Antony Hawkins

Minimal Monitoring alerter

Recommended Posts

This is the most ridiculously simple datasource, possibly ever.

Where devices end up in the 'Minimal Monitoring' dynamic group (i.e. the collector has not been able to find the device properties) the only way you know is by choosing to look in that group.

NOTE: The 'Minimal Monitoring' dynamic group does not exist in all accounts. It's a problem-catching group that we only invented a year or so back, and like any group it can be deleted. You may also have created your own 'Minimal Monitoring' group for other purposes, so check in your account FIRST, before importing this datasource.

The 'Minimal Monitoring' dynamic group this datasource is intended for has a dynamic group custom query of:

system.sysinfo == "" && system.sysoid == "" && isDevice() && !(system.virtualization) && (monitoring != "basic")

This datasource then has the very simple AppliesTo of:

join(system.groups,",") =~ "Minimal Monitoring"

The datasource is a datapump type that both returns and alerts on a value of 1 for all devices, set to alert on the second 10-minute poll, so you get a warning alert from every device within Minimal Monitoring. The poll interval and alert trigger delay combine to give a modest grace period to permit new devices to have AD run against them, to avoid false alerts.

Once changes are made such that the device properties are found, the devices will be removed from the Minimal Monitoring group and the datasource will therefore de-associate, removing the alert.

FXK3HP

Share this post


Link to post
Share on other sites

With or without alerting, a very simple 'Problem Devices' dashboard is also very easy to construct - just a text widget with an explanation, and a NOC widget listing each device in the 'Minimal Monitoring' device group:

593a7341de326_ScreenShot2017-06-09at11_06_16.thumb.png.1f6f7fac4ab8595802406d529c60ae60.png

Share this post


Link to post
Share on other sites

@Andrey Kitsen I created the alerter and the dashboard, and have subsequently used them, for cases where a customer has run a netscan on an inadequately-prepared (for LogicMonitor purposes) network, for example where SNMP credentials were unknown or SNMP was not running, resulting in large numbers of unmonitored devices. This is only a small proportion of customers, so I don't have a statistically significant sample to comment on.

It's probably most useful in large environments with small numbers of non-responsive devices, as these are the cases where a large number of monitored devices in groups can appear to be "everything" - it's easy to overlook the fact that there are a few devices missing from hundreds or thousands across multiple groups. These cases tend to be where a small number of devices have non-standard SNMP configs, etc - maybe their community string differs from what should be the network standard and therefore the group-level snmp.community value doesn't permit a response.

However, it does have uses in smaller environments, and clearly also if all N00 or N,000 detections from a netscan arrive in Minimal Monitoring, it will quickly flag this up too.

Edited by Antony Hawkins

Share this post


Link to post
Share on other sites
On 6/20/2017 at 3:46 AM, Antony Hawkins said:

@Andrey Kitsen I created the alerter and the dashboard, and have subsequently used them, for cases where a customer has run a netscan on an inadequately-prepared (for LogicMonitor purposes) network, for example where SNMP credentials were unknown or SNMP was not running, resulting in large numbers of unmonitored devices. This is only a small proportion of customers, so I don't have a statistically significant sample to comment on.

It's probably most useful in large environments with small numbers of non-responsive devices, as these are the cases where a large number of monitored devices in groups can appear to be "everything" - it's easy to overlook the fact that there are a few devices missing from hundreds or thousands across multiple groups. These cases tend to be where a small number of devices have non-standard SNMP configs, etc - maybe their community string differs from what should be the network standard and therefore the group-level snmp.community value doesn't permit a response.

However, it does have uses in smaller environments, and clearly also if all N00 or N,000 detections from a netscan arrive in Minimal Monitoring, it will quickly flag this up too.

 

I'll take note of this. 

Share this post


Link to post
Share on other sites

Wondering why you use: 
join(system.groups,",") =~ "Minimal Monitoring"

shouldn't this work:
contains(system.groups,"Minimal Monitoring")

I can't get "contains" to work like this though?!  Does it not work in AppliesTo ??

Edited by lkvitek

Share this post


Link to post
Share on other sites

Hi Ikvitek,

In this case, I used:

join(system.groups,",") =~ "Minimal Monitoring"

...purely because, if you use the AppliesTo wizard to select groups to apply a datasource to, this is the format the wizard creates for you.

You are correct though, the 'contains' method is equally valid and should work. I have successfully tested this in my account:

contains(system.groups,"Minimal Monitoring")

If you contact Support they will be able to troubleshoot this for you.

Please also see my note in my original post, that the 'Minimal Monitoring' dynamic group does not exist in all accounts. It's a problem-catching group that we only invented a year or so back, and like any group it can be deleted. You may also have created your own 'Minimal Monitoring' group for other purposes, so check in your account FIRST, before importing this datasource.

Share this post


Link to post
Share on other sites
25 minutes ago, Misha Stamenkovic said:

The LogicModule Locator doesn't work, "Unknown error".

 

Hi Misha,

I've asked someone to take a look into this, thanks for pointing it out.

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.