One thing that I absolutely love about vRealize Network Insight (vRNI) is that the entire database is open by default and that the search bar is powered by Elastic Search. That means that you can type in pretty advanced search queries and basically query everything that vRNI collects. The query itself is written in natural language, so you don’t have to be an expert to use it. You can get really creative as well, getting output you would have a hard time seeing without using the search. To give you some examples, below you can find my cheatsheet with searches I use on a regular basis.
- Keywords & Operators
Inside the natural language on the search bar, there’s an auto completion feature which lists (almost) all available keywords and content which you can use. There are a couple of keywords and operators which are good to know, which are listed below.
|Keyword / Operator||Description|
|where||Create a limitation|
|Keyword =||Where the keyword equals to|
|Keyword >||Where the keyword is greater then (metrics)|
|Keyword <||Where the keyword is smaller then (metrics)|
|Keyword >=||Where the keyword is greater or equal then (metrics)|
|Keyword <=||Where the keyword is smaller or equal then (metrics)|
|and||Add multiple strict limitations (VM where Tag = ‘Web’ AND = ‘App’)|
|or||Search for different limitations (VM where Name = ‘Web’ OR VM Name = ‘App’)|
|of||Look for something related to something else (Datastores of VM ‘Web’)|
|max()||Look for the maximum value (max(Memory Consumed) of VM)|
|sum()||Show the sum of values (sum(Memory Consumed) of VMware VM where Host = ‘esxi01.lab’)|
Get a list of VMs with a certain OS:
vm where Operating System = 'Microsoft Windows Server 2012 (64-bit)'
Look for VMs with a CPU ready rate higher than 1%
vm where CPU Ready Rate > 1%
List of VMs with a higher write latency of 5ms
vm where Write Latency > 5ms
List all VMs which have equal of greater then 2 snapshots
vm where Num Snapshots >= 2
Get an overview of all VMs and their: attached network, VLAN ID, IP address(es), default gateway & mac address(es)
L2 Network, vlan, ip address, default gateway, mac address of vms
List all VMs in a certain VLAN ID (Replace vlan with vxlan when using NSX).
vm where vlan = 20
List all VMs in a vSphere Distributed Portgroup
vm where Dvpg = 'Servers_VLAN20'
Find a VM based on a MAC address
Show the different ESXi versions in the environment and how many hosts have that version
host group by OS
Quick graphical overview of the host performance
cpu, memory, disk of hosts
List each host and the amount of VMs they have
vm group by host
Get the hosts who do most network traffic
network rate of host order by Max Network Rate
Get the maximum utilised host
max(CPU Usage Rate), max(memory utilization) of Host
Show all traffic that’s going to physical devices inside the datacenter
flows where Flow Type = 'VM-Physical' by bytes
Show the same thing as above, but show total amount in bytes:
sum(total bytes) of flow where Flow Type = 'VM-Physical'
Show all traffic going from internal to the internet
flows where Flow Type = 'Src is VM' and Flow Type = 'Dst is Internet' by bytes
Show total traffic (in bytes) amount that the VMs pulled down from the internet
sum(bytes) of flows where Flow Type = 'Src is Internet' and Flow type = 'Dst is VM'
In a dual datacenter setup, where you have two vCenters – show how much traffic is running between the two datacenters
sum(bytes) of flows where Dst Manager = 'vcenter-dc01.corp.local' and Source Manager = 'vcenter-dc02.corp.local'
Show the total amount of VXLAN traffic:
sum(bytes) of flows where Flow Type = 'Src is VTEP' or flow type = 'Dst is VTEP'
Show the amount of VXLAN traffic grouped per VTEP IP address (vmkernel port on the ESXi hosts)
sum(bytes) of flows where Flow Type = 'Src is VTEP' or flow type = 'Dst is VTEP' group by src ip
Show traffic totals grouped by IP address (top talkers)
sum(bytes) of flows group by src ip
Show traffic totals grouped by Port number (top talkers)
sum(bytes) of flows group by dst port
Show all traffic flows from application container Oracle to application container Webfrontend
flows where Source Application = 'Oracle' and Destination Application = 'Webfrontend'
Show all internet traffic flows to a specific country
flows where Destination Country = 'United States'
Show routes of a specific NSX Edge (both ESG & DLR)
routes where vrf = 'TL-ESG-01'
Show a list of all networks (port groups) and count how many VMs are attached
vm group by l2 network
List all VMs impacted by a specific firewall rule
vm where Firewall Rule = 'Allow HTTP from internet'
List all VMs with a specific NSX Security Tag
vm where Security Tag = 'ST-Allow-PING'
Show firewalls rules where all service ports are allowed
firewall rule where Action = 'ALLOW' and Service Any = true
List NSX controllers and which VXLANs they are responsible for
controller of Vxlan group by controller
Show all routes which have a specified next hop
route where NextHop Router = '3TA-Edge01'
Generate a report for all flows except for NFS traffic
plan flows where port.ianaPortDisplay != '2049 [nfs]'
Show report for all flows to a web tier and on port 80
plan flows where port.ianaPortDisplay = '80 [http]' and L2 Network = '3TA-Web'
Show report for all flows happening inside a specific AWS VPC
plan flows where AWS VPC = 'MyVPC'
Show all datastores with a higher write latency then 5ms
datastore where Write Latency > 5ms
List all datastores and their VM count
vm group by datastore
List all datastores with a higher usage percentage of 80%
datastore where Used Space Percent > 80%
List all datastores on a specific NAS
datastore where NAS Server Name = '10.9.0.10'
That’s it for now. Let me know if you have any other interesting searches I can add!