System performance query examples

You can use or edit examples of system performance AQL queries to run in your network.

Use the following query examples to get information about system performance in your network or edit these examples to build your own custom queries.

Disk Utilization and CPU usage

SELECT Hostname, "Metric ID", AVG(Value) 
AS Avg_Value, Element 
FROM events 
WHERE LOGSOURCENAME(logsourceid) 
ILIKE '%%health%%' 
AND 
"Metric ID"='SystemCPU'
OR 
"Metric ID"='DiskUtilizationDevice' 
GROUP BY Hostname, "Metric ID", Element 
ORDER BY Hostname last 20 minutes

This query outputs the Hostname, MetricID, Avg_Value, and Element columns.

The Avg_Value column returns an average value for CPU usage and disk utilization.

Disk Utilization by partition

SELECT Hostname, AVG(Value) AS Disk_Usage, Element 
FROM events 
where LOGSOURCENAME(logsourceid) 
ILIKE '%%health%%' 
and "Metric ID"='DiskUsage' 
GROUP BY Hostname, Element 
ORDER BY Hostname 
LAST 2 HOURS

This query outputs the Hostname, Disk_Usage, and Element columns

The Disk_Usage column returns a value for disk usage for the directories that are listed in the Element column.

Disk usage in gigabytes (GB) per partition

SELECT element 
AS Partiton_Name, 
MAX(value/(1024*1024*1024)) 
AS 'Gigabytes_Used' 
FROM events 
WHERE "Metric ID"='DiskSpaceUsed' 
GROUP BY element 
ORDER BY Gigabytes_Used DESC 
LAST 2 DAYS

This query outputs the Partition_Name and the Gigabytes_Used columns from the events database.

The Gigabytes_Used column returns a value for the gigabytes that are used by each partition that is listed in the Gigabytes_Used column for the last two days.

Copying query examples from the AQL guide

If you copy and paste a query example that contains single or double quotation marks from the AQL Guide, you must retype the quotation marks to be sure that the query parses.