Forum Discussion

jhupka's avatar
jhupka
Icon for Neophyte rankNeophyte
26 days ago

Aggregate data over different time ranges

I have a scenario where I need to monitor the storage utilization on one of the drives for a windows server.  Currently, I'm using the OOTB monitoring (WinVolumeUsage module), and this collects data every 3m.

What I really want is this data summarized in larger time-chunks, and to alert on that view of things.  The disk space on the drive can vary wildly in the short-term, so variations in the 3m data collection results cause alert noise.  What I do know is that if the disk utilization is high at certain times during the day, then there could be a problem (e.g. in-between batch runs, for example)

I'd like to look at larger time windows to see changes - hourly or even just a few times a day - and then alert on those larger time-trends in the storage data.

I've thought of two ways to do this:

1.  Utilize the Aggregate Data collection method for a custom module, but I'm not seeing much for documentation around this collection type. I tried setting it up to give me min/max/avg of the disk instance's utilization over larger time periods, but no data is being collected.  So I couldn't get this to work, and LogicMonitor Support told me I created a custom module, thus they can't assist.

2.  Clone the WinVolumeUsage module, and have its data collection be less often.  While this solves the problem, I feel strange duplicating code/effort like this when I feel data-summarization is the right way to solve this. 

Are there other ways that I could be accomplishing this?

2 Replies

  • orchardl's avatar
    orchardl
    Icon for Neophyte rankNeophyte
    22 days ago

    I end up cloning modules all the time, and yeah it definitely feels like overkill when you have to create a whole new module to do a little thing haha.

    Alternatively, on the resource/group level, have you considered either (a) creating a few scheduled, repeating SDTs that will suppress alerts during the times of day you know the disks will be busy? or (b) modifying the "Alert trigger interval" so it'll only alert you if the problem sticks around for more than x polls? or lastly, (c) maybe create a few new alert thresholds that only apply during certain times of the day? 

    Without knowing the exact situation, I'd likely look at going one of those directions:) 

  • Mike_Rodrigues's avatar
    Mike_Rodrigues
    Icon for Product Manager rankProduct Manager
    22 days ago

    jhupka​ You can override the poll interval on a given DS for just a single resource:

    https://www.logicmonitor.com/support/logicmodules/datasources/creating-managing-datasources/creating-datasources#:~:text=You%20can%20override%20the%20collection,Collector

    Service Insight aggregation is overkill for this use case.

    Cloning modules is less of a headache today considering you can still upgrade them just like you would a core module (when LM releases an update). Not all customizations are preservable but I think collection interval is.