Forum Discussion

Kelemvor's avatar
Kelemvor
Icon for Expert rankExpert
2 months ago

Collector Failover alerts don't seem to use the normal Tokens?!

Hi,

We have integrations configured with Zendesk.  Our Active integration looks like this:

This generally gets us a subject line in our tickets that looks something like this:

However, we had a collector reboot last night, and the resources failed over to a different one.  The ticket we got from that looked like this:

Notice the only thing in the subject line is a dash and the word since.  None of the normal tokens populated like they're supposed to.

Does anyone know if when a collector fails over it doesn't use the standard tokens that all other alerts use?  Are there different tokens that get used instead?  Can I manually specify different settings just for failover notices instead of normal alert?

The  MESSAGE token worked, but none of the individual tokens did.  Obviously getting a ticket with nothing in the subject line isn't help so we need to figure out how to make it work properly.

Thanks.

5 Replies

Sort By
  • Mike_Moniz's avatar
    Mike_Moniz
    Icon for Professor rankProfessor
    2 months ago

    Yeah, there are lots of different types of alerts that LM can generate and each are a bit different. You can tell because they also have different starting alert id strings (like LMD, LMA, LMF, etc). It's covered in https://www.logicmonitor.com/support/alerts/about-alerts/type-of-alerts-in-logicmonitor.

    You want to review the Alert Tokens Available page and the middle column of the table for which alert type uses those tokens. Like Collector alerts don't have Levels, so it doesn't populate that.

    Just like you combine ##HOST## and ##WEBSITE##, perhaps you can try adding something like ##AGENT_DESCRIPTION## in there too. Or I believe you can also have multiple integrations to cover different types of alerts with different payloads. Or just provide everything raw to the integration and let the other end run logic (if supported) to put together messages.

    • Kelemvor's avatar
      Kelemvor
      Icon for Expert rankExpert
      2 months ago

      I took a look but I don't really see much that's going to be useful.  Agent_Description will give me the name of the collector, but there's nothing I see for the actual alert reason.  I'd like the subject to say something like Collector ## is down.  or Collector ## has failed over.

      The MESSAGE token has all that information, but it can be super long so putting that as the subject line may not work well.  But maybe I'll try it once and see what happens. :)

      • Kelemvor's avatar
        Kelemvor
        Icon for Expert rankExpert
        2 months ago

        The only token that has anything useful is the ALERTTYPE which just says: agentFailoverAlert.  But at least it has the word Failover in it...

        The LIMITEDMESSAGE token would be perfect for this, except, of course, that one doesn't exist for failover alerts.  It says it does: The first 10 words of the generated message. which would be perfect.  In fact, I could use that for just about all alerts but for Datasource alerts is just contains the same information as the VALUE token which seems stupid.

        Oh well.

  • Kelemvor's avatar
    Kelemvor
    Icon for Expert rankExpert
    2 months ago

    Yeah, I noticed they were LMF, which I"m guessing the F is for Failover.  I'll try to piece something together   I don't really want to have to create separate integrations just for failovers, so hopefully I can find some tokens like Host and Website that are either/or.

    Thanks.