Virtualization
Query Language Guide
Syntax

- Filter specifications can use parenthetical grouping for the boolean logic
- Strings that do not contains spaces are not required to have quotes around them
- Strings can be quoted either with matching ' or " characters
- Specification of object, properties, operators, and keywords are case insensitive
Operators
Description
Equality. Permissible on the following property types: LONG, DATE, STRING, BOOLEAN. Using the operator on a string collection will evaluate to TRUE if there is at least one string in the collection that matches the parameter
Example(s)
vm.name = 'Foo'
Explanation
Performs a case sensitive string match of the value of the name property on a VM object and compares it to the strong 'Foo'
Description
Not Equal. Permissible on the following property types: LONG, DATE, STRING, BOOLEAN
Explanation
Performs a numeric comparison of the cpu property on all virtual machines and returns any virtual machines that do not have 2 vCPUs
Description
Greater than. Permissible on the following property types: LONG, DATE
Explanation
Performs a numeric comparison of the cpu property on all virtual machines and returns any virtual machines that have more than 2 vCPUs
Description
Less than. Permissible on the following property types: LONG, DATE
Explanation
Performs a numeric comparison of the cpu property on all virtual machines and returns any virtual machines that have less than 2 vCPUs
Description
Greater than or equal to. Permissible on the following property types: LONG, DATE
Explanation
Performs a numeric comparison of the cpu property on all virtual machines and returns any virtual machines that have 2 or more vCPUs
Description
Less than or equal to. Permissible on the following property types: LONG, DATE
Explanation
Performs a numeric comparison of the cpu property on all virtual machines and returns any virtual machines that have 2 or fewer vCPUs
Description
Permissible on the following property types: STRING, STRING_COLLECTION. If used in a collection, the specified string must occur within one string in the collection.
If used with a string, it does a substring match. In both cases the comparison is case insensitive.
Example(s)
portgroup.name CONTAINS '0341' OR vnic.tags CONTAINS '1234' project vm
Explanation
Returns all port groups that include a substring of '0341' as well as all virtual machines that have a vnic with a tag name that contains a substring of '1234'
Description
Permissible on the following property types: STRING, STRING_COLLECTION. Similar to the CONTAINS operator except the substring match is anchored at the beginning
Example(s)
portgroup.name STARTSWITH 'PRIV_' project vm
Explanation
Returns all virtual machines that have vNICs connected to portgroups whose names start with the string 'PRIV_'
Description
Permissible on all property types. If a property's value is NULL then IS EMPTY returns TRUE. If a LONG property type has a value of 0 the operator returns FALSE.
If a string is NULL or is set to the empty string then the operator returns TRUE. If a string collection has 0 items in the collection the operator returns TRUE.
Example(s)
vm.tags IS EMPTY
Explanation
Returns all virtual machines who do not have any TAGS set on them
Keywords
Description
Transforms a result set to another result set by type association or function. The source data is not kept and only the projected data is included in the result set. The VQL query engine will calculate a shortest path traversal of the type system to return the desired type of data
Example(s)
vm.name = 'Foo' PROJECT cluster
Output
Returns the cluster that the VM named 'Foo' is currently running on. The VQL engine first determines what host the VM is on and then what cluster that host is in
Description
Similar to PROJECT accept that use of expand will retain the original result set
Example(s)
vm.name = 'Foo' EXPAND pg
Output
Returns all port groups connected to all vnics for the specified virtual machine. The result set includes the single virtual machine as well as the port group objects
Description
A boolean operator that can be used to exclude objects that do no meet both conditions specified in the AND expression
Example(s)
vm.mem > 1024 AND vm.cpu = 1
Output
Returns all virtual machines that are allocated more than a 1024 Megabytes of memory and have a single vCPU
Description
A boolean operator that can be used to include objects that meet both conditions specified in the OR expression
Example(s)
vm.mem > 1024 OR vm.cpu = 1
Output
Returns any virtual machines that are allocated more than a 1024 Megabytes of memory or have a single vCPU
Description
Constrain a clause to a certain time in the past. If not provided, the time defaults to the current time. Times are relative or absolute
Example(s)
pnic.duplex = HALF project host AT 2 weeks AGO
pnic.duplex = HALF project host AT 2009-01-07 12:00:00
Output
The first example returns all hosts that had a pnic on the host set to HALF duplex 2 weeks ago and the second example returns any hosts that had a pnic set to HALF duplex at an exact time in the past
Description
Constrain a clause to a time range. If a time range is not provided, the time defaults to the current time. Times are relative or absolute. The time specifications for BETWEEN/THRU are required to be of the same type (relative or absolute)
Example(s)
software.name contains KB923561 project VM BETWEEN 10 days ago THRU now
Output
Returns all virtual machines that had a piece of software installed in them that had the string KB923561 in it anytime between 10 days ago thru present
Description
Subtract the contents of one VQL result set from another
Example(s)
datastore.name = DS1023 project vm WITHOUT vm.cpu > 1 AND vm.mem < 1024
Output
Return all virtual machines that have vDisks on a datastore named DS1023 except for any virtual machines that have more than 1 vCPU and less than 1024 Megabytes of RAM
Description
Performs the set intersection of 2 VQL result sets
Example(s)
vm.vapp = "CRM" IN software.name contains "Oracle" project vm
Output
Returns all virtual machines that are a part of the ERP vApp that have any Oracle software installed on them
Description
Combine the contents of one result set with another
Example(s)
portgroup.vlan = 34 project cluster INCLUDE vm.cpu = 4
Output
Return all clusters that have any hosts that have a vswitch/portgroup on vlan 34 and include in the result set any virtual machines that have 4 vCPUs
Types
Description
Array of characters
Example(s)
vm.name = 'Foo'
Output
Any VM whose exact name is Foo
Description
Millisecond precision. Dates can be specified using either absolute or relative semantics
Example(s)
vm.name = Foo at 2009-01-07 12:00:00
Output
The VM named Foo and the vaul of all of it's properties at 2009-01-07 12:00:00
Description
64bit numeric
Output
Any VM that has 2 vCPUs
Description
Holds a value of either true or false
Example(s)
vmknic.dhcp = true project host
Output
Return all Hosts that have a vmknic set to obtain it's IP address via DHCP
Examples
All virtual machines that have more than 1GB of Memory
All virtual machines that have more than 1GB of Memory that also have 2 vCPUs
vm.mem > 1024 AND vm.cpu = 2
Which clusters have virtual machines with more than 1GB of Memory and 2 vCPUs
vm.mem > 1024 AND vm.cpu = 2 project cluster
Which clusters had virtual machines with more than 1GB of Memory and 2 vCPUs a week ago
vm.mem > 1024 AND vm.cpu = 2 project cluster at 7 days ago
All virtual machines across all Hosts that have at least one vNIC on VLAN 42
portgroup.vlan = 42 project vm
All Clusters that are not using DPM
cluster.dpm_enabled = false
All virtual machines that are in clusters that are not using HA
cluster.das_enabled = false project vm
All virtual machines that have a vCDRom connected
vcdrom.is_connected project vm
All virtual machines have a virtual disk with more than 200GB of capacity who are on datastores that are more than 80 percent used
datastore.percent_used > 80 project vdisk | vdisk.capacity_mb > 200000 project vm
All virtual machines that have SQL Server software installed on them
software.name contains 'SQL Server' project vm
All hosts within a specific vCenter instance
vms.name = 'vCenter Name' project host
Get the VM Object that has a vNIC with a specific IP and VLAN
pg.vlan = 42 project vnic | vnic.ips = '192.168.1.10' project vm
Get all virtual machines that have been quarantined
vm.tags contains quarantined
Find out if a particular VM was quarantined in the past
vm.name = 'Foo' AND vm.tags contains quarantine at 7 days ago
Find out all IP Addresses on a physical host. A List of VMKnic objects are returned and each VMKNic object has an ip property
host.name = 'Foo' project vmknic
Find out all IP Addresses on a VM. A list of vNic objects are returned and each vNic object has an ips property that is a collection of strings which represent IP addresses for the specified VM
vm.name = 'Foo' project vnic
API Usage
To issue VQL queries throguh the Reflex VMC API your client software will issue a SOAP request to a Reflex VMC Server. The steps to accomplish this task are the following:
- Enable the Reflex VMC API
- Java Example
- Create client side SOAP Proxy code
- Issue VQL Query in Java
- Python Example
- Issue VQL Query in Python
Enable the Reflex VMC API
- Log on to the VMC and go to the Administration tab
- Open the 'Edit server configuration' dialog
- Set 'core.api.enabled' to 'true' to expose the API externally
- Set 'core.api.require.auth' to 'false' to turn off authentication for the API. This can be set to require authentication later
- Set 'core.api.use.ssl' to 'false' to turn off SSL for the API. This can be set to encrypt network traffic later
Create client side Java SOAP Proxy code
VQL is a dynamic language in that some properties are dynamically added during the runtime of the system. VQL queries are issued through a SOAP method
serviced by the Reflex VMC. Strongly typed VQL objects are provided via dynamically created XSD files embedded within the WSDL.
The URL addresses for the WSDL as well as the actual SOAP service are:
- WSDL Address: http://<Reflex-VMC-DNS-or-IP>:8443/1.0/sdk?wsdl
- Service Address: http://<Reflex-VMC-DNS-or-IP>:8443/1.0/sdk
Any WSDL import mechanism can be used to create client side proxy code. The following command line uses a utility named wsimport to create Java client side proxy code.
wsimport -keep "http://<VMC_server>:8443/1.0/sdk?wsdl"
Issue VQL Query in Java
Once the client side proxy code is created and referenced from your client side code, the
runVQLQuery method can be called.
The following Java code snippet provides an example of issuing a query.
import java.util.List;
import javax.xml.ws.BindingProvider;
import com.reflexsecurity.otoro.soap.ReflexPortType;
import com.reflexsecurity.otoro.soap.ReflexPortTypeService;
import com.reflexsecurity.otoro.soap.Vm;
import com.reflexsecurity.otoro.soap.VqlObject;
public class QueryExample {
public static void main(String[] args) throws Exception {
ReflexPortTypeService reflexService = new ReflexPortTypeService();
ReflexPortType reflexPort = reflexService.getReflexPortTypePort();
BindingProvider bp = (BindingProvider) reflexPort;
bp.getRequestContext().put(BindingProvider.ENDPOINT_ADDRESS_PROPERTY, "http://<VMC server>:8443/1.0/sdk?");
List<VqlObject> objects = reflexPort.runVQLQuery("vnic.ips = '172.16.9.40' project vm");
for (VqlObject object : objects) {
Vm vm = (Vm)object;
System.out.println("vm.getName() = " + vm.getName());
}
}
}
Issue VQL Query in Python
Python can dynamically create python objects from WSDL using the SUDS SOAP library. The following example uses SUDS version 0.3.9 which at the time of writing could be found at:
http://pypi.python.org/.
import suds
client = suds.client.Client('http://<VMC_Server>:8443/1.0/sdk?wsdl')
vm_list = client.service.runVQLQuery('vnic.ips = '172.16.9.40' project vm')
for vm in vm_list:
print vm.name