Column names are case-insensitive but also case-preserving, the names given here is how the schema is defined. If your SELECT statement does write explicit column names, the case used in this statement will be returned. Therefore it is recommended to always explicitly use table names in queries rather than rely on the case defined in the schema.
Be aware that the id column of the SAMPLE, OBSERVATION and ACTION tables are not meant to be interpreted, they are no more than a unique string used to identify a sample. How this string is constituted is a design detail internal to asagent and can change between releases. For that reason the string content should not be relied upon.
Snapshot of the host process table. There is one row per process found and the pid attribute is the table’s primary key. The availability and scale of the attribute values is platform dependant.
| pid | Process ID | int |
| ppid | PID of the parent process | int |
| user | Process user | string |
| uid | Process user ID | int |
| grp | Process group | string |
| gid | Process group ID | int |
| nice | Process nice value | int |
| nthreads | Number of process threads | int |
| priority | Process priority | int |
| pgrp | PID of the process’ group leader | int |
| sid | PID of the process’ session leader | int |
| startTime | Time the process started | string |
| cputime | Accumulated CPU time of the process | float |
| stime | Accumulated system time of the process | float |
| utime | Accumulated user time of the process | float |
| rss | Process resident memory usage | int |
| vsz | Process virtual size | int |
| exe | The process executable name | string |
| args | The command line args. | string |
This table represents the agent status over time. There is one row per status interval and the timestamp attribute is the table’s primary key.
| timestamp | Status timestamp | string |
| startTime | Time the agent started | string |
| upTimeSeconds | The agent uptime in seconds | int |
| uptime | The agent uptime as a friendly string | string |
| configLocation | The path to the agent’s runtime configuration | string |
| configDts | The time the agent configuration was updated | string |
| host | Name of the host the agent is running on | string |
| ip | IP address of the host the agent is running on | string |
| cpu | %cpu the agent is using | float |
| rss | Agent resident memory usage | int |
| vsz | Agent virtual memory usage | int |
Deprecated
This table represents the sample data that agent monitors have acquired. There is one row per sample facet and the table’s primary key is a composite key made of the id and facetId columns.
| id | Sample ID | string |
| facetId | Sample Facet ID | string |
| facetValue | String representation of the sample facet value | string |
| facetType | Data type that the facet value string represents | string |
Deprecated
This table represents the observations made by the agent based on its configuration and the sample data it has encountered. There is one row per observation made and the id attribute is the table’s primary key.
| id | Observation ID | string |
| timestamp | Time when the observation was raised | string |
| message | Message associated with the observation | string |
| processed | Boolean to signify if an action has been made | int |
Deprecated
This table represents the actions raised by the agent based on its configuration and the observation data it has encountered. There is one row per action raised and the id attribute is the table’s primary key. The table has an Observation ID as a foreign key (meaning that there can be many actions for a single observation).
| id | Action ID | string |
| obsId | The ID of the parent observation | string |
| timestamp | Time the action was invoked | string |
| actionType | The type of action that was invoked | string |
New in version 7.0.
This table represents the sample data that agent monitors have acquired. There is one row per sample facet and the table’s primary key is an integer id. The number of rows is controlled by the monitor_window runtime setting.
| id | Non-zero integer that uniquely identifies a row in the table. This is the primary key of the table and in general will be assigned in chronological order. | int |
| component | The component name of the monitor which took the sample containing this facet. | string |
| monitor | The name of the monitor which took the sample containing this facet. | string |
| type | The type of the monitor which took the sample containing this facet. | string |
| sampleid | The unique integer ID of the sample this facet is part of. | int |
| subid | The sample sub-id of this facet. The sample sub-ID is a string which is used to differentiate between samples from a single monitor. That is, samples with different sub-IDs will be treated by the analysis engine as if they were created my separate monitors. This is required for example when one disk monitor monitors multiple disks, suppressions for each monitored disk are treated individually. | string |
| timestamp | The time this sample was taken expressed in seconds since the epoch as a floating point number. | float |
| facetname | The facet name. | string |
| facettype | The facet value type. Possible values are bool, int, float and string. | string |
| facetvalue | A string representation of the facet value. Use the facettype to interpret this value correctly. | string |
New in version 7.0.
This table represents the observations made by the analysis engine. There is one row per observation and the table’s primary key is an integer id. The number of rows is controlled by the analysis_window runtime setting.
| id | Non-zero integer that uniquely identifies a row in the table. This is the primary key of the table and in general will be assigned in chronological order. | int |
| sampleid | The ID of the sample this observation was created for. Note this is equivalent to SAMPLEX.sampleid, not SAMPLEX.id | int |
| component | The component name of the monitor which took the sample this observation was made for. | string |
| monitor | The name of the monitor which took the sample this observation was made for. | string |
| observation | The name of the observation. | string |
| timestamp | The time this observation was created expressed in seconds since the epoch as a floating point number. | float |
| message | The message associated with the observation. | string |
| processed | A flag indicating whether the observation has been processed by the notification engine. | bool |
New in version 7.0.
This table represents the actions made by the notification engine. There is one row per action and the table’s primary key is an integer id. The number of rows is also controlled by the analysis_window runtime setting.
| id | Non-zero integer that uniquely identifies a row in the table. This is the primary key of the table and in general will be assigned in chronological order. | int |
| observationid | The id of the observation that gave rise to this action being taken. | int |
| sampleid | The ID of the sample that gave rise to this action being taken. Note this is equivalent to SAMPLEX.sampleid, not SAMPLEX.id | int |
| component | The component name of the monitor which took the sample that gave rise to this action being taken. | string |
| monitor | The name of the monitor which took the sample that gave rise to this action being taken. | string |
| observation | The name of the observation that gave rise to this action being taken. | string |
| action | The name of the action. | string |
| timestamp | The time this action was created expressed in seconds since the epoch as a floating point number. | float |
| type | The action type. Possible values are trap, smtp, cmd, control and notify. | string |
| success | A flag indicating whether the action was successfully executed. | bool |
New in version 7.0.
Together this and the EVENTDATA table provide information about events occurring in asagent. The EVENT table lists events over time, events that include startup, deconfig, config and shutdown. There is one row per event and the table’s primary key is an integer id.
| id | Non-zero integer that uniquely identifies a row in the table. This is the primary key of the table and in general will be assigned in chronological order. | int |
| timestamp | The time the event occurred expressed in seconds since the epoch as a floating point number. | float |
| event | Name of the event. | string |
New in version 7.0.
The EVENTDATA table is used to associate key-value pairs of additional data with a particular event listed in the EVENT table. The table has a composite key consisting of the parent event’s ID and the key of the additional data.
| eventid | The Event ID of the event this data is associated with | int |
| key | The name of the extra data associated with the event | string |
| value | The value of the extra data associated with the event | string |
The following events and their data include:
Agent startup event.
| Host : | Hostname of the server the agent is running on. |
|---|---|
| Fqdn : | Fully qualified domain name of the host. |
| Ip : | IP address of the host. |
| Config : | The location of the agent configuration. |
| Config_uts : | UNIX timestamp of the configuration’s last modification time. |
Agent shutdown event.
| Duration : | The time it took to stop all asagent subsystems at shutdown. |
|---|
Agent configuration, when a new manifest is loaded all subsystems must be configured using it and these data describe that event.
| Uri : | The URI of the manifest used. |
|---|---|
| Uts : | The UNIX timestamp of the manifest, i.e. the Manifest element’s updated attribute expressed as a floating point number representing seconds since the epoch. |
| Duration : | The time it took to configure all asagent subsystems. |
Agent de-configuration, when a new manifest is loaded all subsystems need to empty their queues and reset their configuration and this data describes that event.
| Duration : | The time it took to de-configure all asagent subsystems. |
|---|
Asagent store housekeeping, this event occurs when the agent performs cleanup and optimisation of it’s data store.
| Dbsize_before : | Size of database before housekeeping. |
|---|---|
| Dbsize_after : | Size of database after housekeeping. |
| Duration : | The time it took to perform the housekeeping. |
New in version 7.0.
This table contains runtime performance statistics for the agent. There is one row for every time stats are taken and the table’s primary key is the timestamp of when the stats were taken.
| timestamp | UNIX timestamp of when metrics were taken | float |
| uptime | Agent uptime in seconds | float |
| cpu_time | Cumulative CPU time used by asagent | float |
| cpu_pct | %CPU used by asagent since previous entry | float |
| rss | RSS memory used by asagent in bytes | int |
| vsz | VSZ memory used by asagent in bytes | int |
| async_tasks | Number of active asynchronous I/O tasks | int |
| async_queue | Size of the async I/O worker input queue | int |
| workers_queue | Size of the workers input queue | int |
| sample_queue | Size of the internal sample queue | int |
| obs_queue | Size of the internal observation queue | int |
| sample_table | Number of rows in the sample table | int |
| obs_table | Number of rows in the observation table | int |
| action_table | Number of rows in the action table | int |
| db_size | Size of the agent store in bytes | int |
