Monitoring AIops

[READ] Historic data points for one PRTG sensor over the recent window. Args: sensor_id: PRTG sensor object id (objid). hours: Look-back window in hours (default 24). target: PRTG target name from config; omit for the default.

[READ] Detailed status for one PRTG sensor (name, status, lastvalue, ...). Args: sensor_id: PRTG sensor object id (objid). target: PRTG target name from config; omit for the default.

[READ] List PRTG sensors (objid, sensor, device, status, message, lastValue). Args: status: Optional PRTG status code to filter by (e.g. "5" for down). target: PRTG target name from config; omit for the default.

[READ] System-wide PRTG sensor counters (up/down/warning/paused/alarms). Args: target: PRTG target name from config; omit for the default.

[WRITE][risk=medium] Return a node to managed state (lift unmanage). Args: node_id: Numeric Orion NodeID. target: SolarWinds target name from config; omit for the default.

[WRITE][risk=high] Permanently delete a node from Orion. IRREVERSIBLE — no undo. Pass dry_run=True to preview (reports the node's caption). Args: node_id: Numeric Orion NodeID to delete. dry_run: If True, preview without deleting. target: SolarWinds target name from config; omit for the default.

[WRITE][risk=medium] Resume a paused PRTG object (inverse of pause_sensor). Args: object_id: PRTG object id to resume. target: Monitoring target name from config; omit for the default.

[WRITE][risk=medium] Schedule a bounded maintenance window for a node. An end time is REQUIRED — no open-ended maintenance. Args: node_id: Numeric Orion NodeID. start_iso: Window start (ISO-8601 UTC timestamp). end_iso: Window end (ISO-8601 UTC timestamp) — required. target: SolarWinds target name from config; omit for the default.

[WRITE][risk=medium] Time-boxed maintenance window (a pause of ``minutes``). Requires minutes > 0 — maintenance windows are never open-ended. Args: object_id: PRTG object id to place in maintenance. minutes: Maintenance duration in minutes (must be > 0). target: Monitoring target name from config; omit for the default.

[READ] Run a named canned SWQL query (e.g. nodes_down, flapping_interfaces). Returns the same envelope as swql_query: ``{"rows": [...], "returned": N, "limit": L, "truncated": bool}``. ``truncated`` is measured against the full result set — do not treat a capped result as the complete answer. Args: name: Canned query name (from swql_library). params: Optional query params (e.g. {"min": 90} for a threshold). target: SolarWinds target name from config; omit for the default. limit: Maximum rows to return. Default 1000.

[READ] List the canned-SWQL library (name + description). These answer the most-repeated SolarWinds SWQL questions directly — run one with swql_canned instead of hand-writing the query. Args: target: Monitoring target name from config; omit for the default.

[READ] Run a validated read-only SWQL SELECT (row-capped). Only SELECT is permitted — state changes go through the governed write tools. Returns ``{"rows": [...], "returned": N, "limit": L, "truncated": bool}``; when ``truncated`` is true the query matched more rows than were returned — narrow the query or raise the limit rather than treating it as the full set. Args: query: A SWQL SELECT statement. params: Optional named parameters referenced as @name in the query. target: SolarWinds target name from config; omit for the default. limit: Maximum rows to return. Default 1000.

[READ] Top-N SolarWinds nodes by a health metric. Returns {"nodes": [...], "returned": N, "metric": str, "error": str | None}. A non-null "error" means the SWQL query failed — the opposite finding from "no nodes are under load", so never report one as the other. Args: metric: One of cpu, memory, latency, packetloss. n: How many nodes to return (default 10). target: SolarWinds target name from config; omit for the default.

[WRITE][risk=medium] Apply a recorded undo by dispatching its inverse tool. The inverse runs through its own governed tool, so it is audited and its risk_level recorded there. Pass dry_run=True to preview the inverse call without executing it. A token can only be applied once. Args: undo_id: The undoId from undo_list (or an ``_undo_id`` in a write result). dry_run: If True, preview the inverse tool + params without running it. target: Passed through to the inverse tool when it accepts a target.

[READ] List recorded, not-yet-applied undo tokens (most recent first). Each entry names the original tool, the inverse tool that ``undo_apply`` would run, and a human note. Use the ``undoId`` with ``undo_apply``. Returns {"undos": [...], "returned": N, "limit": L, "truncated": bool}. ``truncated`` is *measured* (one extra row is fetched), not guessed from a length coincidence: when it is true there are MORE tokens than shown, so re-run with a higher ``limit`` rather than reporting the list as complete. Each entry carries ``effectVerified``. False means the original write lost its response, …

[WRITE][risk=high] Unmanage a node — masks its monitoring. Inverse: remanage_node. Pass dry_run=True to preview. Reversible → remanage. An end time is required (no open-ended unmanage). Args: node_id: Numeric Orion NodeID. start_iso: Unmanage window start (ISO-8601 UTC timestamp). end_iso: Unmanage window end (ISO-8601 UTC timestamp) — required. dry_run: If True, preview without unmanaging. target: SolarWinds target name from config; omit for the default.

[WRITE][risk=medium] Resume alerts for an entity (lift suppression). Args: entity_uri: SWIS entity URI to resume (from list_muted). target: SolarWinds target name from config; omit for the default.

[READ] Volumes at/above a fill threshold (Orion.Volumes), worst first. Volumes whose usage Orion did not report are returned separately in ``unreadableVolumes`` (``percentUsed: null``) — they are unmeasured, not empty. Args: min_percent: Minimum percent-used to include (default 0 = all). target: SolarWinds target name from config; omit for the default.

[WRITE][risk=medium] Create a time-boxed Zabbix maintenance window. Requires minutes > 0 (never open-ended) and at least one host or group id. Reversible: the undo deletes exactly the maintenance id this call created. Args: name: Maintenance window name shown in Zabbix. minutes: Window length in minutes (must be > 0). host_ids: Host ids to cover (from zabbix_hosts). group_ids: Host-group ids to cover (from zabbix_hostgroups). target: Zabbix target name from config; omit for the default.

[WRITE][risk=high] Delete a Zabbix maintenance window. IRREVERSIBLE — no undo. Pass dry_run=True to preview (reports the window's full definition). The BEFORE definition lands in priorState. Args: maintenance_id: Maintenance id to delete (from zabbix_maintenances). dry_run: If True, preview without deleting. target: Zabbix target name from config; omit for the default.

[READ] Most recent Zabbix trigger events (newest first). Sets ``truncated: true`` when more events exist than were returned; re-run with a higher ``top`` rather than treating the result as the whole history. Args: top: Number of events to return (newest first, capped at 500). target: Zabbix target name from config; omit for the default.

[READ] Zabbix host groups (ids + names, for inventory and maintenance). Args: target: Zabbix target name from config; omit for the default.

[READ] Zabbix hosts with interfaces + owning groups (health inventory). Args: target: Zabbix target name from config; omit for the default.

[READ] Bounded metric detail for one Zabbix item (meta + history points). Sets ``truncated: true`` when the item had more points in the window than were returned — the series you got is the most recent slice, not all of it. Args: item_id: Zabbix item id (from the host's items). hours: Look-back window in hours (capped at 168). limit: Max history points to return (capped at 500). target: Zabbix target name from config; omit for the default.

[READ] Zabbix maintenance windows with their hosts/groups and periods. Args: target: Zabbix target name from config; omit for the default.

[READ] Current Zabbix problems (active alerts) with mapped severity levels. Args: min_severity: Only problems at this Zabbix severity (0-5) or above. target: Zabbix target name from config; omit for the default.

[READ] Zabbix triggers, by default only those currently firing (PROBLEM). Args: only_problems: If True (default), only triggers in PROBLEM state. target: Zabbix target name from config; omit for the default.