Alert when Datasources are not present on a device

Sounds doable with a custom DataSource, even sounds like a modification of the Minimal Monitoring check. My first thought would be to take the AppliesTo from your dynamic groups and put that in to the AppliesTo for a custom DataSource. You can then make that DataSource ALWAYS cause an alert. So if a resource matches the AppliesTo it will cause an alert. If the problem is fixed, then the alert goes away.

P.S. Have you look at minimal monitoring itself? It's kinda designed to help cover your concern by checking for resources missing a classification.

13 hours ago, Mike Moniz said:

Sounds doable with a custom DataSource, even sounds like a modification of the Minimal Monitoring check. My first thought would be to take the AppliesTo from your dynamic groups and put that in to the AppliesTo for a custom DataSource. You can then make that DataSource ALWAYS cause an alert. So if a resource matches the AppliesTo it will cause an alert. If the problem is fixed, then the alert goes away.

P.S. Have you look at minimal monitoring itself? It's kinda designed to help cover your concern by checking for resources missing a classification.

 

I see what you are saying with the custom DS that would always be in an alert state if present.  I could use the same applies to that I have setup on my dynamic groups like you mentioned.  Then the DS pops up on the device, alerts and then would be removed upon resolution of the problem.  When the DS is removed would that send an alert clear?   I need a clear sent out to our ServiceNOW integration.  

As for minimal monitoring - I have a dynamic group that's built around the same logic mentioned in that topic but it's just a group.  Didn't know someone had a DS designed around it but now I'm going to take a look at it more.

Appreciate your suggestions!

I'm not 100% but I do believe that removing a DataSource will clear the alert as revoked which will not send a clear to ticketing (really annoying). I'm not sure and suggest you test that. If that is the case then you can likely code equivalent AppliesTo functionality into custom script code with a bit more work and have it return different values instead.

Ah, I've forgotten how minimal monitoring originally worked. I think I ended up making it into a DataSource a while back using the process we are talking about. I only use it when onboarding new customers which has ticket creation blocked so I don't run into the revoke thing.

We do that too.  Just black hole the alerts to go nowhere then when the client is ready remove them from the alert rule.  I will definitely test out the clear state when I have some time.  

On 3/6/2019 at 10:01 AM, Mike Moniz said:

I'm not 100% but I do believe that removing a DataSource will clear the alert as revoked which will not send a clear to ticketing (really annoying). I'm not sure and suggest you test that. If that is the case then you can likely code equivalent AppliesTo functionality into custom script code with a bit more work and have it return different values instead.

Ah, I've forgotten how minimal monitoring originally worked. I think I ended up making it into a DataSource a while back using the process we are talking about. I only use it when onboarding new customers which has ticket creation blocked so I don't run into the revoke thing.

Tested this today and have it working perfectly except I'm not getting a clear update sent to my ticket.  Time to dig in a bit more.

Yeah, I expected as much. There are a few situations, typically when an alert clears by removal of the source of the alert or if the device/instance is in SDT. You might have to code the AppliesTo equivalent into a script that returns 0 or 1 for example.

Are you using the official LogicMonitor ServiceNow store app for your integration? We don't since it didn't exist at the time of our implementation, but I was wondering if it worked around the revoked clear issues. Thanks!

Yes we are using the official integration from the app store.