Index


Overview

Within Statseeker, Auto-Grouping, Custom Reporting, Event Management as well as Threshold and Alert configuration all allow you to apply various filters to target the elements of your network that you want the rule or configuration to apply to. These filters may be group filters, device or interface filters, attribute filters, or a combination of any of these.

Note: creation and use of time filters is covered in Time Filters.

[top]

Group, Device, and Interface Filters

Group, Device, and Interface filters are very quick and simple to implement.

Group filters will be:

  • Is a member of at least one of the specified groups
  • Must be a member of all of the specified groups
  • A combination of the previous two configurations

Device and Interface filters are going to be “is one of the specified devices/interfaces”.

[top]

Attribute Filters

Attribute filters refer to the OID’s or Statseeker configuration fields available for each entity (each device, interface, or configuration object) so which attributes are available varies from entity to entity.

Timeseries Attributes
Note: timeseries attributes cannot be used for auto-grouping rule configurations.

Some Attributes will be pointing to timeseries data such as byte counts, load percentages, temperatures etc.
Filters against these Attributes will typically be along the lines of
{Entity} {Attribute} {format} {operator} {value}.

For example:

Entity Attribute Format Operator Value
Device ping return trip value is greater than 250ms
Interface outbound utilization average for the last 5mins is greater than 85%
Memory used percent average for last 10mins is greater than 90%
File System used percent forecast value for 3 months from now is greater than 85%

[top]

Configuration, State and Status Attributes

Other Attributes will be referring to configuration information (names, descriptions, location information, software/firmware versions, etc.) and state or status information. Filters against these attributes will typically be simple string matching, but for some configuration attributes, and all of the state and status attributes, you need to know what the values could be in order to be able to filter against them.

We have included an abridged version of this information below, presenting only those fields that require specific values. Information on all fields for an object can be found in the API documentation, see API Resource Level Endpoint Reference.


Entity Attribute Values
All poll-able entities poll
  • on
  • off
Alteon Real Servers State
  • disabled
  • failed
  • running
Status
  • cookiepersistent
  • cookiepersistentfastage
  • disable
  • enable
  • fastage
APIC SNMPv3 Authentication Method
  • md5
  • sha
MAC/IP/Switch Collection State
  • on
  • off
Ping Poll
  • on
  • off
Ping State
  • up
  • down
Retired
  • on
  • off
SNMP Poll
  • on
  • off
SNMP Version
  • 1
  • 2
  • 3
SNMPv3 Privacy Method
  • aes
  • aes192
  • aes256
  • des
  • des3
Use GetNext
  • 0
  • 1
Use Minimal Walk
  • 0
  • 1
Use SNMPv1
  • 0
  • 1
BPG Peer (Generic, Cisco Juniper) Admin Status
  • Start
  • Stop
State
  • active
  • connect
  • established
  • idle
  • opensent
  • openconfirm
Cisco APPNAV Controller Member State
  • alive
  • dead
  • excluded
  • inactive
  • na
  • partial
  • zombie
Node Member State
  • alive
  • dead
  • excluded
  • inactive
  • na
  • partial
  • zombie
Cisco Class-Based QoS Class Map Configuration Match Type
  • None
  • Match All
  • Match Any
Cisco Class-Based QoS Queue Map Configuration Flow Enabled
  • true
  • false
Priority Enabled
  • true
  • false
Cisco TCAM Entries TCAM Protocol
  • ipv4
  • mpls
  • eom
  • ipv6
  • ipv4Multicast
  • ipv6Multicast
  • l2VpnPeer
  • l2VpnIpv4Multicast
  • fcoe
  • mplsVpn
  • fcMpls
  • ipv6LocalLink
  • allProtocols
Cisco VPN Tunnels Status
  • initializePhase1
  • awaitXauth
  • awaitCommit
  • active
  • destroy
  • rekey
Tunnel Type
  • ipAddrPeer
  • namePeer
Cisco Firewall Connections Type
  • Other
  • Total Open
  • Current Open
  • Current Closing
  • Current Half-Open
  • Current In Use
  • High
  • Unknown Type
Cisco IPSLA Admin Protocol
  • apolloEcho
  • apolloEchoAppl
  • appleTalkEcho
  • appleTalkEchoAppl
  • decNetEcho
  • decNetEchoAppl
  • dhcpAppl
  • dlswAppl
  • dnsAppl
  • ethernetJitterAppl
  • ethernetPingAppl
  • ftpAppl
  • httpsAppl
  • icmpJitterAppl
  • ipIcmpEcho
  • ipTcpConn
  • ipUdpEchoAppl
  • ipxEcho
  • ipxEchoAppl
  • isoClnsEcho
  • isoClnsEchoAppl
  • jitterAppl
  • mcastJitterAppl
  • mplsLspPingAppl
  • netbiosEchoAppl
  • notApplicable
  • rtpAppl
  • snaLU0EchoAppl
  • snaLU2EchoAppl
  • snaLU62Echo
  • snaLU62EchoAppl
  • snaRUEcho
  • videoAppl
  • vinesEcho
  • vinesEchoAppl
  • voipAppl
  • xnsEcho
  • xnsEchoAppl
  • y17311dm
  • y1731dmm
  • y1731lmm
  • y1731slm
Admin Rtt Type
  • dhcp
  • dlsw
  • dns
  • echo
  • ethernetJitter
  • ethernetPing
  • fileIO
  • ftp
  • https
  • icmpjitter
  • jitter
  • lspGroup
  • lspPing
  • lspPingPseudowire
  • lspTrace
  • mcastJitter
  • pathEcho
  • rtp
  • script
  • tcpConnect
  • udpEcho
  • video
  • voip
  • y1731Delay
  • y1731Loss
Admin Status
  • active
  • createAndGo
  • createAndWait
  • destroy
  • notInService
  • notReady
Completion Status
  • applicationSpecific
  • busy
  • disconnected
  • dnsQueryErrorr
  • dnsServerTimeout
  • dropped
  • enableAbort
  • enableAuthFail
  • enableFail
  • enableFormatError
  • enableInternalError
  • enableNoConnect
  • enableOk
  • enablePortInUse
  • enableVersionFail
  • error
  • httpError
  • httpTransactionTimeout
  • mplsLspEchoTxError
  • mplsLspMalformedReq
  • mplsLspReachButNotFEC
  • mplsLspUnreachable
  • notConnected
  • ok
  • other
  • overThreshold
  • sequenceError
  • statsRetrieveAbort
  • statsRetrieveAuthFail
  • statsRetrieveFail
  • statsRetrieveFormatError
  • statsRetrieveInternalError
  • statsRetrieveNoConnect
  • statsRetrieveOk
  • statsRetrievePortInUse
  • statsRetrieveVersionFail
  • tcpConnectTimeout
  • timeout
  • verifyError
Cisco WAAS Load Status
  • 1 – unknown, feature is not active or disabled
  • 2 – green, feature is operating normally, within acceptable load limits
  • 3 – yellow, feature is overloaded, and new connections received by it may not get optimized
  • 4 – red, feature is not healthy, and existing as well as new connections received by it may not get optimized
Custom Data Type Ranges autoremove
  • on
  • off
  • default
enable
  • 0
  • 1
Devices SNMPv3 Authentication Method
  • md5
  • sha
Use GetNext
  • 0
  • 1
Use Minimal Walk
  • 0
  • 1
Use SNMPv1
  • 0
  • 1
MAC/IP/Switch Collection State
  • on
  • off
Ping Poll
  • on
  • off
Ping State
  • up
  • down
SNMPv3 Privacy Method
  • aes
  • aes192
  • aes256
  • des
  • des3
Retired
  • on
  • off
SNMP Poll
  • on
  • off
SNMP Version
  • 1
  • 2
  • 3
Discover Hosts enable
  • 0
  • 1
Environment Monitors – Interseptor Status
  • unknown
  • disabled
  • eMD-HT
  • eMD-T
Environment Monitors – APC Status
  • connected
  • disconnected
File System Storage Type
  • HOST-RESOURCES-TYPES.hrFSAFS
  • HOST-RESOURCES-TYPES.hrFSAppleshare
  • HOST-RESOURCES-TYPES.hrFSBerkeleyFFS
  • HOST-RESOURCES-TYPES.hrFSBFS
  • HOST-RESOURCES-TYPES.hrFSDFS
  • HOST-RESOURCES-TYPES.hrFSDGCFS
  • HOST-RESOURCES-TYPES.hrFSFat
  • HOST-RESOURCES-TYPES.hrFSFAT32
  • HOST-RESOURCES-TYPES.hrFSHFS
  • HOST-RESOURCES-TYPES.hrFSHPFS
  • HOST-RESOURCES-TYPES.hrFSiso9660
  • HOST-RESOURCES-TYPES.hrFSJournaled
  • HOST-RESOURCES-TYPES.hrFSLinuxExt2
  • HOST-RESOURCES-TYPES.hrFSMFS
  • HOST-RESOURCES-TYPES.hrFSNetware
  • HOST-RESOURCES-TYPES.hrFSNFS
  • HOST-RESOURCES-TYPES.hrFSNTFS
  • HOST-RESOURCES-TYPES.hrFSOther
  • HOST-RESOURCES-TYPES.hrFSRFS
  • HOST-RESOURCES-TYPES.hrFSRockRidge
  • HOST-RESOURCES-TYPES.hrFSSys5FS
  • HOST-RESOURCES-TYPES.hrFSUnknown
  • HOST-RESOURCES-TYPES.hrFSVNode
  • HOST-RESOURCES-TYPES.hrStorageCompactDisc
  • HOST-RESOURCES-TYPES.hrStorageFixedDisk
  • HOST-RESOURCES-TYPES.hrStorageFlashMemory
  • HOST-RESOURCES-TYPES.hrStorageFloppyDisk
  • HOST-RESOURCES-TYPES.hrStorageNetworkDisk
  • HOST-RESOURCES-TYPES.hrStorageOther
  • HOST-RESOURCES-TYPES.hrStorageRam
  • HOST-RESOURCES-TYPES.hrStorageRamDisk
  • HOST-RESOURCES-TYPES.hrStorageRemovableDisk
  • HOST-RESOURCES-TYPES.hrStorageVirtualMemory
Frame Relay (Generic, Cisco, Juniper, Nortel) ifPoll
  • on
  • off
State
  • active
  • inactive
  • invalid
IP System Stats IPv4 Forwarding
  • forwarding
  • notforwarding
IPv6 Forwarding
  • forwarding
  • notforwarding
IP Version
  • ipv4
  • ipv6
Interface if90day
  • 0
  • 1
ifAdminStatus
  • up
  • down
  • testing
ifDuplex
  • auto
  • half
  • full
  • unknown
NUcast Polling
  • on
  • off
  • global
ifPoll
  • on
  • off
ifOperStatus
  • dormant
  • down
  • lowerLayerDown
  • notPresent
  • testing
  • unknown
  • up
Type
  • a12MppSwitch
  • aal2
  • aal5
  • actelisMetaLOOP
  • adsl
  • adsl2
  • adsl2plus
  • aflane8023
  • aflane8025
  • arap
  • arcnet
  • arcnetPlus
  • async
  • atm
  • atmbond
  • atmDxi
  • atmFuni
  • atmIma
  • atmLogical
  • atmRadio
  • atmSubInterface
  • atmVciEndPt
  • atmVirtual
  • aviciOpticalEther
  • basicISDN
  • bgppolicyaccounting
  • bridge
  • bsc
  • cblVectaStar
  • cctEmul
  • ces
  • channel
  • ciscoISLvlan
  • cnr
  • coffee
  • compositeLink
  • dcn
  • ddnX25
  • digitalPowerline
  • digitalWrapperOverheadChannel
  • dlsw
  • docsCableDownstream
  • docsCableMaclayer
  • docsCableMCmtsDownstream
  • docsCableUpstream
  • docsCableUpstreamChannel
  • ds0
  • ds0Bundle
  • ds1
  • ds1FDL
  • ds3
  • dtm
  • dvbAsiIn
  • dvbAsiOut
  • dvbRccDownstream
  • dvbRccMacLayer
  • dvbRccUpstream
  • e1
  • econet
  • eon
  • eplrs
  • escon
  • ethernet3Mbit
  • ethernetCsmacd
  • fast
  • fastEther
  • fastEtherFX
  • fcipLink
  • fddi
  • fibreChannel
  • frameRelay
  • frameRelayInterconnect
  • frameRelayMPI
  • frameRelayService
  • frDlciEndPt
  • frf16MfrBundle
  • frForward
  • g703at2mb
  • g703at64k
  • gfp
  • gigabitEthernet
  • gr303IDT
  • gr303RDT
  • gtp
  • h323Gatekeeper
  • h323Proxy
  • hdh1822
  • hdlc
  • hdsl2
  • hiperlan2
  • hippi
  • hippiInterface
  • homepna
  • hostPad
  • hssi
  • hyperchannel
  • ibm370parChan
  • idsl
  • ieee1394
  • ieee80211
  • ieee80212
  • ieee80216WMAN
  • ieee8023adLag
  • if-gsn
  • imt
  • infiniband
  • interleave
  • ip
  • ipForward
  • ipOverAtm
  • ipOverCdlc
  • ipOverClaw
  • ipSwitch
  • isdn
  • isdns
  • isdnu
  • iso88022llc
  • iso88023Csmacd
  • iso88024TokenBus
  • iso88025CRFPInt
  • iso88025Dtr
  • iso88025Fiber
  • iso88025TokenRing
  • iso88026Man
  • isup
  • l2vlan
  • l3ipvlan
  • l3ipxvlan
  • lapb
  • lapd
  • lapf
  • linegroup
  • lmp
  • localTalk
  • macSecControlledIF
  • macSecUncontrolledIF
  • mediaMailOverIp
  • mfSigLink
  • miox25
  • mocaVersion1
  • modem
  • mpc
  • mpegTransport
  • mpls
  • mplsTunnel
  • msdsl
  • mvl
  • myrinet
  • nfas
  • nsip
  • opticalChannel
  • opticalChannelGroup
  • opticalTransport
  • other
  • para
  • pdnEtherLoop1
  • pdnEtherLoop2
  • plc
  • pon155
  • pon622
  • pos
  • ppp
  • pppMultilinkBundle
  • primaryISDN
  • propAtm
  • propBWAp2Mp
  • propCnls
  • propDocsWirelessDownstream
  • propDocsWirelessMaclayer
  • propDocsWirelessUpstream
  • propMultiplexor
  • propPointToPointSerial
  • propVirtual
  • propWirelessP2P
  • proteon10Mbit
  • proteon80Mbit
  • q2931
  • qam
  • qllc
  • radioMAC
  • radsl
  • reachDSL
  • regular1822
  • rfc1483
  • rfc877x25
  • rpr
  • rs232
  • rsrb
  • sdlc
  • sdsl
  • shdsl
  • sip
  • sipSig
  • sipTg
  • sixToFour
  • slip
  • smdsDxi
  • smdsIcip
  • softwareLoopback
  • sonet
  • sonetOverheadChannel
  • sonetPath
  • sonetVT
  • srp
  • ss7SigLink
  • stackToStack
  • starLan
  • tdlc
  • teLink
  • termPad
  • tr008
  • trasnpHdlc
  • tunnel
  • ultra
  • usb
  • v11
  • v35
  • v36
  • v37
  • vdsl
  • virtualIpAddress
  • virtualTg
  • voiceDID
  • voiceEM
  • voiceEMFGD
  • voiceEncap
  • voiceFGDEANA
  • voiceFGDOS
  • voiceFXO
  • voiceFXS
  • voiceOverAtm
  • voiceOverCable
  • voiceOverFrameRelay
  • voiceOverIp
  • x213
  • x25huntGroup
  • x25mlp
  • x25ple
Interface – NBAR Protocol Discovery Enable
  • true
  • false
Memory Memory Type The generic memory object will also inherit any type value contained within any vendor-specific memory (Alcatel, Aruba, Avaya Cisco, etc.), these values are simply the vendor name.

  • HOST-RESOURCES-TYPES.hrStorageCompactDisc
  • HOST-RESOURCES-TYPES.hrStorageFixedDisk
  • HOST-RESOURCES-TYPES.hrStorageFlashMemory
  • HOST-RESOURCES-TYPES.hrStorageFloppyDisk
  • HOST-RESOURCES-TYPES.hrStorageNetworkDisk
  • HOST-RESOURCES-TYPES.hrStorageOther
  • HOST-RESOURCES-TYPES.hrStorageRam
  • HOST-RESOURCES-TYPES.hrStorageRamDisk
  • HOST-RESOURCES-TYPES.hrStorageRemovableDisk
  • HOST-RESOURCES-TYPES.hrStorageVirtualMemory
Notification Type
  • error
  • warning
  • info
State
  • seen
  • unseen
Optical Signal Monitoring – ADVA Admin State
  • dsbld
  • is
  • mgt
portOperState
  • anr
  • nr
  • out
  • un
  • undefined
Optical Signal Monitoring – NBS Status
  • absent
  • present
PoE Interface adminEnable
  • true
  • false
detectionStatus
  • disabled
  • searching
  • deliveringPower
  • fault
  • test
  • otherFault
PoE Interface – Cisco adminEnable
  • true
  • false
detectionStatus
  • disabled
  • searching
  • deliveringPower
  • fault
  • test
  • otherFault
portEnable
  • auto
  • static
  • limit
  • disable
Riverbed WAN Accelerator Health
  • Admission
  • Control
  • Critical
  • Degraded
  • Healthy
Temperature – Cisco State
  • critical
  • normal
  • notFunctioning
  • notPresent
  • shutdown
  • warning
Threshold Condition
  • Above
  • Below
Trigger
  • breach
  • transition
Format
  • Average
  • Total
  • Maximum
  • Median
  • Minimum
  • Standard Deviation
  • Total
  • 95th Percentile
  • Trendline Prediction
  • Trendline Daily Change
  • Trendline Strength
  • Anomaly Metric
  • Anomaly Strength
  • Forecast Value
  • Forecast Upper Value
  • Forecast Lower Value
  • Forecast Daily Change
Group by Format
  • Average
  • Maximum
  • Median
  • Minimum
  • Standard Deviation
  • Total
  • 95th Percentile
  • Disabled
Threshold Event thresholdAbove
  • 0
  • 1
Timefilter locked
  • 0
  • 1
Ubiquiti Radio Operating Mode
  • ap
  • aprepeater
  • apwds
  • sta
User api
  • r
  • rw
auth
  • File
  • LDAP
  • RADIUS
  • SAML
is_admin
  • 0
  • 1
UPS – APC Battery Replace Indicator
  • batteryNeedsReplacing
  • noBatteryNeedsReplacing
UPS – Generic Battery Replace Indicator
  • batteryDepleted
  • batteryLow
  • batteryNormal
  • unknown
Output Source
  • battery
  • booster
  • bypass
  • none
  • normal
  • other
  • reducer

[top]