Forum Discussion

Joe_Williams's avatar
Joe_Williams
Icon for Professor rankProfessor
2 years ago
Solved

Ideas to maintain thresholds across thousands of devices and even more instances.

I have an ask to standardize some thresholds based on device type. We break out folders out like so: Clients/CLIENTID/Location/Techstack We then have roll up folders under each client for reporting...
alerts
api
thresholds
  • JJumpp's avatar
    JJumpp
    2 years ago

    I understand.  
    Typically, the deepest folder would control the threshold, since that threshold would be “closer” to the device. I think of the threshold inheritance a little like group policies, where the last one that is applied is the one that takes effect, so the closest to the device( or deeper in the resource tree) is the winner. 

    However, if a threshold is set somewhere in the clients tree (Clients/ACMECO/Chicago/Firewalls) and a more ‘global’ threshold set at a higher level group (Thresholds/Firewalls) then the one at the customer level will still win. 
    If two groups that have thresholds configured and are at the same level of the device hierarchy, then the group that was created first wins.  This can be determined by lowest group id.
    https://www.logicmonitor.com/support/alerts/about-alerts/tuning-alert-thresholds#

    When looking at a specific device, you should also be able to see what threshold is applied to a datapoint and from where/what group on the alert tuning tab.

    Is the goal to override anything set at deeper customer levels, or to make sure those deeper level threshold are maintained?

JJumpp's avatar
JJumpp
Icon for LM Champion rankLM Champion
2 years ago

Hi Joe, 

Setting a threshold at a group folder level would really be ideal.  It eliminates the effect on other devices since you aren't setting it at the datasource, and gives you more control to set different thresholds for different customers if you need to adjust it down the line. 

It also makes it easier to manage the thresholds at group levels, than having to reach out and touch each device individually.  However, if the threshold is going to be set at the same value across all customers, then an additional dynamic group that covers all devices would be ideal.  You would end up with a single place/group to manage thresholds changes.  

LM users will often build out a separate group structure that is specifically to manage something like credentials or thresholds, so future management/manipulation is limited to that one tree, and therefore is less likely to conflict with another property value set somewhere else in the resource hierarchy.  
For your situation, you may have a top level group that is “Thresholds” and dynamic groups underneath for different device types, like “Switches” or “Firewalls” and all threshold manipulation is done there, but all the other groups are still used for things like RBAC, dashboard organization, etc.  

Do you think a strategy like this would work for you and your team?
If not, can you explain a little more about what kinds of thresholds you have deeper in your folder structure?