SWQL: Find Interfaces Over 80% Utilisation

By NetMon Hub Editorial · 30 May 2026

SWQL For SolarWinds Platform (Orion): Network Monitoring Overview · Validated on Orion Platform 2025.2

Run this in SWQL Studio or as an alert trigger condition. It returns any interface whose current inbound or outbound percent utilisation is over 80.

SELECT
    n.Caption AS Node,
    i.Name AS Interface,
    i.InPercentUtil,
    i.OutPercentUtil
FROM Orion.NPM.Interfaces i
JOIN Orion.Nodes n ON i.NodeID = n.NodeID
WHERE i.InPercentUtil > 80 OR i.OutPercentUtil > 80
ORDER BY i.InPercentUtil DESC

How it works

• Orion.NPM.Interfaces is the interface entity; Orion.Nodes holds the parent device.
• InPercentUtil / OutPercentUtil are the last-polled utilisation percentages, so this is a point-in-time snapshot — fine for an alert, not for historical reporting.
• For historical analysis, query Orion.NPM.InterfaceTraffic and aggregate over a time window.

Turning it into an alert

Drop the SELECT/ORDER BY and keep the WHERE clause as a custom SWQL alert trigger. Set a reset condition (e.g. < 70) to avoid flapping, and a 5-minute sustained condition so a single poll spike doesn’t page anyone.