Palo Alto multi-slot CPU name mappings in SWQL

keoki

I have a custom poller grabbing an array from the OID 1.3.6.1.2.1.25.3.3.1.2.  

On the dashboard for a Palo Alto 7080, the "Universal Device Poller Status" widgit shows my poller as CPULoad, and it shows to have fetched 12 value(s).  If I click on the link under the test "12 value(s)" I see a nice chart, complete with the actual names of the objects, such as "slot 6 Management Processor", "Slot 10 Data Processor", etc...  These names are useful and CORRECT.

However I have a requirement to export the values, as we must track and include in corporate reporting the CPU usage that is related to specific applications, and we MUST exclude things like the management processors and log processors.  So when I retrieve the values from swql, I am able to pull the array holding all of the cpu slots, but the CPUs are presented in a different order, and because some of the CPUs are load balanced, we can't tell the slots apart because they look the same.  So what I want to do is find the table that holds the correct slot label for the array, and do a join on those so we can get the correct label in the exported swql data.

Can someone tell me what swql table holds labels for the palo alto card slots?  I assume the data is coming from the MIB, and SolarWinds is using it correctly so I want to do that too...

Thanks!!

Keoki 

keoki

So one of the issues we were seeing is different models of Palo's running different software versions, would show different names for the CPU's.  SolarWinds treats the CPU's as if they are a pool of resources, when in fact they are each specialized in what role they play, and averaging idle CPU's together with saturated CPU's will mask the exhausted resource.  So we monitor the CPU's individually, but there was a misalignment between the indexed position in the SNMP CPU array, and the misalignment changed with model and software version. 

The solution required I pull the labels in for the CPU's, and for charts inside of SolarWinds that was enough.  However we had a legal requirement to pull the CPU stats on a specific category of these CPU's, but I was having a hard time finding the labels...  But I found them finally.  Because on most nodes I wanted the cpu in "slot 2" it should have been easy, but in some nodes there is no slot 2, only multiple slot 1's...  Or on a large chassis, we may have multiple slots to watch with inconsistent alignment between slots and cpu array index.  So getting the cpu name was part of the solution, and part of the solution was mapping out the inconsistent naming convention so that we could report on the CPU of interest, and have it align in naming with what an engineer would see on the Palo Alto command line.  SNMP and the command line did not always agree, and the misalignment varied.

in a custom Universal Device Poller, I had to attach the label to the UDP.  The CPU data is at 1.3.6.1.2.1.25.3.3.1.2  And the label detail is at 1.3.6.1.2.1.25.3.2.1.3.  Getting the label detail into the UDP solved the issue inside of SolarWinds.  To access the data in SWQL was the thing I was trying to ask here.  The answer to my original question is "Orion.NPM.CustomPollerStatusOnNodeTabular RowLabel".  The whole SWQL query is:

SELECT A.Caption, C.Status, C.RowLabel
FROM Orion.Nodes A
JOIN Orion.NPM.CustomPollerAssignmentOnNode B ON B.NodeID = A.NodeID
JOIN Orion.NPM.CustomPollerStatusOnNodeTabular C ON C.CustomPollerAssignmentID = B.CustomPollerAssignmentID
Where A.Vendor = 'Palo Alto Networks'

This was not a perfect answer because Palo Alto builds labels using an inconsistent naming convention that changes by model and software version.  So two almost identical nodes can have different labels, and they were subject to change when software updates rolled out.  So once the swql query is run, additional work needs to be done to interpret the label and apply an internally consistent naming convention that matches what is seen on the Palo Alto command line.  I won't include that here because it is not my code, and is specific to a proprietary requirement that we have here.

My thanks to the SolarWinds support staff, I asked for their help, and was not the best customer because of my own access limitations to the SolarWinds servers, I could not reliably supply them with answers to their questions.