jennifer-problems
Read the problems JENNIFER itself detected in a domain, counted per minute, problem type and instance, as the problem heatmap of the console's application insight dashboard shows them. Use it right after an anomaly is found (jennifer-metrics) to see what JENNIFER judged wrong at that time and on which instance: an instance that stopped, restarted or reconnected explains a gap or spike in its metrics. Then narrow the scope with jennifer-app-summary and jennifer-errors for the same window and instances.
- Only minutes with problems are returned: zero rows means JENNIFER found nothing in the period, not a failure (failures stop the query with an error).
- The problem types are JENNIFER event names such as AGENT_STOP, AGENT_START and AGENT_RECONNECT; others appear as JENNIFER detects them.
- The resolution is one minute and the period at most one day; the console is asked ten minutes at a time, and per instance only for the windows that had problems.
jennifer-problems [profile=VALUE] domain_id=VALUE [instance_ids=VALUE] [duration=VALUE] [from=VALUE] [to=VALUE]
- profile=VALUE
- Optional. Name of the JENNIFER console connect profile (type jennifer-apm-console). Every such profile you are granted is used when omitted. With domain_id, which is an id of one console, exactly one profile must be used: name it when you are granted several.
- domain_id=VALUE
- Required. e.g. 1000. The domain (sid) to read; jennifer-instances lists them.
- instance_ids=VALUE
- Optional. e.g. 75553,75555. Comma separated instance ids (oid) of the domain. Every instance that reported in the period is read when omitted.
- duration=VALUE
- Optional. e.g. 10m for the last 10 minutes. Recent period up to now, in s(second), m(minute), h(hour), d(day) units. The last hour when no period is given. At most one day.
- from=VALUE
- Optional. Start of the period, yyyyMMddHHmmss. Omitted digits are padded with zero. Overrides duration.
- to=VALUE
- Optional. End of the period, yyyyMMddHHmmss. Omitted digits are padded with zero. Now when omitted.
Output fields
| Field | Type | Name | Description |
|---|---|---|---|
| _time | Date | Minute | e.g. 2026-10-26 04:56:00. The minute the problems were counted in. |
| profile | String | Connect profile | e.g. jennifer-prod |
| domain_id | Integer | Domain ID | e.g. 1000 |
| instance_id | Long | Instance ID | e.g. 75553. The instance (oid). Null for problems of the domain that no single instance accounts for. |
| instance_name | String | Instance name | e.g. siem-mon-console-1. Null for an instance the period list does not name. |
| problem | String | Problem type | e.g. AGENT_STOP, AGENT_START, AGENT_RECONNECT. The JENNIFER event name of the problem, as the heatmap rows show it. |
| count | Long | Count | e.g. 2. Occurrences in the minute; always 1 or more. |
Usage
What JENNIFER judged wrong in the last hour, by type and instance:
jennifer-problems domain_id=1000 duration=1h | stats sum(count) as count, min(_time) as first_seen, max(_time) as last_seen by problem, instance_name | sort -count
Problems around an anomaly found by jennifer-metrics:
Problems of the day per 10 minutes:
Problems of one instance: