NeophyteWhat is the best way to stop LogicMonitor from monitoring SQL instances? We've restricted the Service Accounts access to our DBs but now we are getting SQL/Windows Authentication bad logon attempts in our DB logs. Our goal now is to simply monitor the OS where our DBs run and use other tools our team is more familiar with for DB monitoring.
Any advice is much appreciated!
ProfessorYou can also look at breaking LM's auto detection of MSSQL by disabling the PropertySources that apply the MSSQL category like addCategory_MSSQL (there might be more). You will need to manually cleanup any existing MSSQL devices to remove existing MSSQL categories. But doing that then let you selectively add the MSSQL category manually if you have a few servers you do want to monitor later. This is likely less important for businesses but super useful for MSPs.
You'd need to figure out which tasks are running that are attempting to log into the SQL instance. This can be done through the collector debug console looking at the output of !tlist and !adlist (and maybe !aplist). You can filter by host on all these commands so that you can see which tasks are hitting the server. Then note the LogicModule name. Go to the LogicModule and adjust the AppliesTo so that it doesn't evaluate to true. The nuclear option is to add " && false()" to the AppliesTo, which turns off the LogicModule entirely. Alternatively, you can put a property into the expression and require that property exist on any devices you do want to monitor, effectively shutting down the LogicModule.
NeophyteLooks like the following DataSources must be set to "false" for the service account to stop polling the SQL instances:
