Forum Discussion

Lewis_Beard's avatar
Lewis_Beard
Icon for Expert rankExpert
14 days ago

Disable Alerting by Instance at Resource Group Level?

I think the answer is "no" here but I promised someone I would ask.

There is some Microsoft update coming that is apparently about to break one Automatic Services instance and make them all start alerting, "System Guard Runtime Monitor Broker". At least that is what I'm told. I know I could make an alert rule to scoop that guy out and send it nowhere, but the user really wants to do the equivalent of toggling alerting off on all those instances manually, so that the alert doesnt show in the UI either. (Apparently the service will still be in the services list in Windows so LM wont delete the instance).

I checked the Resources Folder in the UI, both UIv3 and also UIv4 (sigh). I dont see options, and I know a couple of years ago, I had asked around and got similar answers. There is no instance column or anything where you can put an expression or anything.

But hey, I figured I would ask. Thanks in advance, either way.

  • Mike_Moniz's avatar
    Mike_Moniz
    Icon for Professor rankProfessor
    14 days ago

    "Break" in what way? That it's set to run automatically but shows itself as stopped normally (aka it stops itself). There are several services that already do that (for example Google Update).

    I don't believe LM comes with a build-in check to monitor all autostarting services, but is a commonly created check, but each one might work differently. I'm also not aware of a way you can directly exclude instances at the group level. The general workaround for that issue is to create a special property, something like ##excludedservices##, within the DataSource's filters. You can then set that property at the group level and effectively do what you want.

    But if this is something that is always going to be the case for all devices globall, you can also just directly add the exclusion in the DataSource AD filters without doing properties.

  • Joe_Williams's avatar
    Joe_Williams
    Icon for Professor rankProfessor
    10 days ago

    For your direct question, no that isn't possible currently.
    You have really two options and it looks like you and Mike have touched on them.
    Either do an alert rule to capture them via the instance name and blackhole them, or add a filter into the Datasource itself and drop it.
    Personally I would prefer the alert rule route myself, that way I could verify the update did break the monitoring, but also, after it went into a bad state, I could just ack (if you do that kinda thing) them and then remove the alert rule.