Table Of Contents

Previous topic

Actions

Next topic

Runtime Configuration

Table Schemas

Column names are case-insensitive but also case-preserving, the names given here is how the schema is defined. If your SELECT statement does write explicit column names, the case used in this statement will be returned. Therefore it is recommended to always explicitly use table names in queries rather than rely on the case defined in the schema.

Be aware that the id column of the SAMPLE, OBSERVATION and ACTION tables are not meant to be interpreted, they are no more than a unique string used to identify a sample. How this string is constituted is a design detail internal to asagent and can change between releases. For that reason the string content should not be relied upon.

PROCESS

Snapshot of the host process table. There is one row per process found and the pid attribute is the table’s primary key. The availability and scale of the attribute values is platform dependant.

pid Process ID int
ppid PID of the parent process int
user Process user string
uid Process user ID int
grp Process group string
gid Process group ID int
nice Process nice value int
nthreads Number of process threads int
priority Process priority int
pgrp PID of the process’ group leader int
sid PID of the process’ session leader int
startTime Time the process started string
cputime Accumulated CPU time of the process float
stime Accumulated system time of the process float
utime Accumulated user time of the process float
rss Process resident memory usage int
vsz Process virtual size int
exe The process executable name string
args The command line args. string

STATUS

This table represents the agent status over time. There is one row per status interval and the timestamp attribute is the table’s primary key.

timestamp Status timestamp string
startTime Time the agent started string
upTimeSeconds The agent uptime in seconds int
uptime The agent uptime as a friendly string string
configLocation The path to the agent’s runtime configuration string
configDts The time the agent configuration was updated string
host Name of the host the agent is running on string
ip IP address of the host the agent is running on string
cpu %cpu the agent is using float
rss Agent resident memory usage int
vsz Agent virtual memory usage int

SAMPLE

Deprecated

This table represents the sample data that agent monitors have acquired. There is one row per sample facet and the table’s primary key is a composite key made of the id and facetId columns.

id Sample ID string
facetId Sample Facet ID string
facetValue String representation of the sample facet value string
facetType Data type that the facet value string represents string

OBSERVATION

Deprecated

This table represents the observations made by the agent based on its configuration and the sample data it has encountered. There is one row per observation made and the id attribute is the table’s primary key.

id Observation ID string
timestamp Time when the observation was raised string
message Message associated with the observation string
processed Boolean to signify if an action has been made int

ACTION

Deprecated

This table represents the actions raised by the agent based on its configuration and the observation data it has encountered. There is one row per action raised and the id attribute is the table’s primary key. The table has an Observation ID as a foreign key (meaning that there can be many actions for a single observation).

id Action ID string
obsId The ID of the parent observation string
timestamp Time the action was invoked string
actionType The type of action that was invoked string

SAMPLEX

New in version 7.0.

This table represents the sample data that agent monitors have acquired. There is one row per sample facet and the table’s primary key is an integer id. The number of rows is controlled by the monitor_window runtime setting.

id Non-zero integer that uniquely identifies a row in the table. This is the primary key of the table and in general will be assigned in chronological order. int
component The component name of the monitor which took the sample containing this facet. string
monitor The name of the monitor which took the sample containing this facet. string
type The type of the monitor which took the sample containing this facet. string
sampleid The unique integer ID of the sample this facet is part of. int
subid The sample sub-id of this facet. The sample sub-ID is a string which is used to differentiate between samples from a single monitor. That is, samples with different sub-IDs will be treated by the analysis engine as if they were created my separate monitors. This is required for example when one disk monitor monitors multiple disks, suppressions for each monitored disk are treated individually. string
timestamp The time this sample was taken expressed in seconds since the epoch as a floating point number. float
facetname The facet name. string
facettype The facet value type. Possible values are bool, int, float and string. string
facetvalue A string representation of the facet value. Use the facettype to interpret this value correctly. string

OBSERVATIONX

New in version 7.0.

This table represents the observations made by the analysis engine. There is one row per observation and the table’s primary key is an integer id. The number of rows is controlled by the analysis_window runtime setting.

id Non-zero integer that uniquely identifies a row in the table. This is the primary key of the table and in general will be assigned in chronological order. int
sampleid The ID of the sample this observation was created for. Note this is equivalent to SAMPLEX.sampleid, not SAMPLEX.id int
component The component name of the monitor which took the sample this observation was made for. string
monitor The name of the monitor which took the sample this observation was made for. string
observation The name of the observation. string
timestamp The time this observation was created expressed in seconds since the epoch as a floating point number. float
message The message associated with the observation. string
processed A flag indicating whether the observation has been processed by the notification engine. bool

ACTIONX

New in version 7.0.

This table represents the actions made by the notification engine. There is one row per action and the table’s primary key is an integer id. The number of rows is also controlled by the analysis_window runtime setting.

id Non-zero integer that uniquely identifies a row in the table. This is the primary key of the table and in general will be assigned in chronological order. int
observationid The id of the observation that gave rise to this action being taken. int
sampleid The ID of the sample that gave rise to this action being taken. Note this is equivalent to SAMPLEX.sampleid, not SAMPLEX.id int
component The component name of the monitor which took the sample that gave rise to this action being taken. string
monitor The name of the monitor which took the sample that gave rise to this action being taken. string
observation The name of the observation that gave rise to this action being taken. string
action The name of the action. string
timestamp The time this action was created expressed in seconds since the epoch as a floating point number. float
type The action type. Possible values are trap, smtp, cmd, control and notify. string
success A flag indicating whether the action was successfully executed. bool

EVENT

New in version 7.0.

Together this and the EVENTDATA table provide information about events occurring in asagent. The EVENT table lists events over time, events that include startup, deconfig, config and shutdown. There is one row per event and the table’s primary key is an integer id.

id Non-zero integer that uniquely identifies a row in the table. This is the primary key of the table and in general will be assigned in chronological order. int
timestamp The time the event occurred expressed in seconds since the epoch as a floating point number. float
event Name of the event. string

EVENTDATA

New in version 7.0.

The EVENTDATA table is used to associate key-value pairs of additional data with a particular event listed in the EVENT table. The table has a composite key consisting of the parent event’s ID and the key of the additional data.

eventid The Event ID of the event this data is associated with int
key The name of the extra data associated with the event string
value The value of the extra data associated with the event string

The following events and their data include:

startup

Agent startup event.

Host :Hostname of the server the agent is running on.
Fqdn :Fully qualified domain name of the host.
Ip :IP address of the host.
Config :The location of the agent configuration.
Config_uts :UNIX timestamp of the configuration’s last modification time.
shutdown

Agent shutdown event.

Duration :The time it took to stop all asagent subsystems at shutdown.
config

Agent configuration, when a new manifest is loaded all subsystems must be configured using it and these data describe that event.

Uri :The URI of the manifest used.
Uts :The UNIX timestamp of the manifest, i.e. the Manifest element’s updated attribute expressed as a floating point number representing seconds since the epoch.
Duration :The time it took to configure all asagent subsystems.
deconfig

Agent de-configuration, when a new manifest is loaded all subsystems need to empty their queues and reset their configuration and this data describes that event.

Duration :The time it took to de-configure all asagent subsystems.
housekeeping

Asagent store housekeeping, this event occurs when the agent performs cleanup and optimisation of it’s data store.

Dbsize_before :Size of database before housekeeping.
Dbsize_after :Size of database after housekeeping.
Duration :The time it took to perform the housekeeping.

PERFSTATUS

New in version 7.0.

This table contains runtime performance statistics for the agent. There is one row for every time stats are taken and the table’s primary key is the timestamp of when the stats were taken.

timestamp UNIX timestamp of when metrics were taken float
uptime Agent uptime in seconds float
cpu_time Cumulative CPU time used by asagent float
cpu_pct %CPU used by asagent since previous entry float
rss RSS memory used by asagent in bytes int
vsz VSZ memory used by asagent in bytes int
async_tasks Number of active asynchronous I/O tasks int
async_queue Size of the async I/O worker input queue int
workers_queue Size of the workers input queue int
sample_queue Size of the internal sample queue int
obs_queue Size of the internal observation queue int
sample_table Number of rows in the sample table int
obs_table Number of rows in the observation table int
action_table Number of rows in the action table int
db_size Size of the agent store in bytes int