We have an interface alert that showed a switch interface was down around 4am this morning (11:08 UTC time). I can see that entry in the InterfaceNetObjectDowntime table using a query I found on THWACK.
SELECT N.CAption as Device, I.Caption as Interface, INOD.DateTimeFrom, INOD.DateTimeUntilNow,
- INOD.State, INOD.TotalDurationMin, I.CustomProperties.Comments, I.InterfaceSpeed as Bandwidth
FROM Orion.NPM.InterfaceNetObjectDowntime INOD left join Orion.NPM.Interfaces I on INOD.EntityID = I.InterfaceID left join Orion.nodes N on I.NodeID = N.Nodeid
where INOD.entitytype = 'Orion.NPM.Interfaces'
and INOD.State in (2,3,4,5,6,7,8,9,10)
and month(INOD.DateTimeFrom) = MONTH(GETUTCDATE()) and year(INOD.DateTimeFrom) = year(GETUTCDATE()) And DAY(INOD.DateTimeFrom) = DAY(GETUTCDATE())
And Device like '%IDAHO7K1-AGG-USER-1%'
order by Device, Interface, Inod.DateTimeFrom
I can see the interface is polled every 120 seconds, statistics are every ten minutes, so I'm assuming the device down entry is based on the polling. Is that polling information stored in a database table I can query with SWQL? I've been poking around all morning but haven't been able to find polling information for the interface, only the device (switch).
Thanks
Jim