# macros.conf ############## # NMON index # ############## ##### Customization #### # The default model implements a dual index notion: # "nmon_events": for all regular events (index type: Events) # "nmon_metrics": for all metrics indexed as native metrics (index type: Metrics) # You can easily have your own indexes naming convention and/or have more than the 2 defaults indexes (ex. split between Production and non Production) # To achieve this, simply create your local/macros.conf and customize the indexes definition up to your needs ######################## # This should match all indexes, events and metrics [nmon_index] definition = index="os-unix-nmon-*" iseval = 0 # This should match all indexes, events and metrics [nmon_idx] definition = idx="os-unix-nmon-*" iseval = 0 # metrics indexes, the definition should match all nmon events indexes [nmon_events_index] definition = index="os-unix-nmon-events*" iseval = 0 # metrics indexes, the definition should match all metrics indexes [nmon_metrics_index] definition = index="os-unix-nmon-metrics*" iseval = 0 ######################################## # auto-refresh ######################################## # This macro is used to define the options available for auto-refresh in dashboards, their order, the default selection and behaviour when looking at past data. # You can transparently customize the macro to match your needs and requirements, if for example you prefer to have no auto refresh by default, or a different value than the one provided by default # If you need to so, create a local copy of the macro bellow and modify it up to your needs. # - The "none" should not be removed, but its default priority can be changed # - the evaluation will ensure that if the user is looking at past period, the auto-refresh is deactivated automatically as it would be point less # - The final order is sorted by priority, from the biggest to the lowest value [def_auto_refresh] definition = makeresults | eval label="30 sec", value="30s", priority=5\ | append [ | makeresults | eval label="1 min", value="60s", priority=4 ]\ | append [ | makeresults | eval label="5 min", value="300s", priority=3 ]\ | append [ | makeresults | eval label="none", value="0", priority=0 ]\ | addinfo | fields - _time\ | eval now=now(), delta_now=(now - info_max_time), is_past_search=if((delta_now >= 300),"true","false"), priority=if(((label == "none") AND (is_past_search == "true")),100,priority)\ | sort 0 - priority\ | fields label,value,priority iseval = 0 ######################################## # metric filters macros ######################################## # Using wildcards have performance hits within metric filters # as much as possible we avoid this # CPU filters for all OS [def_cpu_all_os_metric_filters] definition = metric_name=os.unix.nmon.cpu.cpu_all.Sys_PCT\ OR metric_name=os.unix.nmon.cpu.cpu_all.User_PCT\ OR metric_name=os.unix.nmon.cpu.cpu_all.Wait_PCT\ OR metric_name=os.unix.nmon.cpu.cpu_all.Idle_PCT\ OR metric_name=os.unix.nmon.cpu.cpu_all.Steal_PCT\ OR metric_name=os.unix.nmon.cpu.lpar.VP_Sys_PCT\ OR metric_name=os.unix.nmon.cpu.lpar.VP_User_PCT\ OR metric_name=os.unix.nmon.cpu.lpar.VP_Wait_PCT\ OR metric_name=os.unix.nmon.cpu.lpar.VP_Idle_PCT\ OR metric_name=os.unix.nmon.cpu.lpar.entitled\ OR metric_name=os.unix.nmon.cpu.lpar.virtualCPUs iseval = 0 # memory filters for Linux OS [def_memory_linux_metric_filters] definition = metric_name=os.unix.nmon.memory.mem.memtotal\ OR metric_name=os.unix.nmon.memory.mem.active\ OR metric_name=os.unix.nmon.memory.mem.inactive\ OR metric_name=os.unix.nmon.memory.mem.buffers\ OR metric_name=os.unix.nmon.memory.mem.cached\ OR metric_name=os.unix.nmon.memory.mem.memfree\ OR metric_name=os.unix.nmon.memory.mem.swapcached\ OR metric_name=os.unix.nmon.memory.mem.swaptotal\ OR metric_name=os.unix.nmon.memory.mem.swapfree iseval = 0 # memory filters for AIX OS [def_memory_AIX_metric_filters] definition = metric_name=os.unix.nmon.memory.memnew.System_PCT\ OR metric_name=os.unix.nmon.memory.memnew.Process_PCT\ OR metric_name=os.unix.nmon.memory.mem.Real_total_MB\ OR metric_name=os.unix.nmon.memory.mem.Virtual_free_MB\ OR metric_name=os.unix.nmon.memory.mem.Virtual_free_PCT\ OR metric_name=os.unix.nmon.memory.mem.Virtual_total_MB iseval = 0 # physical memory filters for All OS [def_phys_memory_all_os_metric_filters] definition = metric_name=os.unix.nmon.memory.mem.memtotal\ OR metric_name=os.unix.nmon.memory.mem.active\ OR metric_name=os.unix.nmon.memory.mem.inactive\ OR metric_name=os.unix.nmon.memory.mem.buffers\ OR metric_name=os.unix.nmon.memory.mem.cached\ OR metric_name=os.unix.nmon.memory.mem.memfree\ OR metric_name=os.unix.nmon.memory.memnew.System_PCT\ OR metric_name=os.unix.nmon.memory.memnew.Process_PCT\ OR metric_name=os.unix.nmon.memory.mem.Real_total_MB iseval = 0 # physical and virtual memory filters for All OS [def_memory_all_os_metric_filters] definition = metric_name=os.unix.nmon.memory.mem.memtotal\ OR metric_name=os.unix.nmon.memory.mem.active\ OR metric_name=os.unix.nmon.memory.mem.inactive\ OR metric_name=os.unix.nmon.memory.mem.buffers\ OR metric_name=os.unix.nmon.memory.mem.cached\ OR metric_name=os.unix.nmon.memory.mem.memfree\ OR metric_name=os.unix.nmon.memory.memnew.System_PCT\ OR metric_name=os.unix.nmon.memory.memnew.Process_PCT\ OR metric_name=os.unix.nmon.memory.memnew.FScache_PCT\ OR metric_name=os.unix.nmon.memory.mem.Real_total_MB\ OR metric_name=os.unix.nmon.memory.mem.swapcached\ OR metric_name=os.unix.nmon.memory.mem.swaptotal\ OR metric_name=os.unix.nmon.memory.mem.swapfree\ OR metric_name=os.unix.nmon.memory.mem.Virtual_total_MB\ OR metric_name=os.unix.nmon.memory.mem.Virtual_free_MB iseval = 0 # lpar filters for AIX OS [def_lpar_AIX_metric_filters] definition = metric_name=os.unix.nmon.cpu.lpar.VP_Sys_PCT\ OR metric_name=os.unix.nmon.cpu.lpar.VP_User_PCT\ OR metric_name=os.unix.nmon.cpu.lpar.VP_Wait_PCT\ OR metric_name=os.unix.nmon.cpu.lpar.VP_Idle_PCT\ OR metric_name=os.unix.nmon.cpu.lpar.EC_Sys_PCT\ OR metric_name=os.unix.nmon.cpu.lpar.EC_User_PCT\ OR metric_name=os.unix.nmon.cpu.lpar.EC_Wait_PCT\ OR metric_name=os.unix.nmon.cpu.lpar.EC_Idle_PCT\ OR metric_name=os.unix.nmon.cpu.lpar.entitled\ OR metric_name=os.unix.nmon.cpu.lpar.virtualCPUs iseval = 0 ######################################## # metric definitions macros ######################################## # Generic metrics extraction [extract_metrics] definition = rex field="metric_name" ".(?[\w|\-|\_]*)$" iseval = 0 # Generic metrics extraction with the fields list in argument [extract_metrics(1)] args = fields_list definition = `extract_metrics`\ | foreach $fields_list$ [ eval "<>" = case(metric="<>", value) ] iseval = 0 # Extract metrics for cpu_all [extract_metrics_cpu_all(1)] args = fields_list definition = rex field="metric_name" "os\.unix\.nmon\.\w*\.\w*\.(?\w*)\.(?\w*)"\ | foreach $fields_list$ [ eval "<>" = case(metric="<>", value) ] iseval = 0 # Extract metrics for dimensions and create a key field per metric / dimension [extract_metrics_by_key] definition = rex field=metric_name ".(?[\w|\-|\_]*)$"\ | eval key = metric . ":" . dimension_device iseval = 0 # All these macros are used to reduce searches complexity in various dashboards # the macros are expected to be used after the mstats command # define the standard cpu load in percent [def_cpu_load_percent] definition = eval Sys_percent=case(metric_name=="os.unix.nmon.cpu.cpu_all.Sys_PCT", value), User_percent=case(metric_name=="os.unix.nmon.cpu.cpu_all.User_PCT", value), Wait_percent=case(metric_name=="os.unix.nmon.cpu.cpu_all.Wait_PCT", value), Steal_percent=case(metric_name=="os.unix.nmon.cpu.cpu_all.Steal_PCT", value)\ | stats values(Sys_percent) as Sys_percent, values(User_percent) as User_percent, values(Wait_percent) as Wait_percent, values(Steal_percent) as Steal_percent by _time, host\ | fillnull value=0 Sys_percent,User_percent,Wait_percent,Steal_percent\ | eval cpu_load_percent=(Sys_percent+User_percent+Wait_percent+Steal_percent)\ | fields _time, host, cpu_load_percent iseval = 0 # define the lpar (AIX or Linux) VP load in percent [def_lpar_load_percent] definition = `extract_metrics`\ | eval {metric}=value\ | stats values(VP_User_PCT) as VP_User_PCT, values(VP_Sys_PCT) as VP_Sys_PCT, values(VP_Wait_PCT) as VP_Wait_PCT, values(VP_Idle_PCT) as VP_Idle_PCT, values(PhysicalCPU) as PhysicalCPU, values(virtualCPUs) as virtualCPUs values(partition_active_processors) as partition_active_processors by _time, OStype, host\ | fillnull value=0 VP_User_PCT,VP_Sys_PCT,VP_Wait_PCT,VP_Idle_PCT,PhysicalCPU,partition_active_processors\ | eval lpar_load_percent = case(OStype=="AIX", round((VP_User_PCT+VP_Sys_PCT+VP_Wait_PCT+VP_Idle_PCT),2), OStype=="Linux", round((PhysicalCPU/partition_active_processors*100),2))\ | fields _time, host, lpar_load_percent iseval = 0 # define the merged cpu_all / lpar load in percent [def_all_os_cpu_load_percent] definition = `extract_metrics`\ | eval {metric}=value\ | stats values(Sys_PCT) as Sys_PCT, values(User_PCT) as User_PCT, values(Wait_PCT) as Wait_PCT, values(Steal_PCT) as Steal_PCT, values(VP_User_PCT) as VP_User_PCT, values(VP_Sys_PCT) as VP_Sys_PCT, values(VP_Wait_PCT) as VP_Wait_PCT, values(VP_Idle_PCT) as VP_Idle_PCT, values(PhysicalCPU) as PhysicalCPU, values(virtualCPUs) as virtualCPUs values(partition_active_processors) as partition_active_processors by _time, OStype, host\ | fillnull value=0 Sys_PCT,User_PCT,Wait_PCT,Steal_PCT,VP_User_PCT,VP_Sys_PCT,VP_Wait_PCT,VP_Idle_PCT,PhysicalCPU,partition_active_processors\ | eval cpu_all_load_percent=(Sys_PCT+User_PCT+Wait_PCT+Steal_PCT), lpar_load_percent = case(OStype=="AIX", round((VP_User_PCT+VP_Sys_PCT+VP_Wait_PCT+VP_Idle_PCT),2), OStype=="Linux", round((PhysicalCPU/partition_active_processors*100),2))\ | eventstats count(eval(lpar_load_percent>0)) as count_lpar by host\ | eval cpu_load_percent=if(count_lpar>0, lpar_load_percent, cpu_all_load_percent)\ | fields _time, host, cpu_load_percent iseval = 0 # define the merged cpu_all / lpar load in percent by category [def_all_os_cpu_load_percent_by_category] definition = `extract_metrics`\ | eval {metric}=value\ | stats values(Sys_PCT) as Sys_PCT, values(User_PCT) as User_PCT, values(Wait_PCT) as Wait_PCT, values(Idle_PCT) as Idle_PCT, values(Steal_PCT) as Steal_PCT, values(VP_User_PCT) as VP_User_PCT, values(VP_Sys_PCT) as VP_Sys_PCT, values(VP_Wait_PCT) as VP_Wait_PCT, values(VP_Idle_PCT) as VP_Idle_PCT by _time, host\ | eventstats count(eval(VP_Sys_PCT>0)) as count_lpar by host\ | fillnull value=0 Sys_PCT User_PCT Wait_PCT Steal_PCT VP_User_PCT VP_Sys_PCT VP_Wait_PCT VP_Idle_PCT\ | eval Sys_PCT=if(OStype=="AIX" AND count_lpar>0, VP_Sys_PCT, Sys_PCT),\ User_PCT=if(OStype=="AIX" AND count_lpar>0, VP_Sys_PCT, Sys_PCT),\ Wair_PCT=if(OStype=="AIX" AND count_lpar>0, VP_Wait_PCT, Wait_PCT),\ Idle_PCT=if(OStype=="AIX" AND count_lpar>0, VP_Idle_PCT, Idle_PCT) iseval = 0 # define the cpu_all load in percent by category [def_cpu_all_cpu_load_percent_by_category] definition = `extract_metrics`\ | eval {metric}=value\ | stats values(Sys_PCT) as Sys_PCT, values(User_PCT) as User_PCT, values(Wait_PCT) as Wait_PCT, values(Idle_PCT) as Idle_PCT by _time, host iseval = 0 # define the lpar (AIX or Linux) VP load in cores [def_lpar_load_cores] definition = `extract_metrics`\ | eval {metric}=value\ | stats values(VP_User_PCT) as VP_User_PCT, values(VP_Sys_PCT) as VP_Sys_PCT, values(VP_Wait_PCT) as VP_Wait_PCT, values(VP_Idle_PCT) as VP_Idle_PCT, values(PhysicalCPU) as PhysicalCPU, values(entitled) as entitled, values(virtualCPUs) as virtualCPUs by _time, OStype, host\ | fillnull value=0 VP_User_PCT VP_Sys_PCT VP_Wait_PCT VP_Idle_PCT PhysicalCPU entitled virtualCPUs\ | eval lpar_load_cores=case(OStype=="AIX", round(((VP_User_PCT+VP_Sys_PCT+VP_Wait_PCT+VP_Idle_PCT)*virtualCPUs/100),3), OStype=="Linux", round(PhysicalCPU,3)) iseval = 0 # define the lpar (Linux) VP load in cores [def_lpar_load_linux_cores] definition = `extract_metrics`\ | eval {metric}=value\ | stats values(PhysicalCPU) as lpar_load_cores, values(partition_active_processors) as partition_active_processors, values(partition_entitled_capacity) as partition_entitled_capacity by _time, host iseval = 0 # define the lpar (Linux) VP load in percent [def_lpar_load_linux_percent] definition = `extract_metrics`\ | eval {metric}=value\ | stats values(PhysicalCPU) as PhysicalCPU, values(partition_active_processors) as partition_active_processors, values(partition_entitled_capacity) as partition_entitled_capacity by _time, host\ | fillnull value=0 PhysicalCPU partition_active_processors\ | eval lpar_load_percent = round((PhysicalCPU/partition_active_processors*100),2) iseval = 0 ############ # AIX only # ############ # define the lpar (AIX) VP load in cores [def_lpar_load_vp_aix_cores] definition = `extract_metrics`\ | eval {metric}=value\ | stats values(VP_User_PCT) as VP_User_PCT, values(VP_Sys_PCT) as VP_Sys_PCT, values(VP_Wait_PCT) as VP_Wait_PCT, values(VP_Idle_PCT) as VP_Idle_PCT, values(entitled) as entitled, values(virtualCPUs) as virtualCPUs by _time, host\ | fillnull value=0 VP_User_PCT VP_Sys_PCT VP_Wait_PCT VP_Idle_PCT entitled virtualCPUs\ | eval lpar_load_cores=round(((VP_User_PCT+VP_Sys_PCT+VP_Wait_PCT+VP_Idle_PCT)*virtualCPUs/100),3) iseval = 0 # define the lpar (AIX) VP load in percent [def_lpar_load_vp_aix_percent] definition = `extract_metrics`\ | eval {metric}=value\ | stats values(VP_User_PCT) as VP_User_PCT, values(VP_Sys_PCT) as VP_Sys_PCT, values(VP_Wait_PCT) as VP_Wait_PCT, values(VP_Idle_PCT) as VP_Idle_PCT by _time, host\ | fillnull value=0 VP_User_PCT VP_Sys_PCT VP_Wait_PCT VP_Idle_PCT\ | eval lpar_load_percent = round((VP_User_PCT+VP_Sys_PCT+VP_Wait_PCT+VP_Idle_PCT),2)\ | fields _time, host, lpar_load_percent iseval = 0 # define the lpar (AIX) EC load in cores [def_lpar_load_ec_aix_cores] definition = `extract_metrics`\ | eval {metric}=value\ | stats values(EC_User_PCT) as EC_User_PCT, values(EC_Sys_PCT) as EC_Sys_PCT, values(EC_Wait_PCT) as EC_Wait_PCT, values(EC_Idle_PCT) as EC_Idle_PCT, values(entitled) as entitled, values(virtualCPUs) as virtualCPUs by _time, host\ | fillnull value=0 EC_User_PCT EC_Sys_PCT EC_Wait_PCT EC_Idle_PCT virtualCPUs entitled\ | eval lpar_load_cores=round(((EC_User_PCT+EC_Sys_PCT+EC_Wait_PCT+EC_Idle_PCT)*virtualCPUs/100),3) iseval = 0 # define the lpar (AIX) EC load in percent [def_lpar_load_ec_aix_percent] definition = `extract_metrics`\ | eval {metric}=value\ | stats values(EC_User_PCT) as EC_User_PCT, values(EC_Sys_PCT) as EC_Sys_PCT, values(EC_Wait_PCT) as EC_Wait_PCT, values(EC_Idle_PCT) as EC_Idle_PCT by _time, host\ | fillnull value=0 EC_User_PCT EC_Sys_PCT EC_Wait_PCT EC_Idle_PCT virtualCPUs entitled\ | eval lpar_load_percent = round((EC_User_PCT+EC_Sys_PCT+EC_Wait_PCT+EC_Idle_PCT),2)\ | fields _time, host, lpar_load_percent iseval = 0 # define the lpar (AIX) VP load in cores with entitlement and VirtualCPUs [def_lpar_load_aix_cores_by_cat] definition = `extract_metrics`\ | eval {metric}=value\ | stats values(VP_User_PCT) as VP_User_PCT, values(VP_Sys_PCT) as VP_Sys_PCT, values(VP_Wait_PCT) as VP_Wait_PCT, values(VP_Idle_PCT) as VP_Idle_PCT, values(entitled) as entitled, values(virtualCPUs) as virtualCPUs by _time, OStype, host iseval = 0 # define the lpar (AIX) Pool VP load in cores [def_lpar_pool_load_aix_cores] definition = `extract_metrics`\ | eval {metric}=value\ | stats values(poolCPUs) as poolCPUs, values(Pool_id) as Pool_id, values(PoolIdle) as PoolIdle by _time, host\ | fillnull value=0 poolCPUs PoolIdle\ | eval lpar_pool_usage = round((poolCPUs-PoolIdle),3) iseval = 0 # define the lpar (AIX) Pool VP load in percentage of capacity [def_lpar_pool_load_aix_percent] definition = `extract_metrics`\ | eval {metric}=value\ | stats values(poolCPUs) as poolCPUs, values(Pool_id) as Pool_id, values(PoolIdle) as PoolIdle by _time, host\ | fillnull value=0 poolCPUs PoolIdle\ | eval lpar_pool_usage_percent = round(((poolCPUs-PoolIdle)*100/poolCPUs),2) iseval = 0 # define the WLM (AIX) statistics [def_wlm_aix_percent] definition = `extract_metrics`\ | eval {metric}=value\ | stats values(wlmcpu) as wlmcpu, values(wlmmem) as wlmmem, values(wlmbio) as wlmbio by _time, host, dimension_device iseval = 0 ############ # Linux only ############ # define the lpar (Linux) Pool VP load in cores [def_lpar_pool_load_linux_cores] definition = `extract_metrics`\ | eval {metric}=value\ | stats values(smt_mode) as smt_mode, values(pool_idle_time) as pool_idle_time, values(pool_capacity) as pool_capacity by _time, host\ | eval lpar_pool_vp_usage = case(pool_idle_time>"0.1" AND pool_idle_time<(pool_capacity/100), round((((pool_capacity/100)-pool_idle_time)/smt_mode),3)) iseval = 0 # table stats report of percentage memory [def_memory_percentage_linux_report] definition = `extract_metrics`\ | eval {metric}=value\ | stats values(memtotal) as memtotal, values(buffers) as buffers, values(active) as active, values(inactive) as inactive, values(cached) as cached, values(memfree) as memfree,\ values(swapcached) as swapcached, values(swaptotal) as swaptotal, values(swapfree) as swapfree by _time, host\ | fillnull value=0 memtotal buffers active inactive cached memfree swapcached swaptotal swapfree\ | eval mem_used_effective=case(isnotnull(cached), round((((((memtotal-(buffers+cached))-memfree))/memtotal)*100),2), isnotnull(memtotal), round((((memtotal-memfree)/memtotal)*100),2))\ | eval mem_free_effective = case(isnotnull(cached), round((((memfree+(buffers+cached))/memtotal)*100),2), isnotnull(memtotal), round(((memfree/memtotal)*100),2))\ | eval swap_used_effective=case(isnotnull(swapcached), round((((((swaptotal-swapfree)-swapcached))/swaptotal)*100),2), isnotnull(swaptotal), round((((swaptotal-swapfree)/swaptotal)*100),2))\ | eval swap_free_effective=case(isnotnull(swapcached), round((((swapfree+swapcached)/swaptotal)*100),2), isnotnull(swapfree), round(((swapfree/swaptotal)*100),2))\ | eval swapcached = case(isnotnull(swapcached), round(((swapcached/swaptotal)*100),2))\ | eval cached = case(isnotnull(cached), round(((cached/memtotal)*100),2)), buffers = case(isnotnull(buffers), round(((buffers/memtotal)*100),2)),\ active = case(isnotnull(active), round(((active/memtotal)*100),2)), inactive = case(isnotnull(inactive), round(((inactive/memtotal)*100),2))\ | fields - memtotal, memfree, memtotal, swaptotal, swapfree\ | stats avg(*) as "*" by host\ | rename "*_PCT" as "*"\ | fields host, "mem*total*", "mem*used*", "mem*free*", active, inactive, buffers, cached, "swap*total*", "swap*used*", "swap*free*", *\ | rename "mem*" AS "mem* (%)", "swap*" AS "swap* (%)", active as "active (%)", inactive as "inactive (%)", buffers as "buffers (%)", cached as "cached (%)"\ | foreach "*%*" [ eval "<>"=round('<>', 2) ] iseval = 0 # table stats report of volume memory [def_memory_volume_linux_report] definition = `extract_metrics`\ | eval {metric}=value\ | stats values(memtotal) as memtotal, values(buffers) as buffers, values(active) as active, values(inactive) as inactive, values(cached) as cached, values(memfree) as memfree,\ values(swapcached) as swapcached, values(swaptotal) as swaptotal, values(swapfree) as swapfree by _time, host\ | fillnull value=0 memtotal buffers active inactive cached memfree swapcached swaptotal swapfree\ | eval mem_used_effective = case(isnotnull(cached), ((memtotal-(buffers+cached))-memfree), isnotnull(memtotal), memtotal-memfree)\ | eval swap_used_effective = case(isnotnull(swapcached), ((swaptotal-swapfree)-swapcached), isnotnull(swaptotal), (swaptotal-swapfree))\ | stats avg(*) as "*" by host\ | fields host, "mem*total*", "mem*used*", "mem*free*", active, inactive, buffers, cached, "swap*total*", "swap*used*", "swap*free*", *\ | rename "mem*" AS "mem* (MB)", "swap*" AS "swap* (MB)", active as "active (MB)", inactive as "inactive (MB)", buffers as "buffers (MB)", cached as "cached (MB)"\ | foreach "*MB*" [ eval "<>"=round('<>', 0) ] iseval = 0 ######## # Others ######## # define the lpar (All OS) Pool VP load in cores [def_all_os_lpar_pool_load_cores] definition = `extract_metrics`\ | eval {metric}=value\ | stats values(poolCPUs) as poolCPUs, values(PoolIdle) as PoolIdle, values(pool_idle_time) as pool_idle_time, values(pool_capacity) as pool_capacity, values(smt_mode) as smt_mode, values(Pool_id) as Pool_id by _time, OStype, host\ | fillnull value=0 poolCPUs PoolIdle pool_idle_time pool_capacity smt_mode Pool_id\ | eval lpar_pool_vp_usage = case(OStype=="AIX", round((poolCPUs-PoolIdle),3), OStype="Linux", case(pool_idle_time>"0.1" AND pool_idle_time<(pool_capacity/100), round((((pool_capacity/100)-pool_idle_time)/smt_mode),3)) ) iseval = 0 # define the lpar (All OS) Pool VP load in percentage of capacity [def_all_os_lpar_pool_load_percent] definition = `extract_metrics`\ | eval {metric}=value\ | stats values(poolCPUs) as poolCPUs, values(PoolIdle) as PoolIdle, values(pool_idle_time) as pool_idle_time, values(pool_capacity) as pool_capacity, values(smt_mode) as smt_mode, values(Pool_id) as Pool_id by _time, OStype, host\ | fillnull value=0 poolCPUs PoolIdle pool_idle_time pool_capacity smt_mode Pool_id\ | eval lpar_pool_vp_usage_PCT = case(OStype=="AIX", round(((poolCPUs-PoolIdle)*100/poolCPUs),2), OStype="Linux", case(pool_idle_time>"0.1" AND pool_idle_time<(pool_capacity/100), round((((pool_capacity/100)-pool_idle_time)/smt_mode)/(pool_capacity/100)*100,2)) ) iseval = 0 # define the lpar load and pool load (All OS) in VP [def_all_os_lpar_load_and_pool_load_cores] definition = `extract_metrics`\ | eval {metric}=value\ | stats values(VP_User_PCT) as VP_User_PCT, values(VP_Sys_PCT) as VP_Sys_PCT, values(VP_Wait_PCT) as VP_Wait_PCT, values(VP_Idle_PCT) as VP_Idle_PCT, values(PhysicalCPU) as PhysicalCPU, values(entitled) as entitled, values(virtualCPUs) as virtualCPUs, values(poolCPUs) as poolCPUs, values(PoolIdle) as PoolIdle, values(pool_idle_time) as pool_idle_time, values(pool_capacity) as pool_capacity, values(smt_mode) as smt_mode, values(Pool_id) as Pool_id by _time, OStype, host\ | fillnull value=0 VP_User_PCT VP_Sys_PCT VP_Wait_PCT VP_Idle_PCT PhysicalCPU entitled virtualCPUs poolCPUs PoolIdle pool_idle_time pool_capacity smt_mode Pool_id\ | eval lpar_load_cores=case(OStype=="AIX", round(((VP_User_PCT+VP_Sys_PCT+VP_Wait_PCT+VP_Idle_PCT)*virtualCPUs/100),3), OStype=="Linux", round(PhysicalCPU,3))\ | eval lpar_pool_vp_usage = case(OStype=="AIX", round((poolCPUs-PoolIdle),3), OStype="Linux", case(pool_idle_time>"0.1" AND pool_idle_time<(pool_capacity/100), round((((pool_capacity/100)-pool_idle_time)/smt_mode),3)) )\ | fields _time, host, lpar_load_cores, lpar_pool_vp_usage iseval = 0 # define for all OS memory and swap usage in percent [def_memory_load_percent] definition = `extract_metrics`\ | eval {metric}=value\ | stats values(System_PCT) as System_PCT, values(Process_PCT) as Process_PCT, values(memtotal) as memtotal, values(buffers) as buffers, values(cached) as cached, values(memfree) as memfree,\ values(Virtual_total_MB) as Virtual_total_MB, values(Virtual_free_MB) as Virtual_free_MB, values(swapcached) as swapcached, values(swaptotal) as swaptotal, values(swapfree) as swapfree by _time, OStype, host\ | fillnull value=0 System_PCT Process_PCT memtotal buffers cached memfree Virtual_total_MB Virtual_free_MB swapcached swaptotal swapfree\ | eval mem_used_effective_PCT=case(OStype == "AIX",round((System_PCT+Process_PCT),2), OStype=="Linux", round((((((memtotal-(buffers+cached))-memfree))/memtotal)*100),2), OStype=="Solaris", round((((memtotal-memfree)/memtotal)*100),2))\ | eval swap_used_effective_PCT=case(OStype=="AIX", round((((Virtual_total_MB-Virtual_free_MB)/Virtual_total_MB)*100),2), OStype=="Linux", round((((((swaptotal-swapfree)-swapcached))/swaptotal)*100),2), OStype=="Solaris", round((((swaptotal-swapfree)/swaptotal)*100),2))\ | fields _time, host, mem_used_effective_PCT, swap_used_effective_PCT iseval = 0 # define for Linux OS memory and swap usage in percent [def_memory_load_percent_linux] definition = `extract_metrics`\ | eval {metric}=value\ | stats values(memtotal) as memtotal, values(buffers) as buffers, values(cached) as cached, values(memfree) as memfree,\ values(swapcached) as swapcached, values(swaptotal) as swaptotal, values(swapfree) as swapfree by _time, host\ | fillnull value=0 memtotal buffers cached memfree swapcached swaptotal swapfree\ | eval mem_used_effective_PCT=round((((((memtotal-(buffers+cached))-memfree))/memtotal)*100),2)\ | eval swap_used_effective_PCT=round((((((swaptotal-swapfree)-swapcached))/swaptotal)*100),2)\ | fields _time, host, mem_used_effective_PCT, swap_used_effective_PCT iseval = 0 # define for all OS memory and swap usage in percent [def_memory_load_percent_all_metrics] definition = `extract_metrics`\ | eval {metric}=value\ | stats values(System_PCT) as System_PCT, values(Process_PCT) as Process_PCT, values(memtotal) as memtotal, values(buffers) as buffers, values(active) as active, values(inactive) as inactive, values(cached) as cached, values(memfree) as memfree,\ values(Virtual_total_MB) as Virtual_total_MB, values(Virtual_free_MB) as Virtual_free_MB, values(swapcached) as swapcached, values(swaptotal) as swaptotal, values(swapfree) as swapfree by _time, OStype, host\ | fillnull value=0 System_PCT Process_PCT memtotal buffers active inactive cached memfree Virtual_total_MB Virtual_free_MB swapcached swaptotal swapfree\ | eval mem_used_effective=case(OStype == "AIX",round((System_PCT+Process_PCT),2), OStype=="Linux", round((((((memtotal-(buffers+cached))-memfree))/memtotal)*100),2), OStype=="Solaris", round((((memtotal-memfree)/memtotal)*100),2))\ | eval mem_free_effective = case((OStype == "AIX"),round((100-(System_PCT+Process_PCT)),2), OStype=="Linux", round((((memfree+(buffers+cached))/memtotal)*100),2), OStype=="Solaris", round(((memfree/memtotal)*100),2))\ | eval swap_used_effective=case(OStype=="AIX", round((((Virtual_total_MB-Virtual_free_MB)/Virtual_total_MB)*100),2), OStype=="Linux", round((((((swaptotal-swapfree)-swapcached))/swaptotal)*100),2), OStype=="Solaris", round((((swaptotal-swapfree)/swaptotal)*100),2))\ | eval swap_free_effective=case(OStype=="AIX", Virtual_free_PCT, OStype=="Linux", round((((swapfree+swapcached)/swaptotal)*100),2), OStype=="Solaris", round(((swapfree/swaptotal)*100),2))\ | eval swapcached = case(OStype=="Linux", round(((swapcached/swaptotal)*100),2))\ | eval cached = case(OStype=="Linux", round(((cached/memtotal)*100),2)), buffers = case(OStype=="Linux", round(((buffers/memtotal)*100),2)),\ active = case(OStype=="Linux", round(((active/memtotal)*100),2)), inactive = case(OStype=="Linux", round(((inactive/memtotal)*100),2))\ | fields - memtotal, memfree, memtotal, swaptotal, swapfree iseval = 0 # define for all OS memory and swap usage in volume (MB) [def_memory_volume_MB] definition = `extract_metrics`\ | eval {metric}=value\ | stats values(Real_total_MB) as Real_total_MB, values(System_PCT) as System_PCT, values(Process_PCT) as Process_PCT, values(memtotal) as memtotal, values(buffers) as buffers, values(active) as active, values(inactive) as inactive, values(cached) as cached, values(memfree) as memfree,\ values(Virtual_total_MB) as Virtual_total_MB, values(Virtual_free_MB) as Virtual_free_MB, values(swapcached) as swapcached, values(swaptotal) as swaptotal, values(swapfree) as swapfree by _time, OStype, host\ | fillnull value=0 Real_total_MB System_PCT Process_PCT memtotal buffers active inactive cached memfree Virtual_total_MB Virtual_free_MB swapcached swaptotal swapfree\ | eval mem_used_effective = case(OStype=="AIX", (Real_total_MB/100)*(System_PCT+Process_PCT), OStype=="Linux", ((memtotal-(buffers+cached))-memfree), OStype=="Solaris", memtotal-memfree)\ | eval swap_used_effective = case(OStype=="AIX", (Virtual_total_MB-Virtual_free_MB), OStype=="Linux", ((swaptotal-swapfree)-swapcached), OStype=="Solaris", (swaptotal-swapfree)) iseval = 0 # define for all OS memory by category in volume (MB) [def_memory_volume_MB_by_category] definition = `extract_metrics`\ | eval {metric}=value\ | stats values(Real_total_MB) as Real_total_MB, values(System_PCT) as System_PCT, values(Process_PCT) as Process_PCT, values(FScache_PCT) as FScache_PCT, values(memtotal) as memtotal, values(buffers) as buffers, values(cached) as cached, values(memfree) as memfree,\ values(Virtual_total_MB) as Virtual_total_MB, values(Virtual_free_MB) as Virtual_free_MB, values(swapcached) as swapcached, values(swaptotal) as swaptotal, values(swapfree) as swapfree by _time, OStype, host\ | fillnull value=0 Real_total_MB System_PCT Process_PCT memtotal buffers cached memfree Virtual_total_MB Virtual_free_MB swapcached swaptotal swapfree\ | eval mem_used_effective = case(OStype=="AIX", (Real_total_MB/100)*(System_PCT+Process_PCT), OStype=="Linux", ((memtotal-(buffers+cached))-memfree), OStype=="Solaris", memtotal-memfree)\ | eval swap_used_effective = case(OStype=="AIX", (Virtual_total_MB-Virtual_free_MB), OStype=="Linux", ((swaptotal-swapfree)-swapcached), OStype=="Solaris", (swaptotal-swapfree))\ | eval memtotal=if(OStype=="AIX", Real_total_MB, memtotal), cached=if(OStype=="AIX", (Real_total_MB/100)*FScache_PCT, cached), memfree=if(OStype=="AIX", memtotal-((Real_total_MB/100)*(System_PCT+Process_PCT+FScache_PCT)), memfree) iseval = 0 # define for all OS memory usage per process (TOP) [def_all_os_top_memory] definition = `extract_metrics`\ | eval {metric}=value\ | stats values(ResSet) as ResSet, values(ResText) as ResText, values(ResData) as ResData, values(ResSize) as ResSize by _time, OStype, host, dimension_Command\ | fillnull value=0 ResSet ResText ResData ResSize\ | eval mem_usage_mb=case(match(OStype, "Linux"), ((ResSet)/1024), match(OStype, "AIX"), ((ResData+ResText)/1024), match(OStype, "Solaris"), (ResSize/1024) ) iseval = 0 # define for disk read xfer against diskbsize [def_disk_read_xfer] definition = `extract_metrics`\ | eval disk_read=case(match(metric_name, "diskread"), value), disk_size=case(match(metric_name, "diskbsize"), value)\ | stats values(disk_read) as disk_read values(disk_size) as disk_size by _time, dimension_device, host\ | eval disk_read_iops=(disk_read/disk_size)\ | stats sum(disk_read_iops) as disk_read_iops by _time, host iseval = 0 # define for disk read xfer against diskbsize by device [def_disk_read_xfer_by_device] definition = `extract_metrics`\ | eval disk_read=case(match(metric_name, "diskread"), value), disk_size=case(match(metric_name, "diskbsize"), value)\ | stats values(disk_read) as disk_read values(disk_size) as disk_size by _time, dimension_device, host\ | eval disk_read_iops=(disk_read/disk_size)\ | stats sum(disk_read_iops) as disk_read_iops by _time, host, dimension_device iseval = 0 # define for disk write xfer against diskbsize [def_disk_write_xfer] definition = `extract_metrics`\ | eval disk_write=case(match(metric_name, "diskwrite"), value), disk_size=case(match(metric_name, "diskbsize"), value)\ | stats values(disk_write) as disk_write values(disk_size) as disk_size by _time, dimension_device, host\ | eval disk_write_iops=(disk_write/disk_size)\ | stats sum(disk_write_iops) as disk_write_iops by _time, host iseval = 0 # define for disk write xfer against diskbsize by device [def_disk_write_xfer_by_device] definition = `extract_metrics`\ | eval disk_write=case(match(metric_name, "diskwrite"), value), disk_size=case(match(metric_name, "diskbsize"), value)\ | stats values(disk_write) as disk_write values(disk_size) as disk_size by _time, dimension_device, host\ | eval disk_write_iops=(disk_write/disk_size)\ | stats sum(disk_write_iops) as disk_write_iops by _time, host, dimension_device iseval = 0 # define for dg read xfer against dgsize [def_dg_read_xfer] definition = `extract_metrics("dgread dgsize")`\ | stats max(dgread) as disk_read_KB_per_sec max(dgsize) as disk_block_size_KB by _time, dimension_device, host\ | eval disk_read_iops=(disk_read_KB_per_sec/disk_block_size_KB)\ | stats sum(disk_read_iops) as disk_read_iops by _time, host iseval = 0 # define for dg read xfer against dgsize by device [def_dg_read_xfer_by_device] definition = `extract_metrics("dgread dgsize")`\ | stats max(dgread) as disk_read_KB_per_sec max(dgsize) as disk_block_size_KB by _time, dimension_device, host\ | eval disk_read_iops=(disk_read_KB_per_sec/disk_block_size_KB)\ | stats sum(disk_read_iops) as disk_read_iops by _time, host, dimension_device iseval = 0 # define for dg write xfer against dgsize [def_dg_write_xfer] definition = `extract_metrics("dgwrite dgsize")`\ | stats max(dgwrite) as disk_write_KB_per_sec max(dgsize) as disk_block_size_KB by _time, dimension_device, host\ | eval disk_write_iops=(disk_write_KB_per_sec/disk_block_size_KB)\ | stats sum(disk_write_iops) as disk_write_iops by _time, host iseval = 0 # define for dg write xfer against dgsize by device [def_dg_write_xfer_by_device] definition = `extract_metrics("dgwrite dgsize")`\ | stats max(dgwrite) as disk_write_KB_per_sec max(dgsize) as disk_block_size_KB by _time, dimension_device, host\ | eval disk_write_iops=(disk_write_KB_per_sec/disk_block_size_KB)\ | stats sum(disk_write_iops) as disk_write_iops by _time, host, dimension_device iseval = 0 ######################################### # frameID mapping ######################################### [mapping_frameID] definition = lookup nmon_frameID_mapping host as host OUTPUT frameID\ | eval frameID=if(isnull(frameID), host, frameID) iseval = 0 ######################################### # mcatalog ######################################### # used by the data dictionary explorer UI [def_mcatalog_full] definition = mcatalog values(_dims) where `nmon_metrics_index` metric_name="os.unix.nmon.*" by metric_name\ | fields metric_name | sort 0 metric_name\ | append [ | inputlookup nmon_metric_catalog | fields metric_name ]\ | rex field="metric_name" "os\.unix\.nmon\.(?\w*)\.(?\w*)"\ | sort 0 metric_name\ | rex field="metric_name" "\.(?\w*)$"\ | fields metric_category,nmon_section,metric\ | search [ | mcatalog values(_dims) where `nmon_metrics_index` metric_name="os.unix.nmon.*" by metric_name\ | fields metric_name | sort 0 metric_name\ | rex field="metric_name" "os\.unix\.nmon\.(?\w*)\.(?\w*)"\ | stats count by nmon_section | fields - count | fields nmon_section ] iseval = 0 # mcatalog dictionary without dimensions [def_mcatalog_dictionary(1)] args = osfilter definition = mcatalog values(sourcetype) as sourcetype_values where `nmon_metrics_index` metric_name=os.unix.nmon.* host=* OStype=$osfilter$ by OStype, metric_name\ | rename sourcetype_values as sourcetype\ | `extract_metrics`\ | rex field=metric_name "os\.unix\.nmon\.(?[^\.]*)\.(?[^\.]*)"\ | stats count by metric_category, nmon_section, metric iseval = 0 # mcatalog dictionary with dimensions [def_mcatalog_dictionary_with_dimensions(1)] args = osfilter definition = mcatalog values(sourcetype) as sourcetype_values values(_dims) as dimensions where `nmon_metrics_index` metric_name=os.unix.nmon.* host=* OStype=$osfilter$ by OStype, metric_name\ | rename sourcetype_values as sourcetype\ | rex field="metric_name" ".(?[\w|\-|\_]*)$"\ | rex field=metric_name "os\.unix\.nmon\.(?[^\.]*)\.(?[^\.]*)"\ | mvexpand dimensions\ | where (((dimensions == "OStype") OR (dimensions == "serialnum")) OR like(dimensions,"dimension_%"))\ | stats count by metric_category, nmon_section, metric, dimensions\ | eval dimensions=if(match(dimensions, "dimension_.*"), dimensions, "none")\ | dedup metric_category, nmon_section, metric, dimensions\ | eval dimensions=if(match(dimensions, "dimension_.*"), dimensions, ""), count=if(match(dimensions, "dimension_.*"), count,1) iseval = 0 # mcatalog inventory output enriched with nmon inventory data [def_mcatalog_mapped_nmon_inventory] definition = mcatalog values(serialnum) as serials values(OStype) as OStype_values where `nmon_metrics_index` metric_name="os.unix.nmon.*" by host\ | rename serials as serialnum, OStype_values as OStype\ | `mapping_frameID`\ | lookup nmon_inventory hostname as host OUTPUT OSversion, cpu_cores, Physical_mem_MB, Virtual_mem_MB, uptime_duration, system_startup_date, reporting_date\ | eval OS_summary=upper(OStype)+" / "+OSversion\ | fields frameID, serialnum, host, OS_summary, cpu_cores, Physical_mem_MB, Virtual_mem_MB, uptime_duration, system_startup_date, reporting_date iseval = 0 # mcatalog inventory mapped with main KPIs [def_mcatalog_mapped_nmon_inventory_with_main_kpis] definition = `def_mcatalog_mapped_nmon_inventory`\ | fields frameID,serialnum,host,OS_summary,cpu_cores,Physical_mem_MB,Virtual_mem_MB\ | rename Physical_mem_MB as "physical mem (MB)", Virtual_mem_MB as "virtual mem (MB)"\ | sort 0 host\ | appendcols\ [ | mstats avg(_value) as value where `nmon_metrics_index` `def_cpu_all_os_metric_filters` by metric_name, OStype, host span=1m\ | `def_all_os_cpu_load_percent`\ | stats avg(cpu_load_percent) AS avg_cpu_usage, sparkline(avg(cpu_load_percent),5m) As cpu_sparkline by host\ | sort 0 host ]\ | appendcols\ [ | mstats avg(_value) as value where `nmon_metrics_index` metric_name=os.unix.nmon.memory.mem.Real_total_MB\ OR metric_name=os.unix.nmon.memory.mem.Real_free_MB\ OR metric_name=os.unix.nmon.memory.mem.memtotal\ OR metric_name=os.unix.nmon.memory.mem.buffers\ OR metric_name=os.unix.nmon.memory.mem.cached\ OR metric_name=os.unix.nmon.memory.mem.memfree\ OR metric_name=os.unix.nmon.memory.mem.Virtual_total_MB\ OR metric_name=os.unix.nmon.memory.mem.Virtual_free_MB\ OR metric_name=os.unix.nmon.memory.mem.swapcached\ OR metric_name=os.unix.nmon.memory.mem.swaptotal\ OR metric_name=os.unix.nmon.memory.mem.swapfree by host, metric_name span=1m\ | `def_memory_load_percent`\ | stats avg(mem_used_effective_PCT) AS avg_physical_mem_usage, sparkline(avg(mem_used_effective_PCT),5m) As sparkline_physical_mem,\ avg(swap_used_effective_PCT) AS avg_virtual_mem_usage, sparkline(avg(swap_used_effective_PCT),5m) As sparkline_virtual_mem by host\ | sort 0 host ]\ | eval avg_cpu_usage=case(isnum(avg_cpu_usage), round(avg_cpu_usage, 2) . " %"),\ avg_physical_mem_usage=case(isnum(avg_physical_mem_usage), round(avg_physical_mem_usage, 2) . " %"),\ avg_virtual_mem_usage=if(isnum(avg_virtual_mem_usage), round(avg_virtual_mem_usage, 2) . " %", "no virtual memory")\ | `mapping_frameID` iseval =0 ######################################### # df_storage specific ######################################### # used by the configuration interface to provide server inventory [def_filesystem_inventory] definition = mstats latest(_value) as value where `nmon_metrics_index` metric_name=os.unix.nmon.storage.df_storage.Available OR metric_name=os.unix.nmon.storage.df_storage.Use_pct OR metric_name=os.unix.nmon.storage.df_storage.Used OR metric_name=os.unix.nmon.storage.df_storage.blocks by serialnum, host, metric_name, dimension_mount, dimension_filesystem\ | eval Available=case(metric_name=="os.unix.nmon.storage.df_storage.Available", value), Use_pct=case(metric_name=="os.unix.nmon.storage.df_storage.Use_pct", value), Used=case(metric_name=="os.unix.nmon.storage.df_storage.Used", value), blocks=case(metric_name=="os.unix.nmon.storage.df_storage.blocks", value)\ | stats last(Available) as Available, last(Use_pct) as Use_pct, last(Used) as Used, last(blocks) as blocks by serialnum, host, dimension_mount, dimension_filesystem\ | rename dimension_mount as mount, dimension_filesystem as filesystem\ | eval storage_free=blocks-Used, storage_free_percent=(100-Use_pct)\ | rename Use_pct as storage_used_percent, blocks as storage, Used as storage_used, Available as storage_free\ | foreach storage, storage_free, storage_used [ eval <> = round('<>'/1024/1024, 2) ]\ | foreach storage*percent [ eval <> = round('<>', 2) ]\ | rename storage as "storage (GB)", storage_free as "storage free (GB)", storage_used as "storage used (GB)", storage_free_percent as "storage free (%)", storage_used_percent as "storage used (%)"\ | eval UsedPct=if(isnum('storage used (%)'), 'storage used (%)', 0 )\ | `mapping_frameID`\ | fields frameID, serialnum, host, mount, filesystem, "storage (GB)", "storage free (GB)", "storage used (GB)", "storage free (%)", "storage used (%)", UsedPct | rename UsedPct as current_used_percent\ | foreach storage*%* current_used_percent [ eval <> = round('<>', 2) ] | where like(mount, "%") iseval = 0 ######################################### # LPAR Specific definitions ######################################### [lpar_define_conso] definition = eval lpar_ecconso=round(((EC_User_PCT+EC_Sys_PCT+EC_Wait_PCT+EC_Idle_PCT)*entitled/100),2)\ | eval lpar_ec_pct_conso=round((((EC_User_PCT+EC_Sys_PCT+EC_Wait_PCT+EC_Idle_PCT)*entitled)/virtualCPUs),2)\ | eval lpar_vpconso=round(((VP_User_PCT+VP_Sys_PCT+VP_Wait_PCT+VP_Idle_PCT)*virtualCPUs/100),2)\ | eval lpar_vp_pct_conso=round((VP_User_PCT+VP_Sys_PCT+VP_Wait_PCT+VP_Idle_PCT),2)\ | eval pool_conso=round((poolCPUs-PoolIdle),2)\ | eval pool_pct_conso=round(((poolCPUs-PoolIdle)*poolCPUs/100),2) iseval = 0 ######################################### # Custom Span Macro Definition ######################################### ################# # CUSTOMIZATION: ################# # If you want to set a minimal span feature that better fits your data, such as 5mn between 2 measures for example, please: # - Copy the 2 customspan macros to your local/macros.conf # - Edit the line: # | eval span=if(spanrestricted <= 20, "20s", span)\ # And replace with: (example with 5 minutes span, time unit is in seconds) # | eval span=if(spanrestricted <= (5*60), "5m", span)\ [nmon_span] definition = [ | stats count | addinfo\ | eval earliest=if(info_min_time == "0.000", info_search_time,info_min_time)\ | eval latest=if(info_max_time == "+Infinity", info_search_time,info_max_time)\ | eval searchStartTIme=strftime(earliest,"%a %d %B %Y %H:%M")\ | eval searchEndTime=strftime(latest,"%a %d %B %Y %H:%M")\ | eval Difference = (latest - earliest)\ | eval span=case(\ info_min_time == "0.000", "2m",\ Difference > (3000*24*60*60),"4d",\ Difference > (2000*24*60*60),"3d",\ Difference > (1000*24*60*60),"2d",\ Difference > (500*24*60*60),"1d",\ Difference > (333*24*60*60),"12h",\ Difference > (166*24*60*60),"8h",\ Difference > (83*24*60*60),"4h",\ Difference > (41*24*60*60),"2h",\ Difference > (916*60*60),"1h",\ Difference > (833*60*60),"55m",\ Difference > (750*60*60),"50m",\ Difference > (666*60*60),"45m",\ Difference > (583*60*60),"40m",\ Difference > (500*60*60),"35m",\ Difference > (416*60*60),"30m",\ Difference > (333*60*60),"25m",\ Difference > (250*60*60),"20m",\ Difference > (166*60*60),"15m",\ Difference > (83*60*60),"10m",\ Difference > (66*60*60),"5m",\ Difference > (50*60*60),"4m",\ Difference > (33*60*60),"3m",\ Difference > (16*60*60),"2m",\ Difference > (8*60*60),"1m",\ Difference <= (8*60*60),"1m"\ )\ | eval spanrestricted=case(\ info_min_time == "0.000", 2*60,\ Difference > (916*60*60),60*60,\ Difference > (833*60*60),55*60,\ Difference > (750*60*60),50*60,\ Difference > (666*60*60),45*60,\ Difference > (583*60*60),40*60,\ Difference > (500*60*60),35*60,\ Difference > (416*60*60),30*60,\ Difference > (333*60*60),25*60,\ Difference > (250*60*60),20*60,\ Difference > (166*60*60),15*60,\ Difference > (83*60*60),10*60,\ Difference > (66*60*60),5*60,\ Difference > (50*60*60),4*60,\ Difference > (33*60*60),180,\ Difference > (16*60*60),120,\ Difference > (8*60*60),60,\ Difference <= (8*60*60),60\ )\ | eval span=case(spanrestricted < interval, interval, spanrestricted >= interval, span, isnull(interval), span)\ | eval span=if(spanrestricted <= 60, "1m", span)\ | return span ] iseval = 0 # Baseline macro, uses a minimal span of 5m to match the Baseline span [baseline_span] definition = [ | stats count | addinfo\ | eval earliest=if(info_min_time == "0.000", info_search_time,info_min_time)\ | eval latest=if(info_max_time == "+Infinity", info_search_time,info_max_time)\ | eval searchStartTIme=strftime(earliest,"%a %d %B %Y %H:%M")\ | eval searchEndTime=strftime(latest,"%a %d %B %Y %H:%M")\ | eval Difference = (latest - earliest)\ | eval span=case(\ info_min_time == "0.000", "2m",\ Difference > (3000*24*60*60),"4d",\ Difference > (2000*24*60*60),"3d",\ Difference > (1000*24*60*60),"2d",\ Difference > (500*24*60*60),"1d",\ Difference > (333*24*60*60),"12h",\ Difference > (166*24*60*60),"8h",\ Difference > (83*24*60*60),"4h",\ Difference > (41*24*60*60),"2h",\ Difference > (916*60*60),"1h",\ Difference > (833*60*60),"55m",\ Difference > (750*60*60),"50m",\ Difference > (666*60*60),"45m",\ Difference > (583*60*60),"40m",\ Difference > (500*60*60),"35m",\ Difference > (416*60*60),"30m",\ Difference > (333*60*60),"25m",\ Difference > (250*60*60),"20m",\ Difference > (166*60*60),"15m",\ Difference > (83*60*60),"10m",\ Difference > (8*60*60),"5m",\ Difference <= (8*60*60),"5m"\ )\ | eval spanrestricted=case(\ info_min_time == "0.000", 2*60,\ Difference > (916*60*60),60*60,\ Difference > (833*60*60),55*60,\ Difference > (750*60*60),50*60,\ Difference > (666*60*60),45*60,\ Difference > (583*60*60),40*60,\ Difference > (500*60*60),35*60,\ Difference > (416*60*60),30*60,\ Difference > (333*60*60),25*60,\ Difference > (250*60*60),20*60,\ Difference > (166*60*60),15*60,\ Difference > (83*60*60),10*60,\ Difference > (8*60*60),5*60,\ Difference <= (8*60*60),5*60\ )\ | eval span=case(spanrestricted < interval, interval, spanrestricted >= interval, span, isnull(interval), span)\ | eval span=if(spanrestricted <= 60, "5m", span)\ | return span ] iseval = 0 ############################################### # Macro used in Compare interface ############################################### [eval_compare] definition = eval Evolution_usage=((usage_period2-usage_period1)/usage_period1)*100 | eval Evolution_usage=round(Evolution_usage,3)\ | eval Delta_usage=round((usage_period2-usage_period1),3)\ | eval Evolution_pct_usage=case(isnotnull(pct_usage_period1), ((pct_usage_period2-pct_usage_period1)/pct_usage_period1)*100 ) | eval Evolution_pct_usage=round(Evolution_pct_usage,3)\ | eval Delta_pct_usage=round((pct_usage_period2-pct_usage_period1),3)\ | fields host,usage_period1,usage_period2,Delta_usage,Evolution_usage,*\ | rename Evolution_usage As "Evolution_usage (%)"\ | rename Evolution_pct_usage As "Evolution_pct_usage (%)"\ | eval range=case(\ usage_period1==usage_period2, 0, usage_period1usage_period2, 4,\ pct_usage_period1==pct_usage_period2, 0, pct_usage_period1pct_usage_period2, 4)\ | rangemap field=range equal=0-1 increase=2-3 decrease=4-5 default=no\ | eval usage_period1=round(usage_period1,3)\ | eval usage_period2=round(usage_period2,3) iseval = 0 ################################### # Index Statistics ################################### [indexes_datestats] definition = rest /services/data/indexes\ | table currentDBSizeMB minTime maxTime totalEventCount splunk_server title\ | rename title as index | search `nmon_index`\ | eval firstTime=round(strptime('minTime', "%Y-%m-%dT%H:%M:%S%z"),0)\ | eval lastTime=round(strptime('maxTime', "%Y-%m-%dT%H:%M:%S%z"),0)\ | stats min(firstTime) as firstTime, max(lastTime) as lastTime\ | eval "First Event"=strftime(firstTime,"%d/%m/%y-%H:%M")\ | eval "Last Event"=strftime(lastTime,"%d/%m/%y-%H:%M") iseval = 0 ##################### # NMON CONFIG SECTION ##################### # Rex common to all OS [nmon_config_common_rex] definition = rex "(?i),version,(?P.+)"\ | rex "(?i),command,(?P.+)"\ | rex "(?i),OS,(?P[^,]+)"\ | rex "AAA,cpus,(?P\d+)"\ | rex "AAA,cpus,\d+,(?P\d+)" iseval = 0 # AIX Specific [nmon_config_AIX_rex] definition = rex "AAA,AIX,(?P.+)"\ | rex "BBB.+,[0-9].+,lparstat.+,\"Online\sVirtual\sCPUs\s+\:\s(?P\d+)\""\ | rex "BBB.+,[0-9].+,online\sMemory,(?P\d+)"\ | rex "BBB.+,[0-9].+,lsconf,\"\s+Total\sPaging\sSpace:\s(?P\d+)"\ | rex "BBB.+,[0-9].+,lsconf,\"Processor\sImplementation\sMode:\s(?P.+\w)\""\ | rex "BBB.+,[0-9].+,lsconf,\"Processor\sClock\sSpeed:\s(?P.+\w)\""\ | rex "BBB.+,[0-9].+,lsconf,\"CPU\sType:\s(?P.+\w)\""\ | rex "BBB.+,[0-9].+,lsconf,\"Kernel\sType:\s(?P.+\w)\""\ | rex "BBB.+,[0-9].+,lsconf,\"Platform\sFirmware\slevel:\s(?P.+\w)\""\ | rex "BBB.+,[0-9].+,lsconf,\"Machine\sSerial\sNumber:\s(?P.+)\""\ | rex "AAA,SerialNumber,(?P\w+)"\ | eval AIX_Machine_SerialNumber=if(isnotnull(AIX_Machine_SerialNumber), AIX_Machine_SerialNumber, AIX_alt_Machine_SerialNumber)\ | rex "BBB.+,[0-9].+,lparstat.+,\"Shared\sPool\sID\s+\:\s(?P.+)\""\ | eval AIX_PoolID=if(AIX_PoolID=="-","N/A" ,AIX_PoolID)\ | rex "BBB.+,[0-9].+,lparstat.+,\"Maximum\sPhysical\sCPUs\sin\ssystem\s+\:\s(?P.+)\""\ | rex "BBB.+,[0-9].+,lparstat.+,\"Active\sPhysical\sCPUs\sin\ssystem\s+\:\s(?P.+)\""\ | rex "BBB.+,[0-9].+,lparstat.+,\"Active\sCPUs\sin\sPool\s+\:\s(?P.+)\""\ | eval AIX_PoolCPUs=if(AIX_PoolCPUs=="-","N/A" ,AIX_PoolCPUs)\ | rex "BBB.+,[0-9].+,lparstat.+,\"Entitled\sCapacity\s+\:\s(?P.+)\""\ | rex "BBB.+,[0-9].+,lsconf,\"Processor\sType:\s(?P.+\w)\""\ | strcat AIX_virtualcpus " / " cpu_cores_position2 cpu_cores_combo\ | eval AIX_logicalcores=if(isnotnull(cpu_cores_position2), cpu_cores_position2, cpu_cores_position1) iseval = 0 # Linux specific [nmon_config_Linux_rex] definition = rex "AAA,OS,Linux,(?P.+)"\ | rex "BBB.+,[0-9].+cpuinfo,.+model\sname.+:\s+(?P.+)\""\ | rex "BBB.+,[0-9].+,.+etc+.release,\"(?P.+)\""\ | rex "BBB.+,[0-9].+,lsb\_release,\"Release:\s+(?P.+)\""\ | rex "BBB.+,[0-9].+,.proc.meminfo,\"MemTotal:\s+(?P\d+)" | eval Linux_memory_MB=round(Linux_memory_kB/1024,0)\ | rex "BBB.+,[0-9].+,.proc.meminfo,\"SwapTotal:\s+(?P\d+)" | eval Linux_swap_MB=round(Linux_swap_kB/1024,0)\ | rex "AAA,OS,Linux,(?P\d+.\d+).+,#"\ | rex "AAA,OS,Linux,(?P.+),#"\ | rex "AAA,OS,Linux,(?P.+)" iseval = 0 # Solaris specific [nmon_config_Solaris_rex] definition = rex "AAA,OS,Solaris,(?P.+)"\ | rex "AAA,OS,Solaris,.+,(?P.+),.+,.+"\ | rex "AAA,OS,Solaris,(?P.+),.+,.+,.+"\ | rex "BBB.+,[0-9].+,.+etc+.release,\"\s+(?P.+)\""\ | rex "BBB.+,[0-9].+psrinfo\s\-pv,\"\s+(?P.+\w)\""\ | rex "BBB.+,[0-9].+psrinfo\s\-pv,.+clock\s(?P.+)\)\"" iseval = 0 ################################### # Final macros used for inventory data retrieve ################################### [nmon_config] definition = `nmon_index` sourcetype=nmon_config\ | rex "(?i),host,(?P.+)"\ | `nmon_config_common_rex`\ | `nmon_config_AIX_rex`\ | `nmon_config_Linux_rex`\ | `nmon_config_Solaris_rex`\ | eval OStype=case(OS == "Linux", "Linux", OS == "Solaris", "Solaris", isnotnull(AIX_LEVEL), "AIX")\ | eval OS_Level=case(isnotnull(AIX_LEVEL), AIX_LEVEL, isnotnull(Solaris_version), Solaris_version, isnotnull(Linux_distribution), Linux_distribution)\ | eval cpu_cores=if(isnotnull(AIX_virtualcpus), cpu_cores_combo, cpu_cores_position1)\ | eval Processor=case(isnotnull(AIX_processor), AIX_processor, isnotnull(Solaris_processor), Solaris_processor, isnotnull(Linux_processor), Linux_processor) iseval = 0 # Used in addition with the command: `nmon_index` sourcetype=nmon_config | rex "(?i),host,(?.+)" | search $hostname$" in Nmon_Summary # to optimize time treatment [nmon_config_rex] definition = `nmon_config_common_rex`\ | `nmon_config_AIX_rex`\ | `nmon_config_Linux_rex`\ | `nmon_config_Solaris_rex`\ | eval OStype=case(OS == "Linux", "Linux", OS == "Solaris", "Solaris", isnotnull(AIX_LEVEL), "AIX")\ | eval OS_Level=case(isnotnull(AIX_LEVEL), AIX_LEVEL, isnotnull(Solaris_version), Solaris_version, isnotnull(Linux_distribution), Linux_distribution)\ | eval cpu_cores=if(isnotnull(AIX_virtualcpus), cpu_cores_combo, cpu_cores_position1)\ | eval Processor=case(isnotnull(AIX_processor), AIX_processor, isnotnull(Solaris_processor), Solaris_processor, isnotnull(Linux_processor), Linux_processor) iseval = 0 # Called by User Interfaces to filter OS list based on type of OS [nmon_inventory] definition = | inputlookup nmon_inventory iseval = 0 # This macro will be called by the scheduled report responsible for the update of the configuration KVstore lookup # On some large system at scale, the lengh of the code seemed to be an issue in Splunk Web [nmon_inventory_update] definition = tstats latest("Nmon_Config.OStype") as OStype\ latest("Nmon_Config.AIX_Machine_SerialNumber") AS AIX_Machine_SerialNumber\ latest("Nmon_Config.AIX_virtualcpus") AS AIX_virtualcpus\ latest("Nmon_Config.AIX_logicalcores") AS AIX_logicalcores\ latest("Nmon_Config.AIX_entitled") AS AIX_entitled\ latest("Nmon_Config.AIX_LEVEL") AS AIX_LEVEL\ latest("Nmon_Config.AIX_processor_mode") AS AIX_processor_mode\ latest("Nmon_Config.AIX_processor_clockspeed") AS AIX_processor_clockspeed\ latest("Nmon_Config.AIX_cpu_type") AS AIX_cpu_type\ latest("Nmon_Config.AIX_kernel_type") AS AIX_kernel_type\ latest("Nmon_Config.AIX_plateform_firmware_level") AS AIX_plateform_firmware_level\ latest("Nmon_Config.AIX_PoolID") AS AIX_PoolID\ latest("Nmon_Config.AIX_system_installed_CPUs") AS AIX_system_installed_CPUs\ latest("Nmon_Config.AIX_system_active_CPUs") AS AIX_system_active_CPUs\ latest("Nmon_Config.AIX_PoolCPUs") AS AIX_PoolCPUs\ latest("Nmon_Config.AIX_memory_MB") AS AIX_memory_MB\ latest("Nmon_Config.AIX_pagingspace_MB") AS AIX_pagingspace_MB\ latest("Nmon_Config.Linux_memory_MB") AS Linux_memory_MB\ latest("Nmon_Config.Linux_swap_MB") AS Linux_swap_MB\ latest("Nmon_Config.Linux_distribution") AS Linux_distribution\ latest("Nmon_Config.Linux_vendor") AS Linux_vendor\ latest("Nmon_Config.Linux_kernelversion") AS Linux_kernelversion\ latest("Nmon_Config.Solaris_version") AS Solaris_version\ latest("Nmon_Config.Solaris_sunOS_version") AS Solaris_sunOS_version\ latest("Nmon_Config.Solaris_processor_clockspeed") AS Solaris_processor_clockspeed\ latest("Nmon_Config.Solaris_physical_memory_MB") AS Solaris_physical_memory_MB\ latest("Nmon_Config.Processor") AS Processor\ latest("Nmon_Config.cpu_cores") AS cpu_cores\ latest("Nmon_Config.nmon_version") AS nmon_version\ latest("Nmon_Config.uptime") AS uptime_seconds\ latest("Nmon_Config.event_epoch") AS last_report\ from datamodel=metricator-nmon-config where (nodename = Nmon_Config) (sourcetype=nmon_config) by host prestats=true\ | tstats latest("Uptime.uptime") AS external_uptime latest(Uptime.event_epoch) as external_last_report from datamodel=metricator-nmon-config.Uptime where (nodename = Uptime) (Uptime.uptime = "*") by host append=true prestats=true\ | stats dedup_splitvals=t\ latest("Nmon_Config.OStype") as OStype\ latest("Nmon_Config.AIX_Machine_SerialNumber") AS AIX_Machine_SerialNumber\ latest("Nmon_Config.AIX_virtualcpus") AS AIX_virtualcpus\ latest("Nmon_Config.AIX_logicalcores") AS AIX_logicalcores\ latest("Nmon_Config.AIX_entitled") AS AIX_entitled\ latest("Nmon_Config.AIX_LEVEL") AS AIX_LEVEL\ latest("Nmon_Config.AIX_processor_mode") AS AIX_processor_mode\ latest("Nmon_Config.AIX_processor_clockspeed") AS AIX_processor_clockspeed\ latest("Nmon_Config.AIX_cpu_type") AS AIX_cpu_type\ latest("Nmon_Config.AIX_kernel_type") AS AIX_kernel_type\ latest("Nmon_Config.AIX_plateform_firmware_level") AS AIX_plateform_firmware_level\ latest("Nmon_Config.AIX_PoolID") AS AIX_PoolID\ latest("Nmon_Config.AIX_system_installed_CPUs") AS AIX_system_installed_CPUs\ latest("Nmon_Config.AIX_system_active_CPUs") AS AIX_system_active_CPUs\ latest("Nmon_Config.AIX_PoolCPUs") AS AIX_PoolCPUs\ latest("Nmon_Config.AIX_memory_MB") AS AIX_memory_MB\ latest("Nmon_Config.AIX_pagingspace_MB") AS AIX_pagingspace_MB\ latest("Nmon_Config.Linux_memory_MB") AS Linux_memory_MB\ latest("Nmon_Config.Linux_swap_MB") AS Linux_swap_MB\ latest("Nmon_Config.Linux_distribution") AS Linux_distribution\ latest("Nmon_Config.Linux_vendor") AS Linux_vendor\ latest("Nmon_Config.Linux_kernelversion") AS Linux_kernelversion\ latest("Nmon_Config.Solaris_version") AS Solaris_version\ latest("Nmon_Config.Solaris_sunOS_version") AS Solaris_sunOS_version\ latest("Nmon_Config.Solaris_processor_clockspeed") AS Solaris_processor_clockspeed\ latest("Nmon_Config.Solaris_physical_memory_MB") AS Solaris_physical_memory_MB\ latest("Nmon_Config.Processor") AS Processor\ latest("Nmon_Config.cpu_cores") AS cpu_cores\ latest("Nmon_Config.nmon_version") AS nmon_version\ latest("Nmon_Config.uptime") AS uptime_seconds\ latest("Uptime.uptime") AS external_uptime_seconds\ latest("Nmon_Config.event_epoch") AS last_report, latest(Uptime.event_epoch) as external_last_report by host\ | sort limit=0 host\ | rename host AS hostname\ | eval now=now()\ | eval uptime_seconds=if(isnotnull(external_uptime_seconds), external_uptime_seconds, uptime_seconds)\ | eval last_report=if(isnotnull(external_last_report), external_last_report, last_report)\ | fields - external_uptime_seconds\ | eval uptime_seconds=(uptime_seconds+(now-last_report))\ | eval uptime_duration=tostring(uptime_seconds, "duration")\ | fields - external_last_report\ | eval reporting_date=strftime(last_report, "%m/%d/%Y %H:%M")\ | eval system_startup_date=strftime((now()-uptime_seconds), "%m/%d/%Y %H:%M")\ | eval cpu_logicalcores=if(isnum(AIX_logicalcores), AIX_logicalcores, cpu_cores)\ | rex field=Linux_distribution mode=sed "s/Q$//g"\ | fields hostname, OStype, AIX_Machine_SerialNumber, AIX_virtualcpus, AIX_logicalcores, AIX_entitled, AIX_LEVEL,\ AIX_processor_mode, AIX_processor_clockspeed, AIX_cpu_type, AIX_kernel_type, AIX_plateform_firmware_level, AIX_PoolID,\ AIX_system_installed_CPUs, AIX_system_active_CPUs, AIX_PoolCPUs, AIX_memory_MB, AIX_pagingspace_MB, Linux_memory_MB, Linux_swap_MB, Linux_distribution,\ Linux_vendor, Linux_kernelversion, Solaris_version, Solaris_sunOS_version, Solaris_processor_clockspeed, Solaris_physical_memory_MB, Processor, cpu_cores, cpu_logicalcores, nmon_version, uptime_seconds, uptime_duration, system_startup_date, reporting_date\ | eval OSversion=case(OStype=="Linux", Linux_distribution, OStype=="AIX", AIX_LEVEL, OStype=="Solaris", if(isnotnull(Solaris_version), Solaris_version, Solaris_sunOS_version))\ | eval Physical_mem_MB=case(OStype=="Linux", Linux_memory_MB, OStype=="AIX", AIX_memory_MB, OStype=="Solaris", Solaris_physical_memory_MB)\ | eval Virtual_mem_MB=case(OStype=="Linux", Linux_swap_MB, OStype=="AIX", AIX_pagingspace_MB, OStype=="Solaris", "NA")\ | fillnull value="NA" iseval = 0 ################################### # Custom Span definition for Application Statistics Django View ################################### [internal_table_stats_span] definition = [ search index=_internal | head 1 | addinfo\ | eval earliest=if(info_min_time == "0.000", info_search_time,info_min_time)\ | eval latest=if(info_max_time == "+Infinity", info_search_time,info_max_time)\ | eval searchStartTIme=strftime(earliest,"%a %d %B %Y %H:%M")\ | eval searchEndTime=strftime(latest,"%a %d %B %Y %H:%M")\ | eval Difference = (latest - earliest)\ | eval span=case(\ Difference > (12*31*24*60*60),"1y",\ Difference > (31*24*60*60),"1m",\ Difference > (24*60*60),"1d",\ Difference <= (24*60*60),"1h"\ )\ | return span ] iseval = 0 ##################### # FILTER TIME # ##################### [No_Filter] definition = eval time_filtering="false" iseval = 0 [Day_BusinessDays_8h-19h] definition = eval local_time=strftime(_time, "%H:%M"), date_wday=lower(strftime(_time, "%A")) | search (local_time>="08:00" AND local_time<="19:00") AND (date_wday!="sunday" date_wday!="saturday") iseval = 0 [Day_WeekEnd_8h-19h] definition = eval local_time=strftime(_time, "%H:%M"), date_wday=lower(strftime(_time, "%A")) | search (local_time>="08:00" AND local_time<="19:00") AND (date_wday="sunday" OR date_wday="saturday") iseval = 0 [Day_AllDays_8h-19h] definition = eval local_time=strftime(_time, "%H:%M"), date_wday=lower(strftime(_time, "%A")) | search (local_time>="08:00" AND local_time<="19:00") iseval = 0 [Night_BusinessDays_19h-8h] definition = eval local_time=strftime(_time, "%H:%M"), date_wday=lower(strftime(_time, "%A")) | search (local_time>="19:00" AND local_time<="23:59") OR (local_time>="00:00" AND local_time<="08:00") AND (date_wday!="sunday" date_wday!="saturday") iseval = 0 [Night_WeekEnd_19h-8h] definition = eval local_time=strftime(_time, "%H:%M"), date_wday=lower(strftime(_time, "%A")) | search (local_time>="19:00" AND local_time<="23:59") OR (local_time>="00:00" AND local_time<="08:00") AND (date_wday="sunday" OR date_wday="saturday") iseval = 0 [Night_AllDays_19h-8h] definition = eval local_time=strftime(_time, "%H:%M"), date_wday=lower(strftime(_time, "%A")) | search (local_time>="19:00" AND local_time<="23:59") OR (local_time>="00:00" AND local_time<="08:00") iseval = 0 #################################################### # NMON PROCESSING SECTION #################################################### [nmon_processing] definition = `nmon_index` sourcetype=nmon_processing iseval = 0 [nmon_processing_stats] definition = `nmon_processing`\ | eval size_KB=round((size_in_bytes/1000),2)\ | eval size_MB=round((size_in_bytes/1000/1000),2)\ | stats\ min(nbr_lines) As min_nbr_lines, avg(nbr_lines) As avg_nbr_lines, max(nbr_lines) As max_nbr_lines, sum(nbr_lines) As sum_nbr_lines,\ min(size_KB) As min_size_KB, avg(size_KB) As avg_size_KB, max(size_KB) As max_size_KB, sum(size_KB) As sum_size_KB,\ min(size_MB) As min_size_MB, avg(size_MB) As avg_size_MB, max(size_MB) As max_size_MB, sum(size_MB) As sum_size_MB,\ min(elapsed_in_seconds) As min_elapsed_in_seconds, avg(elapsed_in_seconds) As avg_elapsed_in_seconds, max(elapsed_in_seconds) As max_elapsed_in_seconds, sum(elapsed_in_seconds) As sum_elapsed_in_seconds\ | eval sum_nbr_lines_in_millions=round((sum_nbr_lines/1000/1000),2)\ | eval sum_size_GB=round((sum_size_KB/1000/1000),2)\ | eval sum_elapsed=tostring(sum_elapsed_in_seconds,"duration")\ | eval avg_nbr_lines=round(avg_nbr_lines,0)\ | eval avg_size_MB=round(avg_size_MB,2)\ | eval avg_elapsed_in_seconds=round(avg_elapsed_in_seconds,2) iseval = 0 [nmon_processing_stats_by_time] definition = `nmon_processing`\ | eval size_KB=round((size_in_bytes/1000),2)\ | eval size_MB=round((size_in_bytes/1000/1000),2)\ | stats\ min(nbr_lines) As min_nbr_lines, avg(nbr_lines) As avg_nbr_lines, max(nbr_lines) As max_nbr_lines, sum(nbr_lines) As sum_nbr_lines,\ min(size_KB) As min_size_KB, avg(size_KB) As avg_size_KB, max(size_KB) As max_size_KB, sum(size_KB) As sum_size_KB,\ min(size_MB) As min_size_MB, avg(size_MB) As avg_size_MB, max(size_MB) As max_size_MB, sum(size_MB) As sum_size_MB,\ min(elapsed_in_seconds) As min_elapsed_in_seconds, avg(elapsed_in_seconds) As avg_elapsed_in_seconds, max(elapsed_in_seconds) As max_elapsed_in_seconds, sum(elapsed_in_seconds) As sum_elapsed_in_seconds by _time\ | eval sum_nbr_lines_in_millions=round((sum_nbr_lines/1000/1000),2)\ | eval sum_size_GB=round((sum_size_KB/1000/1000),2)\ | eval avg_nbr_lines=round(avg_nbr_lines,0)\ | eval avg_size_MB=round(avg_size_MB,2)\ | eval avg_elapsed_in_seconds=round(avg_elapsed_in_seconds,2) iseval = 0 ################### # ALERTING MACROS # ################### [alerting_cpu_usage] definition = mstats avg(_value) as value where `nmon_metrics_index` (metric_name=os.unix.nmon.cpu.cpu_all.Sys_PCT OR metric_name=os.unix.nmon.cpu.cpu_all.User_PCT OR metric_name=os.unix.nmon.cpu.cpu_all.Wait_PCT OR metric_name=os.unix.nmon.cpu.cpu_all.Steal_PCT OR metric_name=os.unix.nmon.cpu.lpar.VP_User_PCT OR metric_name=os.unix.nmon.cpu.lpar.VP_Sys_PCT OR metric_name=os.unix.nmon.cpu.lpar.VP_Wait_PCT OR metric_name=os.unix.nmon.cpu.lpar.VP_Idle_PCT OR metric_name=os.unix.nmon.cpu.lpar.PhysicalCPU OR metric_name=os.unix.nmon.cpu.lpar.virtualCPUs OR metric_name=os.unix.nmon.cpu.lpar.partition_active_processors) by metric_name, OStype, host span=1m\ | `def_all_os_cpu_load_percent`\ | fields _time, host, cpu_load_percent\ | `mapping_frameID`\ | lookup nmon_alerting_threshold_template frameID OUTPUT alert_cpu_max_percent as template_alert_cpu_max_percent, alert_cpu_min_time_seconds as template_alert_cpu_min_time_seconds\ | lookup nmon_alerting_threshold frameID host OUTPUT alert_cpu_max_percent as server_alert_cpu_max_percent, alert_cpu_min_time_seconds as server_alert_cpu_min_time_seconds\ | eval default_alert_cpu_max_percent="90", default_alert_cpu_min_time_seconds="300"\ | eval alert_cpu_max_percent=case(isnum(server_alert_cpu_max_percent), server_alert_cpu_max_percent, isnum(template_alert_cpu_max_percent), template_alert_cpu_max_percent, isnum(default_alert_cpu_max_percent), default_alert_cpu_max_percent),\ alert_cpu_min_time_seconds=case(isnum(server_alert_cpu_min_time_seconds), server_alert_cpu_min_time_seconds, isnum(template_alert_cpu_min_time_seconds), template_alert_cpu_min_time_seconds, isnum(default_alert_cpu_min_time_seconds), default_alert_cpu_min_time_seconds),\ alert_threshold_source=case(isnum(server_alert_cpu_max_percent), "server_thresholds", isnum(template_alert_cpu_max_percent), "template_thresholds", isnum(default_alert_cpu_max_percent), "default_threshold")\ | sort 0 - _time\ | eval status=if(cpu_load_percent>alert_cpu_max_percent, "red", "green")\ | eval {status}=status\ | transaction frameID host status keepevicted=t keeporphans=t maxpause=5m\ | stats max(_time) as _time, latest(duration) as duration, latest(cpu_load_percent) as latest_cpu_load_percent, latest(alert_cpu_max_percent) as alert_cpu_max_percent, latest(alert_cpu_min_time_seconds) as alert_cpu_min_time_seconds, latest(alert_threshold_source) as alert_threshold_source, latest(status) as status by frameID, host\ | eval "duration (hh:mm:ss)"=tostring(duration, "duration")\ | where (status="red") AND (duration>=alert_cpu_min_time_seconds)\ | fields frameID,host,_time,duration,"duration (hh:mm:ss)",latest_cpu_load_percent,alert_cpu_max_percent,alert_cpu_min_time_seconds,alert_threshold_source iseval = 0 [alerting_filesystem_usage] definition = mstats avg(_value) as value where `nmon_metrics_index` (metric_name="os.unix.nmon.storage.df_storage.Use_pct" OR metric_name="os.unix.nmon.storage.jfsfile") by host, metric_name, dimension_mount span=1m\ | eval df_storage_value=case((metric_name == "os.unix.nmon.storage.df_storage.Use_pct"),value), jfsfile_value=case((metric_name == "os.unix.nmon.storage.jfsfile"),value), storage_used_percent=if(isnum(df_storage_value),df_storage_value,jfsfile_value)\ | stats latest(storage_used_percent) as storage_used_percent by _time, host, dimension_mount\ | rename dimension_mount as mount\ | `mapping_frameID`\ | lookup nmon_alerting_threshold_template_filesystem frameID mount OUTPUT alert_fs_max_percent as template_alert_fs_max_percent, alert_fs_min_time_seconds as template_alert_fs_min_time_seconds, is_shared, _key as fs_uuid\ | lookup nmon_alerting_threshold_filesystem frameID host mount OUTPUT alert_fs_max_percent as server_alert_fs_max_percent, alert_fs_min_time_seconds as server_alert_fs_min_time_seconds\ | eval is_shared=if(isnull(is_shared), "False", is_shared)\ | eval fs_uuid=if(is_shared="True", fs_uuid, md5(frameID . ":" . host . ":" . mount))\ | eval default_alert_fs_max_percent="90", default_alert_fs_min_time_seconds="300"\ | eval alert_fs_max_percent=case(isnum(server_alert_fs_max_percent), server_alert_fs_max_percent, isnum(template_alert_fs_max_percent), template_alert_fs_max_percent, isnum(default_alert_fs_max_percent), default_alert_fs_max_percent),\ alert_fs_min_time_seconds=case(isnum(server_alert_fs_min_time_seconds), server_alert_fs_min_time_seconds, isnum(template_alert_fs_min_time_seconds), template_alert_fs_min_time_seconds, isnum(default_alert_fs_min_time_seconds), default_alert_fs_min_time_seconds),\ alert_threshold_source=case(isnum(server_alert_fs_max_percent), "server_thresholds", isnum(template_alert_fs_max_percent), "template_thresholds", isnum(default_alert_fs_max_percent), "default_threshold")\ | lookup nmon_alerting_filesystem_global_exclusion mount OUTPUT exclude as global_exclude\ | lookup nmon_alerting_filesystem_template_exclusion frameID mount OUTPUT exclude as template_exclude\ | lookup nmon_alerting_filesystem_per_server_exclusion host mount OUTPUT exclude as host_exclude\ | fillnull value="false" global_exclude template_exclude host_exclude\ | where (global_exclude!="true" AND template_exclude!="true" AND host_exclude!="true")\ | sort 0 - _time\ | eval status=if(storage_used_percent>alert_fs_max_percent, "red", "green")\ | eval {status}=status\ | transaction fs_uuid status keepevicted=t keeporphans=t maxpause=5m\ | stats first(frameID) as frameID, first(host) as host, first(mount) as mount, max(_time) as _time, latest(duration) as duration, latest(storage_used_percent) as latest_storage_used_percent, latest(alert_fs_max_percent) as alert_fs_max_percent, latest(alert_fs_min_time_seconds) as alert_fs_min_time_seconds, latest(alert_threshold_source) as alert_threshold_source, latest(status) as status by fs_uuid\ | eval "duration (hh:mm:ss)"=tostring(duration, "duration")\ | where (status="red") AND (duration>=alert_fs_min_time_seconds)\ | fields frameID,host,_time,mount,fs_uuid,duration,"duration (hh:mm:ss)",latest_storage_used_percent,alert_fs_max_percent,alert_fs_min_time_seconds,alert_threshold_source iseval = 0 [alerting_realmemory_usage] definition = mstats avg(_value) as value where `nmon_metrics_index` metric_name=os.unix.nmon.memory.memnew.System_PCT OR metric_name=os.unix.nmon.memory.memnew.Process_PCT OR metric_name=os.unix.nmon.memory.mem.memtotal OR metric_name=os.unix.nmon.memory.mem.buffers OR metric_name=os.unix.nmon.memory.mem.cached OR metric_name=os.unix.nmon.memory.mem.memfree by OStype, host, metric_name span=1m\ | `def_memory_load_percent`\ | fields _time, host,mem_used_effective_PCT\ | `mapping_frameID`\ | lookup nmon_alerting_threshold_template frameID OUTPUT alert_physical_memory_max_percent as template_alert_physical_memory_max_percent, alert_physical_memory_min_time_seconds as template_alert_physical_memory_min_time_seconds\ | lookup nmon_alerting_threshold frameID host OUTPUT alert_physical_memory_max_percent as server_alert_physical_memory_max_percent, alert_physical_memory_min_time_seconds as server_alert_physical_memory_min_time_seconds\ | eval default_alert_physical_memory_max_percent="90", default_alert_physical_memory_min_time_seconds="300"\ | eval alert_physical_memory_max_percent=case(isnum(server_alert_physical_memory_max_percent), server_alert_physical_memory_max_percent, isnum(template_alert_physical_memory_max_percent), template_alert_physical_memory_max_percent, isnum(default_alert_physical_memory_max_percent), default_alert_physical_memory_max_percent),\ alert_physical_memory_min_time_seconds=case(isnum(server_alert_physical_memory_min_time_seconds), server_alert_physical_memory_min_time_seconds, isnum(template_alert_physical_memory_min_time_seconds), template_alert_physical_memory_min_time_seconds, isnum(default_alert_physical_memory_min_time_seconds), default_alert_physical_memory_min_time_seconds),\ alert_threshold_source=case(isnum(server_alert_physical_memory_max_percent), "server_thresholds", isnum(template_alert_physical_memory_max_percent), "template_thresholds", isnum(default_alert_physical_memory_max_percent), "default_threshold")\ | sort 0 - _time\ | eval status=if(mem_used_effective_PCT>alert_physical_memory_max_percent, "red", "green")\ | eval {status}=status\ | transaction frameID host status keepevicted=t keeporphans=t maxpause=5m\ | stats max(_time) as _time, latest(duration) as duration, latest(mem_used_effective_PCT) as latest_mem_used_effective_PCT, latest(alert_physical_memory_max_percent) as alert_physical_memory_max_percent, latest(alert_physical_memory_min_time_seconds) as alert_physical_memory_min_time_seconds, latest(alert_threshold_source) as alert_threshold_source, latest(status) as status by frameID, host\ | eval "duration (hh:mm:ss)"=tostring(duration, "duration")\ | where (status="red") AND (duration>=alert_physical_memory_min_time_seconds)\ | fields frameID,host,_time,duration,"duration (hh:mm:ss)",latest_mem_used_effective_PCT,alert_physical_memory_max_percent,alert_physical_memory_min_time_seconds,alert_threshold_source iseval = 0 [alerting_virtualmemory_usage] definition = mstats avg(_value) as value where `nmon_metrics_index` metric_name=os.unix.nmon.memory.mem.Virtual_total_MB OR metric_name=os.unix.nmon.memory.mem.Virtual_free_MB OR metric_name=os.unix.nmon.memory.mem.swapcached OR metric_name=os.unix.nmon.memory.mem.swaptotal OR metric_name=os.unix.nmon.memory.mem.swapfree by OStype, host, metric_name span=1m\ | `def_memory_load_percent`\ | fields _time, host,swap_used_effective_PCT\ | `mapping_frameID`\ | lookup nmon_alerting_threshold_template frameID OUTPUT alert_virtual_memory_max_percent as template_alert_virtual_memory_max_percent, alert_virtual_memory_min_time_seconds as template_alert_virtual_memory_min_time_seconds\ | lookup nmon_alerting_threshold frameID host OUTPUT alert_virtual_memory_max_percent as server_alert_virtual_memory_max_percent, alert_virtual_memory_min_time_seconds as server_alert_virtual_memory_min_time_seconds\ | eval default_alert_virtual_memory_max_percent="40", default_alert_virtual_memory_min_time_seconds="300"\ | eval alert_virtual_memory_max_percent=case(isnum(server_alert_virtual_memory_max_percent), server_alert_virtual_memory_max_percent, isnum(template_alert_virtual_memory_max_percent), template_alert_virtual_memory_max_percent, isnum(default_alert_virtual_memory_max_percent), default_alert_virtual_memory_max_percent),\ alert_virtual_memory_min_time_seconds=case(isnum(server_alert_virtual_memory_min_time_seconds), server_alert_virtual_memory_min_time_seconds, isnum(template_alert_virtual_memory_min_time_seconds), template_alert_virtual_memory_min_time_seconds, isnum(default_alert_virtual_memory_min_time_seconds), default_alert_virtual_memory_min_time_seconds),\ alert_threshold_source=case(isnum(server_alert_virtual_memory_max_percent), "server_thresholds", isnum(template_alert_virtual_memory_max_percent), "template_thresholds", isnum(default_alert_virtual_memory_max_percent), "default_threshold")\ | sort 0 - _time\ | eval status=if(swap_used_effective_PCT>alert_virtual_memory_max_percent, "red", "green")\ | eval {status}=status\ | transaction frameID host status keepevicted=t keeporphans=t maxpause=5m\ | stats max(_time) as _time, latest(duration) as duration, latest(swap_used_effective_PCT) as latest_swap_used_effective_PCT, latest(alert_virtual_memory_max_percent) as alert_virtual_memory_max_percent, latest(alert_virtual_memory_min_time_seconds) as alert_virtual_memory_min_time_seconds, latest(alert_threshold_source) as alert_threshold_source, latest(status) as status by frameID, host\ | eval "duration (hh:mm:ss)"=tostring(duration, "duration")\ | where (status="red") AND (duration>=alert_virtual_memory_min_time_seconds)\ | fields frameID,host,_time,duration,"duration (hh:mm:ss)",latest_swap_used_effective_PCT,alert_virtual_memory_max_percent,alert_virtual_memory_min_time_seconds,alert_threshold_source iseval = 0 ################### # BASELINE MACROS # ################### ### Baseline generation macros ### # # CPU_ALL # Average CPU usage, relevant for ALL OS # # CPU usage with simple baseline able to chart in the future - future charting capable [nmon_cpu_pct_simple_baseline_future(2)] args= host,statsmode definition = mstats avg(_value) as value where `nmon_metrics_index` metric_name=os.unix.nmon.cpu.cpu_all.Sys_PCT OR metric_name=os.unix.nmon.cpu.cpu_all.User_PCT OR metric_name=os.unix.nmon.cpu.cpu_all.Wait_PCT OR metric_name=os.unix.nmon.cpu.cpu_all.Steal_PCT host=$host$ by metric_name, host span=5m\ | `def_cpu_load_percent`\ | rename host AS hostname\ | append [ | gentimes [| stats count | addinfo | eval start=strftime('info_min_time', "%m/%d/%Y:%H:%M:%S") | return start] [| stats count | addinfo | eval end=strftime('info_max_time', "%m/%d/%Y:%H:%M:%S")\ | return end] increment=5m | eval _time=starttime | eval hostname="$host$"\ | timechart span=5m count by hostname | untable _time hostname count | fields - count ]\ | eval date_wday=if(isnull(date_wday), lower(strftime('_time', "%A")), date_wday)\ | eval local_time=if(isnull(local_time), strftime('_time', "%H%M"), local_time)\ | lookup nmon_baseline_CPU_ALL date_wday,local_time,hostname\ | timechart `baseline_span` $statsmode$(cpu_load_percent) AS cpu_load_percent, avg(baseline_avg_cpu) AS baseline_avg_cpu iseval = 0 # CPU usage with simple baseline able to chart in the future - no future charting [nmon_cpu_pct_simple_baseline(2)] args= host,statsmode definition = mstats avg(_value) as value where `nmon_metrics_index` metric_name=os.unix.nmon.cpu.cpu_all.Sys_PCT OR metric_name=os.unix.nmon.cpu.cpu_all.User_PCT OR metric_name=os.unix.nmon.cpu.cpu_all.Wait_PCT OR metric_name=os.unix.nmon.cpu.cpu_all.Steal_PCT host=$host$ by metric_name, host span=5m\ | `def_cpu_load_percent`\ | rename host AS hostname\ | eval date_wday=if(isnull(date_wday), lower(strftime('_time', "%A")), date_wday)\ | eval local_time=if(isnull(local_time), strftime('_time', "%H%M"), local_time)\ | lookup nmon_baseline_CPU_ALL date_wday,local_time,hostname\ | timechart `baseline_span` $statsmode$(cpu_load_percent) AS cpu_load_percent, avg(baseline_avg_cpu) AS baseline_avg_cpu iseval = 0 # CPU usage with lower, average and upper baseline (predict command rendering) - future charting capable [nmon_cpu_pct_full_baseline_future(2)] args= host,statsmode definition = mstats avg(_value) as value where `nmon_metrics_index` metric_name=os.unix.nmon.cpu.cpu_all.Sys_PCT OR metric_name=os.unix.nmon.cpu.cpu_all.User_PCT OR metric_name=os.unix.nmon.cpu.cpu_all.Wait_PCT OR metric_name=os.unix.nmon.cpu.cpu_all.Steal_PCT host=$host$ by metric_name, host span=5m\ | `def_cpu_load_percent`\ | rename host AS hostname\ | append [ | gentimes [| stats count | addinfo | eval start=strftime('info_min_time', "%m/%d/%Y:%H:%M:%S") | return start] [| stats count | addinfo | eval end=strftime('info_max_time', "%m/%d/%Y:%H:%M:%S")\ | return end] increment=5m | eval _time=starttime | eval hostname="$host$"\ | timechart span=5m count by hostname | untable _time hostname count | fields - count ]\ | eval date_wday=if(isnull(date_wday), lower(strftime('_time', "%A")), date_wday)\ | eval local_time=if(isnull(local_time), strftime('_time', "%H%M"), local_time)\ | lookup nmon_baseline_CPU_ALL date_wday,local_time,hostname\ | timechart `baseline_span` $statsmode$(cpu_load_percent) AS cpu_load_percent, avg(lower_baseline_avg_cpu) AS lower, avg(baseline_avg_cpu) AS predicted, avg(upper_baseline_avg_cpu) AS upper\ | eval _lower = "lower" | eval _predicted = "predicted" | eval _upper = "upper" iseval = 0 # CPU usage with lower, average and upper baseline (predict command rendering) - no future charting [nmon_cpu_pct_full_baseline(2)] args= host,statsmode definition = mstats avg(_value) as value where `nmon_metrics_index` metric_name=os.unix.nmon.cpu.cpu_all.Sys_PCT OR metric_name=os.unix.nmon.cpu.cpu_all.User_PCT OR metric_name=os.unix.nmon.cpu.cpu_all.Wait_PCT OR metric_name=os.unix.nmon.cpu.cpu_all.Steal_PCT host=$host$ by metric_name, host span=5m\ | `def_cpu_load_percent`\ | rename host AS hostname\ | eval date_wday=if(isnull(date_wday), lower(strftime('_time', "%A")), date_wday)\ | eval local_time=if(isnull(local_time), strftime('_time', "%H%M"), local_time)\ | lookup nmon_baseline_CPU_ALL date_wday,local_time,hostname\ | timechart `baseline_span` $statsmode$(cpu_load_percent) AS cpu_load_percent, avg(lower_baseline_avg_cpu) AS lower, avg(baseline_avg_cpu) AS predicted, avg(upper_baseline_avg_cpu) AS upper\ | eval _lower = "lower" | eval _predicted = "predicted" | eval _upper = "upper" iseval = 0 # # LPAR # Average AIX micro-partitions Virtual CPU usage, relevant for AIX OS only # # Virtual CPU usage with simple baseline - future charting capable [nmon_vp_usage_simple_baseline_future(2)] args= host,statsmode definition = mstats avg(_value) as value where `nmon_metrics_index` metric_name=os.unix.nmon.cpu.lpar.* host=$host$ by OStype, metric_name, host span=5m\ | `def_lpar_load_cores`\ | fields _time, host, lpar_load_cores, entitled, virtualCPUs\ | rename host AS hostname\ | append [ | gentimes [| stats count | addinfo | eval start=strftime('info_min_time', "%m/%d/%Y:%H:%M:%S") | return start] [| stats count | addinfo | eval end=strftime('info_max_time', "%m/%d/%Y:%H:%M:%S")\ | return end] increment=5m | eval _time=starttime | eval hostname="$host$"\ | timechart span=5m count by hostname | untable _time hostname count | fields - count ]\ | eval date_wday=if(isnull(date_wday), lower(strftime('_time', "%A")), date_wday)\ | eval local_time=if(isnull(local_time), strftime('_time', "%H%M"), local_time)\ | lookup nmon_baseline_LPAR date_wday,local_time,hostname\ | timechart `baseline_span` $statsmode$(lpar_load_cores) AS vp_usage, max(entitled) AS entitled, max(virtualCPUs) AS virtualCPUs, avg(baseline_avg_vp_usage) AS baseline_avg_vp_usage iseval = 0 # Virtual CPU usage with simple baseline - no future charting [nmon_vp_usage_simple_baseline(2)] args= host,statsmode definition = mstats avg(_value) as value where `nmon_metrics_index` metric_name=os.unix.nmon.cpu.lpar.* host=$host$ by OStype, metric_name, host span=5m\ | `def_lpar_load_cores`\ | fields _time, host, lpar_load_cores, entitled, virtualCPUs\ | rename host AS hostname\ | eval date_wday=if(isnull(date_wday), lower(strftime('_time', "%A")), date_wday)\ | eval local_time=if(isnull(local_time), strftime('_time', "%H%M"), local_time)\ | lookup nmon_baseline_LPAR date_wday,local_time,hostname\ | timechart `baseline_span` $statsmode$(lpar_load_cores) AS vp_usage, max(entitled) AS entitled, max(virtualCPUs) AS virtualCPUs, avg(baseline_avg_vp_usage) AS baseline_avg_vp_usage iseval = 0 # Virtual CPU usage with lower, average and upper baseline (predict command rendering) - future charting capable [nmon_vp_usage_full_baseline_future(2)] args= host,statsmode definition = mstats avg(_value) as value where `nmon_metrics_index` metric_name=os.unix.nmon.cpu.lpar.* host=$host$ by OStype, metric_name, host span=5m\ | `def_lpar_load_cores`\ | fields _time, host, lpar_load_cores, entitled, virtualCPUs\ | rename host AS hostname\ | append [ | gentimes [| stats count | addinfo | eval start=strftime('info_min_time', "%m/%d/%Y:%H:%M:%S") | return start] [| stats count | addinfo | eval end=strftime('info_max_time', "%m/%d/%Y:%H:%M:%S")\ | return end] increment=5m | eval _time=starttime | eval hostname="$host$"\ | timechart span=5m count by hostname | untable _time hostname count | fields - count ]\ | eval date_wday=if(isnull(date_wday), lower(strftime('_time', "%A")), date_wday)\ | eval local_time=if(isnull(local_time), strftime('_time', "%H%M"), local_time)\ | lookup nmon_baseline_LPAR date_wday,local_time,hostname\ | timechart `baseline_span` $statsmode$(lpar_load_cores) AS vp_usage, max(entitled) AS entitled, max(virtualCPUs) AS virtualCPUs\ avg(lower_baseline_avg_vp_usage) AS lower, avg(baseline_avg_vp_usage) AS predicted, avg(upper_baseline_avg_vp_usage) AS upper\ | eval _lower = "lower" | eval _predicted = "predicted" | eval _upper = "upper" iseval = 0 # Virtual CPU usage with lower, average and upper baseline (predict command rendering) - no future charting [nmon_vp_usage_full_baseline(2)] args= host,statsmode definition = mstats avg(_value) as value where `nmon_metrics_index` metric_name=os.unix.nmon.cpu.lpar.* host=$host$ by OStype, metric_name, host span=5m\ | `def_lpar_load_cores`\ | fields _time, host, lpar_load_cores, entitled, virtualCPUs\ | rename host AS hostname\ | eval date_wday=if(isnull(date_wday), lower(strftime('_time', "%A")), date_wday)\ | eval local_time=if(isnull(local_time), strftime('_time', "%H%M"), local_time)\ | lookup nmon_baseline_LPAR date_wday,local_time,hostname\ | timechart `baseline_span` $statsmode$(lpar_load_cores) AS vp_usage, max(entitled) AS entitled, max(virtualCPUs) AS virtualCPUs\ avg(lower_baseline_avg_vp_usage) AS lower, avg(baseline_avg_vp_usage) AS predicted, avg(upper_baseline_avg_vp_usage) AS upper\ | eval _lower = "lower" | eval _predicted = "predicted" | eval _upper = "upper" iseval = 0 # Pool Virtual CPU usage with simple baseline - future charting capable [nmon_pool_usage_simple_baseline_future(2)] args= host,statsmode definition = mstats avg(_value) as value where `nmon_metrics_index` metric_name=os.unix.nmon.cpu.lpar.* host="$host$" by OStype, metric_name, host span=5m\ | `def_all_os_lpar_pool_load_cores`\ | rename host AS hostname\ | append [ | gentimes [| stats count | addinfo | eval start=strftime('info_min_time', "%m/%d/%Y:%H:%M:%S") | return start] [| stats count | addinfo | eval end=strftime('info_max_time', "%m/%d/%Y:%H:%M:%S")\ | return end] increment=5m | eval _time=starttime | eval hostname="$host$"\ | timechart span=5m count by hostname | untable _time hostname count | fields - count ]\ | eval date_wday=if(isnull(date_wday), lower(strftime('_time', "%A")), date_wday)\ | eval local_time=if(isnull(local_time), strftime('_time', "%H%M"), local_time)\ | lookup nmon_baseline_LPAR date_wday,local_time,hostname\ | timechart `baseline_span` $statsmode$(lpar_pool_vp_usage) AS pool_usage, max(poolCPUs) AS poolCPUs, avg(baseline_avg_pool_usage) AS baseline_avg_pool_usage iseval = 0 # Pool Virtual CPU usage with simple baseline - no future charting [nmon_pool_usage_simple_baseline(2)] args= host,statsmode definition = mstats avg(_value) as value where `nmon_metrics_index` metric_name=os.unix.nmon.cpu.lpar.* host="$host$" by OStype, metric_name, host span=5m\ | `def_all_os_lpar_pool_load_cores`\ | rename host AS hostname\ | eval date_wday=if(isnull(date_wday), lower(strftime('_time', "%A")), date_wday)\ | eval local_time=if(isnull(local_time), strftime('_time', "%H%M"), local_time)\ | lookup nmon_baseline_LPAR date_wday,local_time,hostname\ | timechart `baseline_span` $statsmode$(lpar_pool_vp_usage) AS pool_usage, max(poolCPUs) AS poolCPUs, avg(baseline_avg_pool_usage) AS baseline_avg_pool_usage iseval = 0 # Pool CPU usage with lower, average and upper baseline (predict command rendering) - future charting capable [nmon_pool_usage_full_baseline_future(2)] args= host,statsmode definition = mstats avg(_value) as value where `nmon_metrics_index` metric_name=os.unix.nmon.cpu.lpar.* host="$host$" by OStype, metric_name, host span=5m\ | `def_all_os_lpar_pool_load_cores`\ | rename host AS hostname\ | append [ | gentimes [| stats count | addinfo | eval start=strftime('info_min_time', "%m/%d/%Y:%H:%M:%S") | return start] [| stats count | addinfo | eval end=strftime('info_max_time', "%m/%d/%Y:%H:%M:%S")\ | return end] increment=5m | eval _time=starttime | eval hostname="$host$"\ | timechart span=5m count by hostname | untable _time hostname count | fields - count ]\ | eval date_wday=if(isnull(date_wday), lower(strftime('_time', "%A")), date_wday)\ | eval local_time=if(isnull(local_time), strftime('_time', "%H%M"), local_time)\ | lookup nmon_baseline_LPAR date_wday,local_time,hostname\ | timechart `baseline_span` $statsmode$(lpar_pool_vp_usage) AS pool_usage, max(poolCPUs) AS poolCPUs, avg(lower_baseline_avg_pool_usage) AS lower, avg(baseline_avg_pool_usage) AS predicted, avg(upper_baseline_avg_pool_usage) AS upper\ | eval _lower = "lower" | eval _predicted = "predicted" | eval _upper = "upper" iseval = 0 # Pool CPU usage with lower, average and upper baseline (predict command rendering) - no future charting [nmon_pool_usage_full_baseline(2)] args= host,statsmode definition = mstats avg(_value) as value where `nmon_metrics_index` metric_name=os.unix.nmon.cpu.lpar.* host="$host$" by OStype, metric_name, host span=5m\ | `def_all_os_lpar_pool_load_cores`\ | rename host AS hostname\ | eval date_wday=if(isnull(date_wday), lower(strftime('_time', "%A")), date_wday)\ | eval local_time=if(isnull(local_time), strftime('_time', "%H%M"), local_time)\ | lookup nmon_baseline_LPAR date_wday,local_time,hostname\ | timechart `baseline_span` $statsmode$(lpar_pool_vp_usage) AS pool_usage, max(poolCPUs) AS poolCPUs, avg(lower_baseline_avg_pool_usage) AS lower, avg(baseline_avg_pool_usage) AS predicted, avg(upper_baseline_avg_pool_usage) AS upper\ | eval _lower = "lower" | eval _predicted = "predicted" | eval _upper = "upper" iseval = 0 # # MEM # Average Real and Virtual Memory usage, relevant for ALL OS # # Real Memory Usage (in percentage) with simple baseline - future charting capabable [nmon_real_mem_simple_baseline_future(2)] args= host,statsmode definition = mstats avg(_value) as value where `nmon_metrics_index` `def_memory_all_os_metric_filters` (host=$host$) by OStype, metric_name, host span=5m\ | `def_memory_load_percent`\ | rename host AS hostname\ | append [ | gentimes [| stats count | addinfo | eval start=strftime('info_min_time', "%m/%d/%Y:%H:%M:%S") | return start] [| stats count | addinfo | eval end=strftime('info_max_time', "%m/%d/%Y:%H:%M:%S")\ | return end] increment=5m | eval _time=starttime | eval hostname="$host$"\ | timechart span=5m count by hostname | untable _time hostname count | fields - count ]\ | eval date_wday=if(isnull(date_wday), lower(strftime('_time', "%A")), date_wday)\ | eval local_time=if(isnull(local_time), strftime('_time', "%H%M"), local_time)\ | lookup nmon_baseline_MEM date_wday,local_time,hostname\ | timechart `baseline_span` $statsmode$(mem_used_effective_PCT) AS avg_real_mem, avg(baseline_avg_real_mem) AS baseline_avg_real_mem iseval = 0 # Real Memory Usage (in percentage) with simple baseline - no future charting [nmon_real_mem_simple_baseline(2)] args= host,statsmode definition = mstats avg(_value) as value where `nmon_metrics_index` `def_memory_all_os_metric_filters` (host=$host$) by OStype, metric_name, host span=5m\ | `def_memory_load_percent`\ | rename host AS hostname\ | eval date_wday=if(isnull(date_wday), lower(strftime('_time', "%A")), date_wday)\ | eval local_time=if(isnull(local_time), strftime('_time', "%H%M"), local_time)\ | lookup nmon_baseline_MEM date_wday,local_time,hostname\ | timechart `baseline_span` $statsmode$(mem_used_effective_PCT) AS avg_real_mem, avg(baseline_avg_real_mem) AS baseline_avg_real_mem iseval = 0 # Real Memory Usage (in percentage) with lower, average and upper baseline (predict command rendering) - future charting capable [nmon_real_mem_full_baseline_future(2)] args= host,statsmode definition = mstats avg(_value) as value where `nmon_metrics_index` `def_memory_all_os_metric_filters` (host=$host$) by OStype, metric_name, host span=5m\ | `def_memory_load_percent`\ | rename host AS hostname\ | append [ | gentimes [| stats count | addinfo | eval start=strftime('info_min_time', "%m/%d/%Y:%H:%M:%S") | return start] [| stats count | addinfo | eval end=strftime('info_max_time', "%m/%d/%Y:%H:%M:%S")\ | return end] increment=5m | eval _time=starttime | eval hostname="$host$"\ | timechart span=5m count by hostname | untable _time hostname count | fields - count ]\ | eval date_wday=if(isnull(date_wday), lower(strftime('_time', "%A")), date_wday)\ | eval local_time=if(isnull(local_time), strftime('_time', "%H%M"), local_time)\ | lookup nmon_baseline_MEM date_wday,local_time,hostname\ | timechart `baseline_span` $statsmode$(mem_used_effective_PCT) AS avg_real_mem, avg(lower_baseline_avg_real_mem) AS lower, avg(baseline_avg_real_mem) AS predicted, avg(upper_baseline_avg_real_mem) AS upper\ | eval _lower = "lower" | eval _predicted = "predicted" | eval _upper = "upper" iseval = 0 # Real Memory Usage (in percentage) with lower, average and upper baseline (predict command rendering) - no future charting [nmon_real_mem_full_baseline(2)] args= host,statsmode definition = mstats avg(_value) as value where `nmon_metrics_index` `def_memory_all_os_metric_filters` (host=$host$) by OStype, metric_name, host span=5m\ | `def_memory_load_percent`\ | rename host AS hostname\ | eval date_wday=if(isnull(date_wday), lower(strftime('_time', "%A")), date_wday)\ | eval local_time=if(isnull(local_time), strftime('_time', "%H%M"), local_time)\ | lookup nmon_baseline_MEM date_wday,local_time,hostname\ | timechart `baseline_span` $statsmode$(mem_used_effective_PCT) AS avg_real_mem, avg(lower_baseline_avg_real_mem) AS lower, avg(baseline_avg_real_mem) AS predicted, avg(upper_baseline_avg_real_mem) AS upper\ | eval _lower = "lower" | eval _predicted = "predicted" | eval _upper = "upper" iseval = 0 # Virtual Memory Usage (in percentage) with simple baseline - future charting capable [nmon_virtual_mem_simple_baseline_future(2)] args= host,statsmode definition = mstats avg(_value) as value where `nmon_metrics_index` `def_memory_all_os_metric_filters` (host=$host$) by OStype, metric_name, host span=5m\ | `def_memory_load_percent`\ | rename host AS hostname\ | append [ | gentimes [| stats count | addinfo | eval start=strftime('info_min_time', "%m/%d/%Y:%H:%M:%S") | return start] [| stats count | addinfo | eval end=strftime('info_max_time', "%m/%d/%Y:%H:%M:%S")\ | return end] increment=5m | eval _time=starttime | eval hostname="$host$"\ | timechart span=5m count by hostname | untable _time hostname count | fields - count ]\ | eval date_wday=if(isnull(date_wday), lower(strftime('_time', "%A")), date_wday)\ | eval local_time=if(isnull(local_time), strftime('_time', "%H%M"), local_time)\ | lookup nmon_baseline_MEM date_wday,local_time,hostname\ | timechart `baseline_span` $statsmode$(swap_used_effective_PCT) AS avg_virtual_mem, avg(baseline_avg_virtual_mem) AS baseline_avg_virtual_mem iseval = 0 # Virtual Memory Usage (in percentage) with simple baseline - no future charting [nmon_virtual_mem_simple_baseline(2)] args= host,statsmode definition = mstats avg(_value) as value where `nmon_metrics_index` `def_memory_all_os_metric_filters` (host=$host$) by OStype, metric_name, host span=5m\ | `def_memory_load_percent`\ | rename host AS hostname\ | eval date_wday=if(isnull(date_wday), lower(strftime('_time', "%A")), date_wday)\ | eval local_time=if(isnull(local_time), strftime('_time', "%H%M"), local_time)\ | lookup nmon_baseline_MEM date_wday,local_time,hostname\ | timechart `baseline_span` $statsmode$(swap_used_effective_PCT) AS avg_virtual_mem, avg(baseline_avg_virtual_mem) AS baseline_avg_virtual_mem iseval = 0 # Virtual Memory Usage (in percentage) with lower, average and upper baseline (predict command rendering) - future charting capable [nmon_virtual_mem_full_baseline_future(2)] args= host,statsmode definition = mstats avg(_value) as value where `nmon_metrics_index` `def_memory_all_os_metric_filters` (host=$host$) by OStype, metric_name, host span=5m\ | `def_memory_load_percent`\ | rename host AS hostname\ | append [ | gentimes [| stats count | addinfo | eval start=strftime('info_min_time', "%m/%d/%Y:%H:%M:%S") | return start] [| stats count | addinfo | eval end=strftime('info_max_time', "%m/%d/%Y:%H:%M:%S")\ | return end] increment=5m | eval _time=starttime | eval hostname="$host$"\ | timechart span=5m count by hostname | untable _time hostname count | fields - count ]\ | eval date_wday=if(isnull(date_wday), lower(strftime('_time', "%A")), date_wday)\ | eval local_time=if(isnull(local_time), strftime('_time', "%H%M"), local_time)\ | lookup nmon_baseline_MEM date_wday,local_time,hostname\ | timechart `baseline_span` $statsmode$(swap_used_effective_PCT) AS avg_virtual_mem, avg(lower_baseline_avg_virtual_mem) AS lower, avg(baseline_avg_virtual_mem) AS predicted, avg(upper_baseline_avg_virtual_mem) AS upper\ | eval _lower = "lower" | eval _predicted = "predicted" | eval _upper = "upper" iseval = 0 # Virtual Memory Usage (in percentage) with lower, average and upper baseline (predict command rendering) - no future charting [nmon_virtual_mem_full_baseline(2)] args= host,statsmode definition = mstats avg(_value) as value where `nmon_metrics_index` `def_memory_all_os_metric_filters` (host=$host$) by OStype, metric_name, host span=5m\ | `def_memory_load_percent`\ | rename host AS hostname\ | eval date_wday=if(isnull(date_wday), lower(strftime('_time', "%A")), date_wday)\ | eval local_time=if(isnull(local_time), strftime('_time', "%H%M"), local_time)\ | lookup nmon_baseline_MEM date_wday,local_time,hostname\ | timechart `baseline_span` $statsmode$(swap_used_effective_PCT) AS avg_virtual_mem, avg(lower_baseline_avg_virtual_mem) AS lower, avg(baseline_avg_virtual_mem) AS predicted, avg(upper_baseline_avg_virtual_mem) AS upper\ | eval _lower = "lower" | eval _predicted = "predicted" | eval _upper = "upper" iseval = 0 # # DISKXFER # Average Number of disk I/O per sec stats, relevant for ALL OS # # Average IOPS with simple baseline - future charting capable [nmon_iops_simple_baseline_future(2)] args= host,statsmode definition = mstats sum(_value) as value where `nmon_metrics_index` metric_name=os.unix.nmon.storage.diskxfer OR metric_name=os.unix.nmon.storage.dgxfer host=$host$ by metric_name, host span=1m\ | `extract_metrics`\ | eval diskxfer_iops=case(metric_name=="os.unix.nmon.storage.diskxfer", value), dgxfer_iops=case(metric_name=="os.unix.nmon.storage.dgxfer", value)\ | stats max(diskxfer_iops) as diskxfer_iops, max(dgxfer_iops) as dgxfer_iops by _time, host\ | eval iops=if(isnum(dgxfer_iops), dgxfer_iops, diskxfer_iops)\ | bucket _time span=5m\ | stats avg(iops) as iops by _time, host\ | rename host AS hostname\ | append [ | gentimes [| stats count | addinfo | eval start=strftime('info_min_time', "%m/%d/%Y:%H:%M:%S") | return start] [| stats count | addinfo | eval end=strftime('info_max_time', "%m/%d/%Y:%H:%M:%S")\ | return end] increment=5m | eval _time=starttime | eval hostname="$host$"\ | timechart span=5m count by hostname | untable _time hostname count | fields - count ]\ | eval date_wday=if(isnull(date_wday), lower(strftime('_time', "%A")), date_wday)\ | eval local_time=if(isnull(local_time), strftime('_time', "%H%M"), local_time)\ | lookup nmon_baseline_DISKXFER date_wday,local_time,hostname\ | timechart `baseline_span` $statsmode$(iops) AS disk_iops, avg(baseline_avg_disk_iops) AS baseline_disk_iops iseval = 0 # Average IOPS with simple baseline - no future charting [nmon_iops_simple_baseline(2)] args= host,statsmode definition = mstats sum(_value) as value where `nmon_metrics_index` metric_name=os.unix.nmon.storage.diskxfer OR metric_name=os.unix.nmon.storage.dgxfer host=$host$ by metric_name, host span=1m\ | `extract_metrics`\ | eval diskxfer_iops=case(metric_name=="os.unix.nmon.storage.diskxfer", value), dgxfer_iops=case(metric_name=="os.unix.nmon.storage.dgxfer", value)\ | stats max(diskxfer_iops) as diskxfer_iops, max(dgxfer_iops) as dgxfer_iops by _time, host\ | eval iops=if(isnum(dgxfer_iops), dgxfer_iops, diskxfer_iops)\ | bucket _time span=5m\ | stats avg(iops) as iops by _time, host\ | rename host AS hostname\ | eval date_wday=if(isnull(date_wday), lower(strftime('_time', "%A")), date_wday)\ | eval local_time=if(isnull(local_time), strftime('_time', "%H%M"), local_time)\ | lookup nmon_baseline_DISKXFER date_wday,local_time,hostname\ | timechart `baseline_span` $statsmode$(iops) AS disk_iops, avg(baseline_avg_disk_iops) AS baseline_disk_iops iseval = 0 # Average IOPS with lower, average and upper baseline (predict command rendering) - future charting capable [nmon_iops_full_baseline_future(2)] args= host,statsmode definition = mstats sum(_value) as value where `nmon_metrics_index` metric_name=os.unix.nmon.storage.diskxfer OR metric_name=os.unix.nmon.storage.dgxfer host=$host$ by metric_name, host span=1m\ | `extract_metrics`\ | eval diskxfer_iops=case(metric_name=="os.unix.nmon.storage.diskxfer", value), dgxfer_iops=case(metric_name=="os.unix.nmon.storage.dgxfer", value)\ | stats max(diskxfer_iops) as diskxfer_iops, max(dgxfer_iops) as dgxfer_iops by _time, host\ | eval iops=if(isnum(dgxfer_iops), dgxfer_iops, diskxfer_iops)\ | bucket _time span=5m\ | stats avg(iops) as iops by _time, host\ | rename host AS hostname\ | append [ | gentimes [| stats count | addinfo | eval start=strftime('info_min_time', "%m/%d/%Y:%H:%M:%S") | return start] [| stats count | addinfo | eval end=strftime('info_max_time', "%m/%d/%Y:%H:%M:%S")\ | return end] increment=5m | eval _time=starttime | eval hostname="$host$"\ | timechart span=5m count by hostname | untable _time hostname count | fields - count ]\ | eval date_wday=if(isnull(date_wday), lower(strftime('_time', "%A")), date_wday)\ | eval local_time=if(isnull(local_time), strftime('_time', "%H%M"), local_time)\ | lookup nmon_baseline_DISKXFER date_wday,local_time,hostname\ | timechart `baseline_span` $statsmode$(iops) AS disk_iops,\ avg(lower_baseline_avg_disk_iops) AS lower, avg(baseline_avg_disk_iops) AS predicted, avg(upper_baseline_avg_disk_iops) AS upper\ | eval _lower = "lower" | eval _predicted = "predicted" | eval _upper = "upper" iseval = 0 # Average IOPS with lower, average and upper baseline (predict command rendering) - no future charting [nmon_iops_full_baseline(2)] args= host,statsmode definition = mstats sum(_value) as value where `nmon_metrics_index` metric_name=os.unix.nmon.storage.diskxfer OR metric_name=os.unix.nmon.storage.dgxfer host=$host$ by metric_name, host span=1m\ | `extract_metrics`\ | eval diskxfer_iops=case(metric_name=="os.unix.nmon.storage.diskxfer", value), dgxfer_iops=case(metric_name=="os.unix.nmon.storage.dgxfer", value)\ | stats max(diskxfer_iops) as diskxfer_iops, max(dgxfer_iops) as dgxfer_iops by _time, host\ | eval iops=if(isnum(dgxfer_iops), dgxfer_iops, diskxfer_iops)\ | bucket _time span=5m\ | stats avg(iops) as iops by _time, host\ | rename host AS hostname\ | eval date_wday=if(isnull(date_wday), lower(strftime('_time', "%A")), date_wday)\ | eval local_time=if(isnull(local_time), strftime('_time', "%H%M"), local_time)\ | lookup nmon_baseline_DISKXFER date_wday,local_time,hostname\ | timechart `baseline_span` $statsmode$(iops) AS disk_iops,\ avg(lower_baseline_avg_disk_iops) AS lower, avg(baseline_avg_disk_iops) AS predicted, avg(upper_baseline_avg_disk_iops) AS upper\ | eval _lower = "lower" | eval _predicted = "predicted" | eval _upper = "upper" iseval = 0