15 July 2020 LogicMonitor Basics Office Hours

Q&A Transcript follows. There weren't any questions pending when we ended the webinar, only some comments.

Q: what training resources do you have available for absolute first timers to LogicMonitor?'
Answered at 4:50. Unfortunately the new LMCP program, while it has been finished, is still going through some final approvals before it will be available. It will be soon.

Q: We have a number of Windows Servers with different drive sizes. How do we create an alert like the following: If the drive is >= 1TB, alert(critical) at 2%, if the drive is < 1TB, alert(critical) at 5%
Answered at 8:52.
Q by another attendee at 35:38: Technically shouldn't one of those be equal to? As if you ever had a drive land exactly on that value it wouldn't be included.
Yes, I did not validate that my formula actually works, just showing an example. 

Q: Will the links to these training tools and other solutions be put into chat?
Yes, they were put in the chat and also posted earlier in this thread.

Q: similar to the storage thresholds question, can you show how to set up alert(s) on a dynamic group (say 20 firewalls - don't want to have to set it up on each individual device, and want it to apply when a new one shows up in the dynamic group) that:
1) emails if the cpu on any system is > 80% utilized
2) texts if the cpu on any system is > 90% utilized
Answered at 23:19

Q: the Escalate Button on the Alert portal page..how do you link to it. We click on the button and get an error. Can’t see how to associate a particular escalation for it to call.
Q: we get an error everytime we click on it
Answered at 36:20

Q: We have a number of machines on aws in auto-scaling groups that end up re-spinning every few weeks. While this is great for keeping production clean and running, the data that gets sent to LogicMonitor gets deleted with the old instance. Is it possible to have machine data like cpu/memory usage, ping times etc collected in an autoscaling object? We have LogicMonitor automatically delete the records for terminated machines to save on licensing, else I believe our bill would be prohibitively large.
Answered at 41:00

Q: how do you prevent devices groups showing up in the subject line of an email alert if the device  is in more than one group we are alerted for.
Answered at 44:24

Q: How would you alert if a new service is added to a server?  Not if an existing service starts up but a new service, as if the machine was compromised.
Q: Could you load an array and do a delta alert?
Q: I think there is an EventID that is created when new services are added on a system.  You could have an EventSource do it, I think.
Q: a config source would do it
Q: would it be possible to create a config source
Q: what if you set a delta and alerted on that, if you knew the number of the services
Q: Meant he could just watch the audit log for the adding of the instance to services using the api then trigger alert from there.
Answered at 46:32 and 52:20

Q: if stage 3 in default doesn't acknowledge or fix the alert, does it really not send another alert again? or does it continue to alert the stage 3 person?
Answered at 45:19

Q: Escalation brings up an interesting question : If we have a default escalation chain for critical alerts, can we have one of the stages ping something like slack, but have it ping a specific slack channel depending on what team owns the server that is alerting?
Answered at 50:41

Q: Can you set alerts to go off based on a trigger of other alerts? I don't immediately care if one F5 goes down, but if both go down, I want sirens to go off.
Answered at 55:06

Q: How does one setup a delta in LogicMonitor?
Answered at 56:39

Q: by "absolute" it means make the number positive? (or -19 becomes 19)
Not answered in the video. Check out this page for details on the various deltas and what they mean.

Q: Can we create our own customized reports?
Answered at 59:49