Moquery to check unused EPGs

[Jarurug]

Hi All,

We have 300+ EPGs in our Environment and some of them are not used.

Is there a Moquery to list all the unused EPGs?

[RedNectar]

Hi @Jarurug ,

Maybe I should write a blogpost about how to ask a good question!

In the meantime, I'm struggling to understand what you mean by "unused EPGs"

It could mean EPGs that have no:

• endpoints
• static path mappings
• provided or consumed contracts
• physical or VMM domain associated with it
• perhaps something else I haven't thought of

Anyway, I'm going to ASSUME you mean EPGs that have no provided or consumed contracts.

And I'm going to use icurl rather than moquery - I may translate the icurl answers to moquery later if I get time (BTW, moquery just translates your queries to icurl anyway - and not always accurately)

Because icurl uses ? and & characters in the command, you can assume all the following examples have been entered from a bash command shell, not the APIC CLI

The following will give you a list of the dn (distinguished or unique name) of every EPG in the system. 

apic#1 bash
T17@apic1:~> icurl -s http://localhost/api/node/class/fvAEPg.json | jq -r '.imdata[].fvAEPg.attributes.dn' | sort

The following will give you a list of the dn (distinguished or unique name) of every EPG in the system that either provides or consumes a contract. [Scroll right - it's a LONG command]

apic#1 bash
T17@apic1:~> icurl -s http://localhost/api/node/class/fvAEPg.json?'query-target=subtree&target-subtree-class=fvAEPg&rsp-subtree=children&rsp-subtree-class=fvRsCons&rsp-subtree-include=required&rsp-subtree-class=fvRsProv&rsp-subtree-include=required' | jq -r '.imdata[].fvAEPg.attributes.dn' | sort | uniq

If you pipe each output into a text file, you can use comm to find all EPGs that have NO provided or consumed contracts.  Below I piped all EPGs into a file called all, and the contracted EPGs into a file called contracted.  You can see that on my lab, there are six EPGs that have neither consumed or provided contracts.

apic#1 bash
T17@apic1:~> icurl -s http://localhost/api/node/class/fvAEPg.json | jq -r '.imdata[].fvAEPg.attributes.dn' | sort > all
T17@apic1:~> icurl -s http://localhost/api/node/class/fvAEPg.json?'query-target=subtree&target-subtree-class=fvAEPg&rsp-subtree=children&rsp-subtree-class=fvRsCons&rsp-subtree-include=required&rsp-subtree-class=fvRsProv&rsp-subtree-include=required' | jq -r '.imdata[].fvAEPg.attributes.dn' | sort | uniq > contracted
T17@apic1:~> comm -3 all contracted     # the -3 option suppresses lines that appear in both files
uni/tn-infra/ap-access/epg-default
uni/tn-infra/ap-ave-ctrl/epg-ave-ctrl
uni/tn-Tenant01/ap-2Tier_AP/epg-AppServers_EPG
uni/tn-Tenant01/ap-2Tier_AP/epg-DBServers_EPG
uni/tn-Tenant03/ap-2tier_ap/epg-WebServers_EPG
uni/tn-Tenant05/ap-2Tier_AP/epg-DBServers_EPG
uni/tn-Tenant18/ap-3Tier_AP/epg-DBServers_EPG

---

BTW - if you want a cool print of all EPGs and the contracts that the provide and consume, try this.

T17@apic1:~> icurl -s http://localhost/api/node/class/fvAEPg.json?'rsp-prop-include=naming-only&query-target=subtree&target-subtree-class=fvAEPg&rsp-subtree=children&rsp-subtree-class=fvRsCons&rsp-subtree-include=required&rsp-subtree-class=fvRsProv&rsp-subtree-include=required' | jq

[RedNectar]

Hi @Jarurug ,

I'm guessing you were not satified with my last answer because I gave you an icurl answer when you asked for a moquery answer.

I did say in my first answer that "I may translate the icurl answers to moquery later if I get time" 

Well, I got time and can now tell you that the many bugs in moquery make it impossible to solve this problem using moquery in exactly the same way.

But I found a work-around

The following will give you a list of the dn (distinguished or unique name) of every EPG in the system. 

apic#1 moquery -c fvAEPg -o json | jq -r '.imdata[].fvAEPg.attributes.dn' | sort

The following SHOULD give you a list of the dn (distinguished or unique name) of every EPG in the system that either provides or consumes a contract.

apic#1  moquery -c fvAEPg -o json -x "query-target=subtree target-subtree-class=fvAEPg rsp-subtree=children rsp-subtree-class=fvRsCons rsp-subtree-include=required rsp-subtree-class=fvRsProv rsp-subtree-include=required"| jq -r '.imdata[].fvAEPg.attributes.dn' | sort

Unfortunately, it lists ONLY EPGs that provide a contract.  So it may as well be simplified to:

apic#1  moquery -c fvAEPg -o json -x "query-target=subtree target-subtree-class=fvAEPg rsp-subtree=children rsp-subtree-class=fvRsProv rsp-subtree-include=required"| jq -r '.imdata[].fvAEPg.attributes.dn' | sort

And you can get all the EPGs that consume a contract using 

apic#1  moquery -c fvAEPg -o json -x "query-target=subtree target-subtree-class=fvAEPg rsp-subtree=children rsp-subtree-class=fvRsCons rsp-subtree-include=required"| jq -r '.imdata[].fvAEPg.attributes.dn' | sort

As before, if you redirect each output into a text file, combining the provided and consumed contracts list using temp file, you can use comm to find all EPGs that have NO provided or consumed contracts.  Below I piped all EPGs into a file called all, and sorted the the contracted EPGs into a file called contracted. 

Note the >> double redirection on the 3rd moquery command so the output gets appended to the temp file, 

apic#1 bash
T17@apic1:~> moquery -c fvAEPg -o json | jq -r '.imdata[].fvAEPg.attributes.dn' | sort > all
T17@apic1:~> moquery -c fvAEPg -o json -x "query-target=subtree target-subtree-class=fvAEPg rsp-subtree=children rsp-subtree-class=fvRsProv rsp-subtree-include=required"| jq -r '.imdata[].fvAEPg.attributes.dn' | sort > temp
T17@apic1:~> moquery -c fvAEPg -o json -x "query-target=subtree target-subtree-class=fvAEPg rsp-subtree=children rsp-subtree-class=fvRsCons rsp-subtree-include=required"| jq -r '.imdata[].fvAEPg.attributes.dn' | sort >> temp
T17@apic1:~> sort temp | uniq > contracted
T17@apic1:~> comm -3 all contracted     # the -3 option suppresses lines that appear in both files
uni/tn-infra/ap-access/epg-default
uni/tn-infra/ap-ave-ctrl/epg-ave-ctrl
uni/tn-Tenant01/ap-2Tier_AP/epg-AppServers_EPG
uni/tn-Tenant01/ap-2Tier_AP/epg-DBServers_EPG
uni/tn-Tenant03/ap-2tier_ap/epg-WebServers_EPG
uni/tn-Tenant05/ap-2Tier_AP/epg-DBServers_EPG
uni/tn-Tenant18/ap-3Tier_AP/epg-DBServers_EPG

---

Hopefully this answer will satisfy you!

[Marcel Zehnder]

Hi to get a list of EPGs with no endpoints in it, you can do the following (on a APIC):

moquery -c fvAEPg | grep dn | grep epg | awk '{print $3}' | sort > /tmp/all_epgs
moquery -c fvCEp | grep dn | grep epg | awk '{print $3}' | cut -d "/" -f1-4 | sort | uniq > /tmp/epgs_with_endpoints 
grep -vf /tmp/epgs_with_endpoints /tmp/all_epgs

HTH

[RedNectar]

If only we knew what was mean by "unused EPGs"

It could mean EPGs that have no:

• endpoints = see Marcel's answer
• static path mappings
• provided or consumed contracts = see my previous answers
• physical or VMM domain associated with it
• perhaps something else I haven't thought of

Let's hope @Jarurug responds with some more information

[Jarurug]

Thanks for helping @RedNectar.

Sorry if my question was not proper. Am trying to find a Moquery to list EPGs which doesn't have any EndPoints associated with it.

[Jarurug]

Thanks Marcel.

I was looking for this Only(EPG with no EndPoints)

However, this EPGs which am getting from your Moquery still have Endpoints associated with it. Have checked the same with TAC but they also don't seem to have an solution for this.

[Remi-Astruc]

Hi @Jarurug ,

Then, in the @Marcel Zehnder 's script, just replace fvCEp with fvRsPathAtt

If that's what you needed, all the credit goes to him...

Hi Marcel, long time I've not been around, nice to see you again!

[Marcel Zehnder]

Hi @Remi-Astruc Same here, I did not have to much time for the community recently. Nice to see you!