6 Replies Latest reply on Aug 21, 2015 6:40 AM by tom.rybka

    SWQL query timeout

    ipstar

      How to increase timeout with error?

      Thanks

       

      Capture.PNG

        • Re: SWQL query timeout
          tdanner

          Can you give us some more context? Do some queries work but more complex ones give this timeout error? Or do you get this right away when you run SWQL Studio?

            • Re: SWQL query timeout
              ipstar

              It took about 2 minutes before error.

              Today it to be this error instead.

               

              2015-08-19 22:00:23,354 [51] ERROR SolarWinds.InformationService.Core.InformationService - SWQL Studio Exception caught in method RunQuery

              System.Exception: Error while executing FastBit query: 'SELECT ApplicationID AS C1, CASE WHEN ((Flags&3)<>0) THEN Bytes ELSE 0 END AS C2, CASE WHEN (SourceIP<DestinationIP) THEN DestinationAS ELSE SourceAS END AS C3, CASE WHEN (SourceIP<DestinationIP) THEN DestinationCountry ELSE SourceCountry END AS C4, CASE WHEN (SourceIP<DestinationIP) THEN DestinationDomain ELSE SourceDomain END AS C5, CASE WHEN (SourceIP<DestinationIP) THEN DestinationHostname ELSE SourceHostname END AS C6, CASE WHEN (SourceIP<DestinationIP) THEN DestinationIP ELSE SourceIP END AS C7, CASE WHEN (SourceIP<DestinationIP) THEN DestinationIPGroupSegmentID ELSE SourceIPGroupSegmentID END AS C8, CASE WHEN ((Flags&1)<>0) THEN InterfaceIDRx ELSE 0 END AS C9, CASE WHEN ((Flags&2)<>0) THEN InterfaceIDTx ELSE 0 END AS C10, NodeID AS C11, CASE WHEN ((Flags&3)<>0) THEN Packets ELSE 0 END AS C12, Port AS C13, Protocol AS C14, CASE WHEN (SourceIP<DestinationIP) THEN SourceAS ELSE DestinationAS END AS C15, CASE WHEN (SourceIP<DestinationIP) THEN SourceCountry ELSE DestinationCountry END AS C16, CASE WHEN (SourceIP<DestinationIP) THEN SourceDomain ELSE DestinationDomain END AS C17, CASE WHEN (SourceIP<DestinationIP) THEN SourceHostname ELSE DestinationHostname END AS C18, CASE WHEN (SourceIP<DestinationIP) THEN SourceIP ELSE DestinationIP END AS C19, CASE WHEN (SourceIP<DestinationIP) THEN SourceIPGroupSegmentID ELSE DestinationIPGroupSegmentID END AS C20, TimeStamp AS C21, ToS AS C22, TimeStamp AS C23, 0+0 AS C24, CASE WHEN ((Flags&1)<>0) THEN Bytes ELSE 0 END AS C25, CASE WHEN ((Flags&2)<>0) THEN Bytes ELSE 0 END AS C26, CASE WHEN ((Flags&1)<>0) THEN Packets ELSE 0 END AS C27, CASE WHEN ((Flags&2)<>0) THEN Packets ELSE 0 END AS C28, (CASE WHEN ((Flags&1)<>0) THEN Bytes ELSE 0 END+CASE WHEN ((Flags&2)<>0) THEN Bytes ELSE 0 END) AS C29, (CASE WHEN ((Flags&1)<>0) THEN Packets ELSE 0 END+CASE WHEN ((Flags&2)<>0) THEN Packets ELSE 0 END) AS C30, CASE WHEN ((Flags&8)=0) THEN ApplicationID ELSE 100001 END AS C31, CASE WHEN ((Flags&8)=0) THEN 1 ELSE 0 END AS C32

              FROM Flows

              WHERE (((Flags&3)<>0))'. Ended with error: There was an error reading from the pipe: The pipe has been ended. (109, 0x6d).

                 at SolarWinds.Data.Providers.Orion.Netflow.FastBit.QueryRelation.SelectQueryRelation.<GetEnumerator>d__8.MoveNext()

                 at SolarWinds.Data.Query.PhysicalQueryPlan.ProjectOp.<GetEnumeratorInternal>d__0.MoveNext()

                 at SolarWinds.Data.Query.PhysicalQueryPlan.PhysicalQueryPlan.<GetEnumerator>d__0.MoveNext()

                 at SolarWinds.InformationService.Serialization.XmlResponseSerializerSimple..ctor(IQueryResultReader reader, Boolean includeQueryPlan)

                 at SolarWinds.InformationService.Serialization.XmlSerializer.GetSerializer()

                 at SolarWinds.InformationService.Serialization.XmlSerializer.PrepareSerialize(IQueryExpr query, ISchema schema, IQueryResultReader reader)

                 at SolarWinds.InformationService.Core.InformationService.RunQuery(String query, IDictionary`2 parameters, IDataSerializer serializer)

                • Re: SWQL query timeout
                  tdanner

                  Ok, that helps. What was the original SWQL query? And what version of NTA are you using?

                    • Re: SWQL query timeout
                      ipstar

                      Query

                       

                      SELECT ApplicationID, Bytes, DestinationASID, DestinationCountryCode, DestinationDomain, DestinationHostname, DestinationIP, DestinationIPGroupSegmentID, InterfaceIDRx, InterfaceIDTx, NodeID, Packets, Port, ProtocolID, SourceASID, SourceCountryCode, SourceDomain, SourceHostname, SourceIP, SourceIPGroupSegmentID, TimeStamp, ToSID, ObservationTimestamp, Description, IngressBytes, EgressBytes, IngressPackets, EgressPackets, TotalBytes, TotalPackets, EnabledApplicationID, ApplicationEnabled

                      FROM Orion.Netflow.Flows

                       

                      Capture.PNG

                        • Re: SWQL query timeout
                          tdanner

                          "Orion.Netflow.Flows" represents every flow record in the system. Your query is requesting NTA to simply return all of them. I'm not surprised it timed out, but even if it had completed that wouldn't be a useful result. You need a WHERE clause. I would start with filtering on the TimeStamp property to a narrow range.

                          • Re: SWQL query timeout
                            tom.rybka

                            The SWIS entity model is designed for summarization/reporting purposes, it has not been meant to be used for dumping flows. Adding more filtering, especially by TimeStamp property, is really good start. Also, GROUP BY clause aggregating data by certain properties is a typical construct used in reports. What is your specific intention you want to express by a query?