Cisco Cisco Firepower Management Center 4000 Entwickleranleitung
3-9
FireSIGHT System Database Access Guide
Chapter 3 Schema: System-Level Tables
health_event
health_event Joins
You cannot perform joins on the
health_event
table.
health_event Sample Query
The following query returns up to the 25 most recent health events logged within the defined time frame.
SELECT module_name, FROM_UNIXTIME(event_time_sec)
AS event_time, description, value, units, status, sensor_name
FROM health_event
WHERE event_time_sec
BETWEEN UNIX_TIMESTAMP("2011-10-01 00:00:00")
AND UNIX_TIMESTAMP("2011-10-07 23:59:59")
ORDER BY event_time DESC
LIMIT 0, 25;
sensor_name
The text name of the managed device that generated the event record. This field is
null
when
the health event refers to the reporting device itself, rather than to a connected one.
sensor_uuid
A unique identifier for the managed device, or zero if
sensor_name
is
null
.
status
The health monitor status that has been reported for the appliance identified in
sensor_uuid
.
Values are:
•
red
- Critical status. Limits have been exceeded for at least one health module on the
appliance and the problem has not been corrected.
•
yellow
- Warning status. Limits have been exceeded for at least one health module on the
appliance and the problem has not been corrected.
•
green
- Normal status. All health modules on the appliance are running within the limits
configured in the health policy applied to the appliance.
•
recovered
- All health modules on the appliance are running within the limits configured in
the health policy applied to the appliance, including modules that were in a Critical or
Warning state.
Warning state.
•
disabled
- Either the appliance is disabled or blacklisted, or is currently unreachable, or has
no health policy applied to it.
•
error
- At least one health monitoring module has failed on the appliance and has not been
successfully re-run since the failure occurred
units
The unit of measure for results obtained by the health test. For example,
%
(of Disk Usage).
value
The number of units of the result obtained by the health test. For example, the
value
of 80% is
80
.
Table 3-5
health_event Fields (continued)
Field
Description