Complex vRNI Queries
Hi everyone - this'll be a short post, as I just wanted to write some some quick notes about queries in vRealize Network Insight. VMware has a great document on some Advanced vRNI Queries; I wanted to talk about the keyword "in" and "of" and record how I've used them for some other interesting queries that aren't on their list.
"In" allows you to search in a list so that you can take advantage of nested queries. "Of" allows you to specify a property of a query (which can be useful when you want to search a list based on that property).
So, if I want to see all network flows that hit firewall rules in a particular NSX section, I could use this query:
flow where firewall rule in (nsx firewall rule where section name = "My Critical Section")
That will give me a list of all flows that have hit any firewall rules in that section. That's actually the query that I needed to solve my problem, but I solved it with "of" syntax first and want to record that version in case this syntax is useful somewhere else in the future! So, here's how I did it based on the RuleID attribute of the flow:
flow where ruleID in (ruleID of nsx firewall rule where section name = "My Critical Section")
Admittedly, not that different, but the interesting bit there is that you can specify which parameter of the firewall rule to match against, which may be a useful technique when matching against other rule parameters or even parameters on other objects, like VMs!
"In" allows you to search in a list so that you can take advantage of nested queries. "Of" allows you to specify a property of a query (which can be useful when you want to search a list based on that property).
So, if I want to see all network flows that hit firewall rules in a particular NSX section, I could use this query:
flow where firewall rule in (nsx firewall rule where section name = "My Critical Section")
That will give me a list of all flows that have hit any firewall rules in that section. That's actually the query that I needed to solve my problem, but I solved it with "of" syntax first and want to record that version in case this syntax is useful somewhere else in the future! So, here's how I did it based on the RuleID attribute of the flow:
flow where ruleID in (ruleID of nsx firewall rule where section name = "My Critical Section")
Admittedly, not that different, but the interesting bit there is that you can specify which parameter of the firewall rule to match against, which may be a useful technique when matching against other rule parameters or even parameters on other objects, like VMs!
Comments
Post a Comment
Sorry guys, I've been getting a lot of spam recently, so I've had to turn on comment moderation. I'll do my best to moderate them swiftly after they're submitted,