Mike Moniz

Members
  • Content Count

    45
  • Joined

  • Last visited

  • Days Won

    6

Everything posted by Mike Moniz

  1. Hiya, I've been thinking about having LogicMonitor take corrective actions on some tasks. For example archiving files if a drive is getting close to full. I know that LogicMonitor does not have any event action abilities based on alerts, where you can run something when an alert occurs. I know that you can write scripts for DataSources, and you can do anything in a script so in theory you can have a DataSource do the cleanup during a check. I just feel there is little reason to do that as you are basically just using LogicMonitor as a glorified centralized Task Scheduler. - Thresholds are checked AFTER the script is run, so you can't use LogicMonitor's thresholds, SDTs or other functionality. The script would need to hard code threshold or have them placed in properties. - DataSource scripts have a limited time to run (default 2min I think), so it needs to complete fast or kick off a separate process. - Might be possible to implement Custom HTTP Integration, but that would require some endpoint to receive and act on it. I also think there is a limit on how many integrations you have and might be too limited to have one generic integration. I'm just talking out loud here and wondering if anyone else has thought about or implemented something like this. Thanks!
  2. Mike Moniz

    allow propertysources to set any property

    I agree this is one as I have also run into this one with the same workaround from support. In my case to auto create location properties for AWS. I suggest anyone with this problem send LM Feedback if you haven't already, they do track those. I know they already deal with "system.categories" which PropertySources does allow to be modified, but everything else gets "auto." as far as I know. I like the dot prefix idea.
  3. Mike Moniz

    LogicMonitor Feature

    You are correct that it's not currently a feature in LogicMonitor (LM) to take an action on an alert. There are "tricks" to do something like this where you use the DataSource script (which normally just runs to provide performance data) to also take action at the same time, but at that point you are just using LM as a task scheduler and are not using the thresholds or SDT features. You can also use the Integration feature to kick off a REST API call on alerts, but it's really designed for ticketing/alerting systems and not for actions. Mike Suding's Blog (worth reading!) has a hack (http://blog.mikesuding.com/2018/12/03/automatic-action-triggered-by-an-alert/) where you have LM monitor it's own alerts via API to kick off a process; which I think is getting rather complex/silly but it should technically work. I much prefer to have an official feature to do this. One thing to keep in mind if you attempt this is to remember that all checks are run on the Collector server(s), not on the device you are monitoring because LM is agentless. So if you are monitoring an IIS server, you will need to recycle the AppPool by running a remote command to IIS from the collector. There are a few topics on the forums that discuss this further: https://communities.logicmonitor.com/topic/1816-lm-actions/ https://communities.logicmonitor.com/topic/2053-self-healing-actions/ https://communities.logicmonitor.com/topic/2265-taking-automated-actions-on-alerts/ I also suggest submitting Feedback on the portal (under support) if you feel this would be a nice feature to have.
  4. Yeah, I expected as much. There are a few situations, typically when an alert clears by removal of the source of the alert or if the device/instance is in SDT. You might have to code the AppliesTo equivalent into a script that returns 0 or 1 for example. Are you using the official LogicMonitor ServiceNow store app for your integration? We don't since it didn't exist at the time of our implementation, but I was wondering if it worked around the revoked clear issues. Thanks!
  5. Mike Moniz

    SQL Mirror DB alerting

    Great to hear!
  6. I'm not 100% but I do believe that removing a DataSource will clear the alert as revoked which will not send a clear to ticketing (really annoying). I'm not sure and suggest you test that. If that is the case then you can likely code equivalent AppliesTo functionality into custom script code with a bit more work and have it return different values instead. Ah, I've forgotten how minimal monitoring originally worked. I think I ended up making it into a DataSource a while back using the process we are talking about. I only use it when onboarding new customers which has ticket creation blocked so I don't run into the revoke thing.
  7. Sounds doable with a custom DataSource, even sounds like a modification of the Minimal Monitoring check. My first thought would be to take the AppliesTo from your dynamic groups and put that in to the AppliesTo for a custom DataSource. You can then make that DataSource ALWAYS cause an alert. So if a resource matches the AppliesTo it will cause an alert. If the problem is fixed, then the alert goes away. P.S. Have you look at minimal monitoring itself? It's kinda designed to help cover your concern by checking for resources missing a classification.
  8. Mike Moniz

    Alert Count in Big Number widget

    The Big Number can only display a current Datapoint value or a count of Resources/Devices. It doesn't count up alerts or other items but what you can do is collect this information as a Datapoint which you can use Big Number widget on, along with tables and graphs and such. The trick is is to "monitor" LogicMonitor portal itself via the LM API. So LogicMonitor is kinda calling itself to collect information. This may require custom DataSources (coding) so it can get a bit complex. The closest example I can find quickly is on Mike Suding's Blog (useful resource) at http://blog.mikesuding.com/2016/11/25/monitor-quantity-of-devices-in-a-logicmonitor-account/ . This actual example is dated since device quantity is now built in, but it shows code example of having LM query it's own API. I would suggest looking over the "LM Exchange" forum here to see if someone else has written this previously or perhaps ask LM Support if they have something like this. This might be jumping in the deep-end if you're new to LM.
  9. Mike Moniz

    Collector 27.005 breaks MySQL v5 monitoring

    Just to throw it out there, the error kinda looks like a known bug in MySQL pre 5.0.24. Although I wouldn't expect a collector upgrade to trigger it. I don't monitor MySQL to test myself. https://bugs.mysql.com/bug.php?id=15455
  10. Mike Moniz

    No SNMP data is being reported....

    There is two main types of SNMP checks. There is your SNMP Get/Walk and there is SNMP Traps. They work very differently. SNMP Get/Walk is where LogicMonitor will directly query your device for state/performance data, this is what most of LogicMonitor wants to use, is the best option and what !snmpwalk does. There is also SNMP Traps where you setup the device to send out alerts to the monitoring system. The setup for each of these are completely different. Many devices support both but some devices only support SNMP Traps (looking at you EMC). If the device supports SNMP Get/Walk, there is likely a section for this on the device config separate from the SNMP Trap section. Also you may need to white-list the IP address of the collector on the device. If the device only supports SNMP Trap, you can still set it up in LogicMonitor but it's far more limited: https://www.logicmonitor.com/support/eventsources/types-of-events/snmp-trap-monitoring/
  11. Mike Moniz

    SQL Mirror DB alerting

    Thanks, unsure why I couldn't find it previously. I might have misread your original request as not wanting to see mirrored databases at all, so ignore the whole modify AD thing I mentioned before. Yeah, changing the threshold for State to be "> 1" sounds like it would cover your needs. To not generate an alert if the State is Oneline (0) or Restoring (1).
  12. Sorry, I'm not setup to test this to verify how it works exactly. I would suggest reaching out to LogicMonitor Support so they can review your particular situation and settings.
  13. Mike Moniz

    Network Topology Maps

    Not currently. See https://communities.logicmonitor.com/topic/838-network-diagram/
  14. Tried esx.tags=true? https://www.logicmonitor.com/support/monitoring/os-virtualization/esx-servers-vsphere/#tag . Doesn't use device-level properties though. You can use PropertySources to run a powershell script to add the tags as device autoproperties. Your script will need to provide especially formatted output and that is covered in the documentation and you can look at existing PropertySources for examples.
  15. Mike Moniz

    SQL Mirror DB alerting

    I can't seem to find this DataSource in LogicMonitor, is this a custom or community DataSource? If you click on the "Edit Global Defining" to jump to it's DataSource settings, what is the "Name" and "lmLocator" code (under version, if exists)? If this DataSource provides Instances using Auto Discover (AD), you can either modify AD itself or use the Filtering section to only include instances you want.
  16. Mike Moniz

    collector fail count

    I don't know about the heartbeat fail datapoint other then what the description says "Number of failed attempts to execute the heartbeat task" but what I've setup is for all our collectors to ping LM (x.logicmonitor.com), ping 8.8.8.8 and each collector pings all the other collectors. It helps us determine if for example the internet is down vs LM SaaS itself is down vs VPN down vs internal networking issues. Perhaps it might even make sense to temporarily add the collector server as a resource a 2nd time but have another collector monitor it. But if you have the option to just rebuild the server and collector, that might just be the simplest option.
  17. Mike Moniz

    Complex Datapoint and limit

    Based on the Limit documentation and without testing it, you have the right understanding. This would report 0 if ok and 1 if under/over but this also means the alert it would generate wouldn't provide any details like what is the temp actually is. Perhaps you can try having two complex datapoints called something like UnderTemp and OverTemp which each just have an expression of "Temperature" (basically cloning the normal datapoint) but one you can set thresholds of < 46 and the other > 60. That way you can report both that the temp was over/under with custom messages and have the temperature right in the alert. Makes it also easy to do warn/error/crit. Actually you can just clone the original Temperature datapoint without having to use complex datapoints (Poll Now would work this way) but I think complex Datapoints would make it more clear.
  18. I completely agree with this one. There are several situations where an alert gets cleared in LM but it doesn't update it's integration including if you disable alerting.
  19. Mike Moniz

    Collector IP address / Interface

    Hmm not sure, wouldn't expect collector/java to force an interface. I didn't see anything obvious in the collector config files either.
  20. Mike Moniz

    Collector IP address / Interface

    Perhaps you can use routing tables on the collector host itself? At the OS level.
  21. Mike Moniz

    Export Netflow from Windows Server to LogicMonitor

    Not sure about the netflow stuff but with wireshark (which also uses winpcap) it might not support using 127.0.0.1/localhost. Perhaps try using the lan ip? https://superuser.com/questions/508623/how-can-i-see-127-0-0-1-traffic-on-windows-using-wireshark
  22. Mike Moniz

    Issues With Creating A Datasource

    Since it's part of a URL you might have to use urlencode rather than htmlentieies. So ">" would be "%3C". There is also java.net.URLEncoder in Groovy. I would look at perhaps using something like pairs << ("${k}=${URLEncoder.encode(v, "UTF-8")}") in your packParams() function. https://stackoverflow.com/questions/10187344/how-to-encode-url-in-groovy
  23. Mike Moniz

    Issues With Creating A Datasource

    I haven't tested your code but I would try doing some testing and attempt to narrow down which part exactly is causing the issue. For example does your code work fine if you remove all the parameters from the URL? And if you remove just the filter part? My gut feeling would look at the non-alphanumeric characters in your filter and there might be differences between how REST calls work in PS vs Groovy. Perhaps they need to be escaped. You might also want to simplify your code, just for testing, in case there are issues with function parameters or the like.
  24. Mike Moniz

    SQL Mirror DB alerting

    What DataSource are you using that is reporting down?
  25. Mike Moniz

    parsing response

    I don't really know python much but LM did state they will be providing a new Python SDK once v.113 is released (end of the month) which might make querying LM easier: https://www.logicmonitor.com/release-notes/v-113-release-notes/ . I haven't seen it myself. Otherwise you may want to output/dump jsonResponse to make sure it's valid json (and not an http 501 error for example) or perhaps comment out the print line to see which line is causing the error? Perhaps you need to do ['data'][0]['id'] or the like? The API can return multiple devices. Again I don't really know python and I'm not currently setup to test with it.