• 0
Shack

Alert when Datasources are not present on a device

Question

I want to alert on something I fear I am going to have to do manually via reporting.  My goal is to be able to alert on devices that are missing certain datasources.  For example - Lets say you add a Dell server into your portal, WMI looks good, everything checks out and monitoring of Windows begins.  

Now lets say you forgot to setup SNMP for Open Manage and the Dell Datasource never pops up under this server.  How can I alert on that?  

Right now I've been able to build out dynamic groups using the auto.activedatasources which will get me these lists.  I have a group for Dell's missing the Dell DS, one for HP's missing the HP DS, another for SQL Servers missing the Database DS but I would like to be able to alert on these as opposed to relying on a dynamic group or report.  

Can this sort of thing be done?

Share this post


Link to post
Share on other sites

7 answers to this question

Recommended Posts

  • 0

Sounds doable with a custom DataSource, even sounds like a modification of the Minimal Monitoring check. My first thought would be to take the AppliesTo from your dynamic groups and put that in to the AppliesTo for a custom DataSource. You can then make that DataSource ALWAYS cause an alert. So if a resource matches the AppliesTo it will cause an alert. If the problem is fixed, then the alert goes away.

P.S. Have you look at minimal monitoring itself? It's kinda designed to help cover your concern by checking for resources missing a classification.

 

Edited by Mike Moniz

Share this post


Link to post
Share on other sites
  • 0
13 hours ago, Mike Moniz said:

Sounds doable with a custom DataSource, even sounds like a modification of the Minimal Monitoring check. My first thought would be to take the AppliesTo from your dynamic groups and put that in to the AppliesTo for a custom DataSource. You can then make that DataSource ALWAYS cause an alert. So if a resource matches the AppliesTo it will cause an alert. If the problem is fixed, then the alert goes away.

P.S. Have you look at minimal monitoring itself? It's kinda designed to help cover your concern by checking for resources missing a classification.

 

 

I see what you are saying with the custom DS that would always be in an alert state if present.  I could use the same applies to that I have setup on my dynamic groups like you mentioned.  Then the DS pops up on the device, alerts and then would be removed upon resolution of the problem.  When the DS is removed would that send an alert clear?   I need a clear sent out to our ServiceNOW integration.  

As for minimal monitoring - I have a dynamic group that's built around the same logic mentioned in that topic but it's just a group.  Didn't know someone had a DS designed around it but now I'm going to take a look at it more.

Appreciate your suggestions!

Share this post


Link to post
Share on other sites
  • 0

I'm not 100% but I do believe that removing a DataSource will clear the alert as revoked which will not send a clear to ticketing (really annoying). I'm not sure and suggest you test that. If that is the case then you can likely code equivalent AppliesTo functionality into custom script code with a bit more work and have it return different values instead.

Ah, I've forgotten how minimal monitoring originally worked. I think I ended up making it into a DataSource a while back using the process we are talking about. I only use it when onboarding new customers which has ticket creation blocked so I don't run into the revoke thing.

Share this post


Link to post
Share on other sites
  • 0

We do that too.  Just black hole the alerts to go nowhere then when the client is ready remove them from the alert rule.  I will definitely test out the clear state when I have some time.  

Share this post


Link to post
Share on other sites
  • 0
On 3/6/2019 at 10:01 AM, Mike Moniz said:

I'm not 100% but I do believe that removing a DataSource will clear the alert as revoked which will not send a clear to ticketing (really annoying). I'm not sure and suggest you test that. If that is the case then you can likely code equivalent AppliesTo functionality into custom script code with a bit more work and have it return different values instead.

Ah, I've forgotten how minimal monitoring originally worked. I think I ended up making it into a DataSource a while back using the process we are talking about. I only use it when onboarding new customers which has ticket creation blocked so I don't run into the revoke thing.

Tested this today and have it working perfectly except I'm not getting a clear update sent to my ticket.  Time to dig in a bit more.

Share this post


Link to post
Share on other sites
  • 0

Yeah, I expected as much. There are a few situations, typically when an alert clears by removal of the source of the alert or if the device/instance is in SDT. You might have to code the AppliesTo equivalent into a script that returns 0 or 1 for example.

Are you using the official LogicMonitor ServiceNow store app for your integration? We don't since it didn't exist at the time of our implementation, but I was wondering if it worked around the revoked clear issues. Thanks!

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Answer this question...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.