Expert
ProfessorYeah, there are lots of different types of alerts that LM can generate and each are a bit different. You can tell because they also have different starting alert id strings (like LMD, LMA, LMF, etc). It's covered in https://www.logicmonitor.com/support/alerts/about-alerts/type-of-alerts-in-logicmonitor.
You want to review the Alert Tokens Available page and the middle column of the table for which alert type uses those tokens. Like Collector alerts don't have Levels, so it doesn't populate that.
Just like you combine ##HOST## and ##WEBSITE##, perhaps you can try adding something like ##AGENT_DESCRIPTION## in there too. Or I believe you can also have multiple integrations to cover different types of alerts with different payloads. Or just provide everything raw to the integration and let the other end run logic (if supported) to put together messages.
ExpertI took a look but I don't really see much that's going to be useful. Agent_Description will give me the name of the collector, but there's nothing I see for the actual alert reason. I'd like the subject to say something like Collector ## is down. or Collector ## has failed over.
The MESSAGE token has all that information, but it can be super long so putting that as the subject line may not work well. But maybe I'll try it once and see what happens. :)
ExpertThe only token that has anything useful is the ALERTTYPE which just says: agentFailoverAlert. But at least it has the word Failover in it...
The LIMITEDMESSAGE token would be perfect for this, except, of course, that one doesn't exist for failover alerts. It says it does: The first 10 words of the generated message. which would be perfect. In fact, I could use that for just about all alerts but for Datasource alerts is just contains the same information as the VALUE token which seems stupid.
Oh well.
ExpertIs there no EDIT option in the se forums? WTH is up with that? sigh
Anyway, I tried AGENT_DESCRIPTION but that won't work because every alert type uses that so all my subject lines will have the Domain/Servername of the collector that the server uses. That's not needed for normal alerts and just clutters up the subject.
Looks like I may have no option other than creating an Integration just for failover alerts. Argh.
