

However, at least in this case, SW seems to offer out of the box the "Node Details view" I already mentioned with the status information for the Enclosure, BUT I don't see any pre configured harware sensor ALERT in this case.

What are the options in this case, in your opinion ?

Regards

arturom

Thanks mate !

However, I don't see where are the "out of the box alerts" in the case of this enclosures. I can see the "Node view" showing the relevant HW status information, and my problem is preciselly that : how to create the alerts from that Node View (that is : Solarwinds obviously knows how to automatically check this HW) but I have no clues on how to create the ALERTS ...

Any pointers ?

Regards