rvbd.profiler

The Profiler package offers a set of interfaces to control and work with a Cascade Profiler Appliance.

All interaction with a Profiler requires an instance of rvbd.profiler.Profiler. This class establishes a connection to the Profiler.

Profiler Columns and Groupbys

One of the key pieces of information Profiler keeps track of are all of the different Column types, and under what context they are appropriate. For instance, if we are running a Traffic Summary report, then 'time' is not a valid column of data since this report type organizes its information in other ways.

Column types fall into two categories: keys and values. Keys are column types that represent the primary organization/grouping of the data, and values are all of the different calculations that can be made.

The contexts for columns that are available are defined by three values: realm, centricity, and groupby. A breakdown of how these three inter-relate is shown in the following table:

    |-----------------------------+------------+----------------------|
    | realm                       | centricity | groupby              |
    |-----------------------------+------------+----------------------|
    | traffic_summary             | hos,int    | all (except thu)     |
    | traffic_overall_time_series | hos,int    | tim                  |
    | traffic_flow_list           | hos        | hos                  |
    | identity_list               | hos        | thu                  |
    |-----------------------------+------------+----------------------|

As FlyScript develops further, this table and the available permutations will expand.

The Profiler tutorial goes into more detail on how these columns can be queried.

Profiler objects

class rvbd.profiler.profiler.Profiler

The Profiler class is the main interface to interact with a Profiler Appliance. Primarily this provides an interface to reporting.

Profiler(host, port=None, auth=None)

Establishes a connection to a Profiler appliance.

host is the name or IP address of the Profiler to connect to

port is the TCP port on which the Profiler appliance listens. if this parameter is not specified, the function will try to automatically determine the port.

auth defines the authentication method and credentials to use to access the Profiler. It should be an instance of rvbd.common.UserAuth or rvbd.common.OAuth.

force_version is the API version to use when communicating. if unspecified, this will use the latest version supported by both this implementation and the Profiler appliance.

See the base Service class for more information about additional functionality supported.

get_columns(columns, groupby=None)

Return valid Column objects for list of columns

columns is a list of strings and/or Column objects

groupby will optionally ensure that the selected columns are valid for the given groupby

get_columns_by_ids(ids)

Return Column objects that have ids in list of strings ids.

ids is a list of integer ids

search_columns(realms=None, centricities=None, groupbys=None)

Identify columns given one or more values for the triplet.

Results will be based on the following relationship table:

|-----------------------------+------------+----------------------|
| realm                       | centricity | groupby              |
|-----------------------------+------------+----------------------|
| traffic_summary             | hos,int    | all (except thu)     |
| traffic_overall_time_series | hos,int    | tim                  |
| traffic_flow_list           | hos        | hos                  |
| identity_list               | hos        | thu                  |
|-----------------------------+------------+----------------------|

version

Returns the software version of the Profiler

Base Report object

class rvbd.profiler.report.Report

This class represents a Profiler report. This class is normally not used directly, but instead via subclasses for specific report types.

Report(profiler)

Initialize a report object. A report object is bound to an instance of a Profiler at creation.

run(template_id, timefilter=None, resolution="auto", query=None, trafficexpr=None, data_filter=None, sync=True)

Create the report on Profiler and begin running the report. If the sync option is True, periodically poll until the report is complete, otherwise return immediately.

template_id is the numeric id of the template to use for the report

timefilter is the range of time to query, a TimeFilter object

resolution is the data resolution (1min, 15min, etc.), defaults to 'auto'

query is the query object containing criteria

trafficexpr is a TrafficFilter object

data_filter is a deprecated filter to run against report data

sync if True, poll for status until the report is complete

wait_for_complete(interval=1, timeout=600)

Periodically checks report status and returns when 100% complete

status()

Query for the status of report. If the report has not been run, this returns None.

The return value is a dict containing:

status indicating completed when finished

percent indicating the percentage complete (0-100)

remaining_seconds is an estimate of the time left until complete

get_data(index=0, columns=None)

Retrieve the data for this report. If columns is specified, restrict the data to the list of requested columns.

get_iterdata(index=0, columns=None)

Retrieve an iterator on the the data for this report. If columns is specified, restrict the legend to the list of requested columns.

get_legend(index=0, columns=None)

Return a legend describing the columns that are associated with this report. If columns is specified, restrict the legend to the list of requested columns.

delete()

Issue a call to Profiler delete this report.

Traffic Summary Report

class rvbd.profiler.report.TrafficSummaryReport

TrafficSummaryReport(profiler)

Create a traffic summary report. The data is organized by the requested groupby, and retrieves the selected columns.

run(groupby, columns, sort_col=None, timefilter=None, trafficexpr=None, host_group_type="ByLocation", resolution="auto", centricity="hos", area=None, sync=True)

See SingleQueryReport for a description of the arguments.

Traffic Overall Time Series Report

class rvbd.profiler.report.TrafficOverallTimeSeriesReport

TrafficOverallTimeSeriesReport(profiler)

Create an overall time series report.

run(columns, timefilter=None, trafficexpr=None, resolution="auto", centricity="hos", area=None, sync=True)

See SingleQueryReport for a description of the arguments. (Note that sort_col, groupby, and host_group_type are not applicable to this report type).

Traffic Flow List Report

class rvbd.profiler.report.TrafficFlowListReport

TrafficFlowListReport(profiler)

Create a flow list report.

run(columns, sort_col=None, timefilter=None, trafficexpr=None, sync=True)

See SingleQueryReport for a description of the arguments. (Note that only columns,sort_col,timefilter, andtrafficexpr` apply to this report type).

Identity Report

class rvbd.profiler.report.IdentityReport

IdentityReport(profiler)

Create a report for Active Directory events.

run(username=None, timefilter=None, trafficexpr=None, sync=True)

Run complete user identity report over the requested timeframe

username specific id to filter results by

timefilter is the range of time to query, a TimeFilter object

trafficexpr is an optional TrafficFilter object