SWQL: CPU Monitoring with sustained threshold

Question

Hi,

I was wondering if there is a way to add a 'sustained' threshold for CPU monitoring with a SWQL query.

I wanted to create a CPU Monitoring dashboard that will trigger when the CPU load has reached a 90% threshold + sustained for over 30 minutes.

I created this simple dashboard, however, it's only reporting in near real-time.

select n.caption AS [Nodes],'/Orion/NetPerfMon/NodeDetails.aspx?NetObject=N:' + ToString(n.nodeid) AS [_LinkFor_Nodes],

n.CPULoad as [CPULoad]

,'/Orion/NetPerfMon/NodeDetails.aspx?NetObject=N:' + ToString(n.nodeid) AS [_LinkFor_CPULoad]

,Case

WHEN n.CPULoad < '89' THEN ('/Orion/images/ActiveAlerts/Warning.png')

WHEN n.CPULoad > '90' THEN ('/Orion/images/ActiveAlerts/Critical.png')

End as [_IconFor_CPULoad],

cp.Application_Function, cp.Asset_Type

from orion.Nodes n

left join orion.NodesCustomProperties cp on n.NodeID = cp.NodeID

where n.CPULoad > '80'

order by n.CPULoad DESC

tdanner · Accepted Answer

Here's a query that returns nodes with their last-polled CPU load and also the lowest CPU poll value they had in the last 30 minutes:

SELECT N.Caption, N.CPULoad, MIN(N.CPULoadHistory.MinLoad) AS MinLoad

FROM Orion.Nodes N

WHERE N.CPULoadHistory.DateTime > ADDMINUTE(-30, GETUTCDATE())

GROUP BY N.Caption, N.CPULoad

ORDER BY N.CPULoad DESC

Top Replies