What Just Happened Events

Warning

When the option "!" is used, then the argument it is used with is excluded.

WJH Event Statistics

Description	Get statistical information on the WJH event.
Request URL	/neo/app/wjh_events/statistics
Arguments	'deviceName'/'!deviceName': get WJH event filtered by device name 'deviceIP'/'!deviceIP': get WJH event filtered by device IP 'category'/'!category': get WJH event filtered by category 'subcategory'/'!subcategory': get WJH event filtered by subcategory 'reason_description'/'!reason_description': get WJH event filtered by reason description 'reason_severity'/'!reason_severity': get WJH event filtered by reason severity 'inPort'/'!inPort': get WJH event filtered by port 'aclName'/'!aclName': get WJH event filtered by ACL name 'aclRule'/'!aclRule': get WJH event filtered by ACL rule 'downReason'/'!downReason': get WJH event filtered by reason 'packet_ethernet_srcMac'/'!packet_ethernet_srcMac': get WJH event filtered by source MAC 'packet_ethernet_dstMac'/'!packet_ethernet_dstMac': get WJH event filtered by destination MAC 'packet_ethernet_vlanId'/'!packet_ethernet_vlanId': get WJH event filtered by VLAN ID 'packet_ethernet_etherTypeName'/'!packet_ethernet_etherTypeName': get WJH event filtered by ethertype 'packet_ip_srcIp'/'!packet_ip_srcIp': get WJH event filtered by source IP 'packet_ip_dstIp'/'!packet_ip_dstIp': get WJH event filtered by destination IP 'packet_ip_protocolName'/'!packet_ip_protocolName': get WJH event filtered by IP protocol 'packet_transport_srcPortName'/'!packet_transport_srcPortName': get WJH event filtered by transport layer source name 'packet_transport_dstPortName'/'!packet_transport_dstPortName': get WJH event filtered by transport layer destination name 'packet_vxlan_innerSrcMac'/'!packet_vxlan_innerSrcMac': get WJH event filtered by VXLAN source MAC address 'packet_vxlan_innerDstMac'/'!packet_vxlan_innerDstMac': get WJH event filtered by VXLAN destination MAC address 'packet_vxlan_innerSrcIp'/'!packet_vxlan_innerSrcIp': get WJH event filtered by VXLAN source IP address 'packet_vxlan_innerDstIp'/'!packet_vxlan_innerDstIp': get WJH event filtered by VXLAN destination IP address 'packet_vxlan_vni'/'!packet_vxlan_vni': get WJH event filtered by VXLAN VNI 'packet_vxlan_innerProtocolName'/'!packet_vxlan_innerProtocolName': get WJH event filtered by VXLAN protocol 'packet_vxlan_innerSrcPortName'/'!packet_vxlan_innerSrcPortName': get WJH event filtered by VXLAN source port 'packet_vxlan_innerDstPortName'/'!packet_vxlan_innerDstPortName': get WJH event filtered by VXLAN destination port 'from': get WJH event that occurred after a given timestamp 'until': get WJH event that occurred before a given timestamp

Query example:

Copy
Copied!

            
            https://<ip-address>/neo/app/wjh_events/statistics?reason_severity=Warning,Notice,Error&from=-12h&until=1595160184&tz=Asia/Jerusalem&_=1595160184441

Response:

Copy
Copied!

            
            {
  categories: [
    {
      category: "Forwarding",
      total: 2901,
      reasons: [
        {
          reason: "Source MAC equals destination MAC",
          total: 2901
        }
      ]
    }
  ]
}

WJH Events

Description	Get a list of WJH event filtered by reason or category.
Request URL	/neo/app/wjh_events
Arguments	'deviceName'/'!deviceName': get WJH event filtered by device name 'deviceIP'/'!deviceIP': get WJH event filtered by device IP 'category'/'!category': get WJH event filtered by category 'subcategory'/'!subcategory': get WJH event filtered by subcategory 'reason_description'/'!reason_description': get WJH event filtered by reason description 'reason_severity'/'!reason_severity': get WJH event filtered by reason severity 'inPort'/'!inPort': get WJH event filtered by port 'aclName'/'!aclName': get WJH event filtered by ACL name 'aclRule'/'!aclRule': get WJH event filtered by ACL rule 'downReason'/'!downReason': get WJH event filtered by reason 'packet_ethernet_srcMac'/'!packet_ethernet_srcMac': get WJH event filtered by source MAC 'packet_ethernet_dstMac'/'!packet_ethernet_dstMac': get WJH event filtered by destination MAC 'packet_ethernet_vlanId'/'!packet_ethernet_vlanId': get WJH event filtered by VLAN ID 'packet_ethernet_etherTypeName'/'!packet_ethernet_etherTypeName': get WJH event filtered by ethertype 'packet_ip_srcIp'/'!packet_ip_srcIp': get WJH event filtered by source IP 'packet_ip_dstIp'/'!packet_ip_dstIp': get WJH event filtered by destination IP 'packet_ip_protocolName'/'!packet_ip_protocolName': get WJH event filtered by IP protocol 'packet_transport_srcPortName'/'!packet_transport_srcPortName': get WJH event filtered by transport layer source name 'packet_transport_dstPortName'/'!packet_transport_dstPortName': get WJH event filtered by transport layer destination name 'packet_vxlan_innerSrcMac'/'!packet_vxlan_innerSrcMac': get WJH event filtered by VXLAN source MAC address 'packet_vxlan_innerDstMac'/'!packet_vxlan_innerDstMac': get WJH event filtered by VXLAN destination MAC address 'packet_vxlan_innerSrcIp'/'!packet_vxlan_innerSrcIp': get WJH event filtered by VXLAN source IP address 'packet_vxlan_innerDstIp'/'!packet_vxlan_innerDstIp': get WJH event filtered by VXLAN destination IP address 'packet_vxlan_vni'/'!packet_vxlan_vni': get WJH event filtered by VXLAN VNI 'packet_vxlan_innerProtocolName'/'!packet_vxlan_innerProtocolName': get WJH event filtered by VXLAN protocol 'packet_vxlan_innerSrcPortName'/'!packet_vxlan_innerSrcPortName': get WJH event filtered by VXLAN source port 'packet_vxlan_innerDstPortName'/'!packet_vxlan_innerDstPortName': get WJH event filtered by VXLAN destination port 'from': get WJH event that occurred after a given timestamp 'until': get WJH event that occurred before a given timestamp 'limit': limit response to a specific number of WJH events 'offset': begins counting events after specified number of WJH events

Query example:

Copy
Copied!

            
            https://<ip-address>/neo/app/wjh_events?reason_severity=Warning,Notice,Error&from=-12h&until=1595160184&tz=Asia/Jerusalem&_=1595160184441&limit=1

Response:

Copy
Copied!

            
            {
  items: [
    {
      category: "Forwarding",
      subcategory: "L2",
      deviceIP: "10.10.10.10",
      deviceName: "ufm-sw10",
      inPort: "Eth1/9",
      reason_description: "Source MAC equals destination MAC",
      reason_eventType: null,
      reason_severity: "Error",
      reason_recommendedAction: "Bad packet was received from peer",
      timestamp: "2020-07-19 15:02:01.468267",
      packetType: "IP",
      rawPacket: null,
      ethernet: {
        packet_ethernet_etherTypeName: "Internet Protocol version 4 (IPv4) (0x0800)",
        packet_ethernet_srcMac: "00:10:10:10:10:10",
        packet_ethernet_dstMac: "00:10:10:10:10:11",
        packet_ethernet_vlanId: null,
        packet_ethernet_pcp: null
      },
      ip: {
        packet_ip_srcIp: "99.255.255.0",
        packet_ip_dstIp: "99.254.254.0",
        packet_ip_protocolName: "IGMP (0x02)",
        packet_ip_tos: null,
        packet_ip_ttl: 64,
        packet_ip_version: 4,
        packet_ip_length: 12288
      }
    },
    total: 2901
  }

WJH Event Timeline

Description	Get all WJH event group by reason or category or severity.
Request URL	/neo/app/wjh_events/timeline
Arguments	'deviceName'/'!deviceName': get WJH event filtered by device name 'deviceIP'/'!deviceIP': get WJH event filtered by device IP 'category'/'!category': get WJH event filtered by category 'subcategory'/'!subcategory': get WJH event filtered by subcategory 'reason_description'/'!reason_description': get WJH event filtered by reason description 'reason_severity'/'!reason_severity': get WJH event filtered by reason severity 'inPort'/'!inPort': get WJH event filtered by port 'aclName'/'!aclName': get WJH event filtered by ACL name 'aclRule'/'!aclRule': get WJH event filtered by ACL rule 'downReason'/'!downReason': get WJH event filtered by reason 'packet_ethernet_srcMac'/'!packet_ethernet_srcMac': get WJH event filtered by source MAC 'packet_ethernet_dstMac'/'!packet_ethernet_dstMac': get WJH event filtered by destination MAC 'packet_ethernet_vlanId'/'!packet_ethernet_vlanId': get WJH event filtered by VLAN ID 'packet_ethernet_etherTypeName'/'!packet_ethernet_etherTypeName': get WJH event filtered by ethertype 'packet_ip_srcIp'/'!packet_ip_srcIp': get WJH event filtered by source IP 'packet_ip_dstIp'/'!packet_ip_dstIp': get WJH event filtered by destination IP 'packet_ip_protocolName'/'!packet_ip_protocolName': get WJH event filtered by IP protocol 'packet_transport_srcPortName'/'!packet_transport_srcPortName': get WJH event filtered by transport layer source name 'packet_transport_dstPortName'/'!packet_transport_dstPortName': get WJH event filtered by transport layer destination name 'packet_vxlan_innerSrcMac'/'!packet_vxlan_innerSrcMac': get WJH event filtered by VXLAN source MAC address 'packet_vxlan_innerDstMac'/'!packet_vxlan_innerDstMac': get WJH event filtered by VXLAN destination MAC address 'packet_vxlan_innerSrcIp'/'!packet_vxlan_innerSrcIp': get WJH event filtered by VXLAN source IP address 'packet_vxlan_innerDstIp'/'!packet_vxlan_innerDstIp': get WJH event filtered by VXLAN destination IP address 'packet_vxlan_vni'/'!packet_vxlan_vni': get WJH event filtered by VXLAN VNI 'packet_vxlan_innerProtocolName'/'!packet_vxlan_innerProtocolName': get WJH event filtered by VXLAN protocol 'packet_vxlan_innerSrcPortName'/'!packet_vxlan_innerSrcPortName': get WJH event filtered by VXLAN source port 'packet_vxlan_innerDstPortName'/'!packet_vxlan_innerDstPortName': get WJH event filtered by VXLAN destination port 'from': get WJH event that occurred after a given timestamp 'until': get WJH event that occurred before a given timestamp 'interval': group results based on intervals of time 'group_by': get all WJH events grouped by reason or category or severity

Query example:

Copy
Copied!

            
            https://<ip-address>/neo/app/wjh_events/timeline?reason_severity=Warning,Notice,Error&from=-12h&interval=43s&until=1595160184&tz=Asia/Jerusalem&_=1595160184446

Response:

Copy
Copied!

            
            2020-07-1914: 59: 09: {
  Forwarding: 0
},
2020-07-1914: 59: 52: {
  Forwarding: 0
},
2020-07-1915: 00: 35: {
  Forwarding: 0
},
2020-07-1915: 01: 18: {
  Forwarding: 0
},
2020-07-1915: 02: 01: {
  Forwarding: 2901
},
2020-07-1915: 02: 44: {
  Forwarding: 0
}
}

WJH Filters

Description	Return all the unique values of all tags on influxDB
Request URL	/neo/app/wjh_events/filters
Arguments	N/A

Response:

Copy
Copied!

            
            {
  packet_ethernet_dstMac: [
    "00:3b:cc:11:22:23"
  ],
  subcategory: [
    "L2"
  ],
  packet_ethernet_etherTypeName: [
    "Internet Protocol version 4 (IPv4) (0x0800)"
  ],
  packet_ip_dstIp: [
    "99.254.254.3",
    "99.254.254.2",
    "99.254.254.8",
    "99.254.254.9",
    "99.254.254.0",
    "99.254.254.6",
    "99.254.254.4",
    "99.254.254.10",
    "99.254.254.7",
    "99.254.254.1",
    "99.254.254.5",
    "99.254.254.11"
  ],
  packet_ethernet_srcMac: [
    "00:3b:cc:11:22:23"
  ],
  deviceIP: [
    "10.209.36.128"
  ],
  packet_ip_srcIp: [
    "99.255.255.22",
    "99.255.255.95",
    "99.255.255.252",
    "99.255.255.129",
    "99.255.255.155",
    "99.255.255.34",
  ],
  deviceName: [
    "r-ufm-sw72"
  ],
  category: [
    "Forwarding"
  ],
  inPort: [
    "Eth1/9"
  ],
  packetType: [
    "IP"
  ],
  packet_ip_protocolName: [
    "IGMP (0x02)"
  ],
  reason_description: [
    "Source MAC equals destination MAC"
  ],
  reason_severity: [
    "Error"
  ]
}

WJH Metadata

Description	Return all supported WJH events metadata
Request URL	/neo/app/wjh_events/metadata
Arguments	N/A

Response:

Copy
Copied!

            
            [
  {
    "category": "Forwarding",
    "default": true,
    "filterable": true,
    "reasonID": "207",
    "recommendedAction": "Validate why IGMP join or multicast router port does not exist",
    "severity": "Warning",
    "subCategory": "L2",
    "caption": "",
    "description": "Multicast egress port list is empty",
    "elementName": "Multicast egress port list is empty",
    "generation": -1,
    "instanceID": "Multicast egress port list is empty"
  },
  {
    "category": "Buffer",
    "default": true,
    "filterable": false,
    "reasonID": "506",
    "recommendedAction": "Monitor network congestion",
    "severity": "Notice",
    "subCategory": "Buffer",
    "caption": "",
    "description": "Packet Latency Threshold Crossed",
    "elementName": "Packet Latency Threshold Crossed",
    "generation": -1,
    "instanceID": "Packet Latency Threshold Crossed"
  }
]

Set WJH Streaming Filters

Description	Set WJH session streaming settings on the Telemetry Agent
Request URL	PUT /neo/app/wjh_events/streaming/filters
Arguments	N/A

Response:

Copy
Copied!

            
            {
  "reason_ids": [
    "Ingress port ACL",
    "Ingress router ACL"
    “Blackhole ARP/neighbor"
  ]
}

Get WJH Streaming Filters

Description	Return WJH session streaming settings configured on the Telemetry Agent
Request URL	GET /neo/app/wjh_events/streaming/filters
Arguments	N/A

Response:

Copy
Copied!

            
            {
  "reason_ids": [
    "Ingress port ACL",
    "Ingress router ACL"
  ]
}

Reset WJH Streaming Filters

Description	Reset to default WJH session streaming settings on the Telemetry Agent
Request URL	DELETE /neo/app/wjh_events/streaming/filters
Arguments	N/A

Response:

Copy
Copied!

            
            {
  "reason_ids": [
    "Ingress port ACL",
    "Ingress router ACL"
    “Blackhole ARP/neighbor"
  ]
}

On This Page