DX Application Performance Management

 View Only
Expand all | Collapse all

Queries regarding Historical Event Viewer

  • 1.  Queries regarding Historical Event Viewer

    Posted Apr 15, 2015 02:36 AM

    From the Historical Events viewer, it is evident that the oldest 500 events are returned while I am querying with <AgentName> in the search bar and I can see more no of events found indicated at the bottom left hand corner of the viewing pane. While I am searching with <type:errorsnapshot>/<errorsnapshot> in the query pane the oldest 500 error events are getting returned from all the agents.

    I need to get error happened under a particular agent for last 1 week. How can I search for this? Can anybody help?

    Also want to know whether the no if events returned after querying historical events can be modified or not. If yes how?

     

    Regards,

    Amit



  • 2.  Re: Queries regarding Historical Event Viewer

    Posted Apr 15, 2015 05:58 PM

    Hi Amit,

     

    I need to get error happened under a particular agent for last 1 week.

    Vaibhav --> Yes you can extract it.

    1. Enter Query "type:errorsnapshot AND (agent:AGENT_NAME)"
    2. Select the time window for which you are looking for. - here in this case take 7 days.

     

    In place of agent_name, enter the name of the agent. If agent's name is common or similar for two servrs, then include server\host name also in the similar format.

     

    Also want to know whether the no if events returned after querying historical events can be modified or not. If yes how?

    Vaibhav-->There is no direct way to manipulate the event data. But I guess you can play around with Events DB and see if you can.But I would suggest not to go with that as that might corrupt your DB and hence your APM solution.


    Hope it helps.


    Regards,

    Vaibhav



  • 3.  Re: Queries regarding Historical Event Viewer

    Posted Apr 16, 2015 04:21 AM

    Vaibhav,

    Thanks a lot for the help. Appreciate it. I was trying the same but was most probably stuck between the agent name & hostname. Does that query work for the Scheduled introscope reports too?

    For the second part, excuse me for phrasing it wrongly. I wanted to modify viewing pane properties where only oldest 500 results shown. I want to see all the results.Is there any parameter in the Workstation properties file?

    Also I have noticed another thing while looking at my Workstation properties file which is as follows

    As Per workstation guide: By default, the Query field remembers up to twelve searches; you can designate a different number of searches for the field to remember by editing the introscope.workstation.historical.query.history.limit property in IntroscopeWorkstation.properties.

    But strangely there is no such property defined in my IntroscopeWorkstation.properties file but the query field still remembers the last 12 searches. How can I edit that property while it is not there?Hiko_Davis



  • 4.  Re: Queries regarding Historical Event Viewer

    Broadcom Employee
    Posted Apr 16, 2015 04:38 AM

    The dashboard views are setup with limits so as not to impact EM performance.

    The more data you show on a dasboard and widget, greater the performance impact to the EM.

     

    Leave that sort of thing to reports. If you need reports that show more than what's available in APM, consider extracting the data and moving it to your own datastore.



  • 5.  Re: Queries regarding Historical Event Viewer

    Posted Apr 16, 2015 05:46 AM

    Thanks Hiko for the help. Let me dig into reporting and I will come up with a new thread if I need any help there.



  • 6.  Re: Queries regarding Historical Event Viewer

    Posted Apr 16, 2015 01:11 PM

    How can I publish this query result in a report? The Workstation guide refers graphical report element takes Metric Grouping as Data Source. If I want to generate a report containing No of Errors happened in a particular agent what is the best approach?



  • 7.  Re: Queries regarding Historical Event Viewer

    Broadcom Employee
    Posted Apr 16, 2015 03:07 PM

    Anything coming from the events db will be in XML format, so you'll have to parse for the information yourself.

     

    What are the details you would like from this query?



  • 8.  Re: Queries regarding Historical Event Viewer

    Posted Apr 16, 2015 11:56 PM

    Hiko,

    Yes, I have noticed that. I can export the search results from the Historical Query Viewer as text or xml. But I also noticed that, the exported xml or text file doesn't contain all the events rather it only exports oldest 500 events which are visible in the viewing pane. Even if I go for a xml parser that would parse the limited information available in the xml file. My Primary concern is to fetch information about all the error occurred in 24 hours, from a particular agent in a host. I can query the events DB for that, but always getting oldest 500 events. Can you suggest any work around for this ?

     

    Regards,

    Amit.



  • 9.  Re: Queries regarding Historical Event Viewer

    Broadcom Employee
    Posted Apr 17, 2015 01:36 AM

    You could alter the limit on the number of results via the properties file, but I suggest you not do that as it will impact the performance of the EM doing said query.

     

    My suggestion is to run the query for the historical data in chunks and then going forward, you do this at a regular interval as not to impact performance by wanting so many results.



  • 10.  Re: Queries regarding Historical Event Viewer

    Posted Apr 17, 2015 07:25 AM

    Hi Amit,

     

    The only feasible way I would suggest you is to run the query on hourly basis( or two hourly basis depending on the total error count) and collect the info.

    And I am also assuming that you are not interested in error count but in the content of that error, otherwise you can get the value at the bottom of the historical viewer.

     

    Hope it helps.

     

    Regards,

    Vaibhav



  • 11.  Re: Queries regarding Historical Event Viewer

    Posted Apr 20, 2015 01:50 AM

    Vaibhav,

    Thanks for replying. Yes, I can get the total count the bottom of the viewer pane but the detail info about all the error is required. Is there any means by which we can schedule it to publish like a Introscope report ?

    Regards,

    Amit.



  • 12.  Re: Queries regarding Historical Event Viewer

    Broadcom Employee
    Posted Apr 20, 2015 12:23 PM

    You run CLW as a scheduled task to download data or run a redefined report from a Management Module.

    There is no scheduling tool for this in APM.

     

    I am, however, working on a fieldpack to help automate this process.

     

    So you can create a cronjob or a Windows Scheduler task to run this report.



  • 13.  Re: Queries regarding Historical Event Viewer

    Posted Apr 20, 2015 06:03 PM

    Amit,

    As per my knowledge, there is no out-of-box functionality provided to achieve this.

     

    But as a work around what could be done is,  you can export the error details into Excel\Text format and try to extract the String after "Error Message:" using some sort of script or Macro or VB.[extracting string using string functions]

     

    Hope it helps.

     

    Regards,

    Vaibhav