Feature Request - New property to indicate monitoring is disabled | Feature Requests

Feature Request - New property to indicate monitoring is disabled

I have a problem where my users will disable alerting on a resource that has been removed from the environment instead of deleting it. Or they may disable alerting and forget to re-enable it. With alerting disabled, my no-data datapoint alerts never trigger. In the case of removed devices, the resources just hang out there forever and never get removed because they don’t show up on my data collection failures dashboard. Devices for which the user intended to re-enable alerting eventually meet the same fate unless they go down and we don’t know about it. Either of these outcomes is bad news.

It would be nice if there were a property which would indicate that alerting for a resource has been disabled. As far as I am aware, there is currently no way to do this. Then I could create a dynamic group of devices which have monitoring disabled. As devices are populated in the group, I can investigate them. As it stands now, I have to go manually hunt them down.

lroussell

Posted 2 years ago·Last reply 2 years ago

3 comments

LM User

·2 years ago

My longer post is being moderated. In the meantime: https://github.com/sweenig/lm/tree/main/LMAutomation/Alerting%20Status

LM User

·2 years ago

The idea with it being a property is that you could create a dynamic group and either list that group on the dashboard or use a big number widget to show the number of disabled devices?

You could write a propertysource to query the API for the “disableAlerting” attribute on the device and store that as a property:

import javax.crypto.Mac<br/>import javax.crypto.spec.SecretKeySpec<br/>import org.apache.commons.codec.binary.Hex<br/>import com.santaba.agent.groovyapi.http.*<br/>import groovy.json.JsonSlurper<br/>import groovy.json.JsonOutput<br/><br/>accessId = hostProps.get("alerting_status.id")<br/>accessKey = hostProps.get("alerting_status.key")<br/><br/>def lm_get_request(_resourcePath, _queryParams, _accessId = accessId, _accessKey = accessKey) {<br/>    account = ''<br/>    File file = new File('../conf/agent.conf')<br/>    file.text.eachLine{if (it =~ /company=/){ account = it.split('=')[1].trim() }}<br/>    url = "https://" + account + ".logicmonitor.com" + "/santaba/rest"<br/>    httpClient = HTTP.open(account + ".logicmonitor.com", 443)<br/>    headers=calcSignature('GET',_resourcePath,accessKey,accessId) // calcSignature defined below<br/>    headers.put("X-Version", "3")<br/>    response = httpClient.get(url + _resourcePath + _queryParams, headers)<br/>    responseBody = httpClient.getResponseBody()<br/>    try {allResponse = new JsonSlurper().parseText(responseBody)}<br/>    catch (Exception e) {allResponse = responseBody}<br/>    return allResponse<br/>}<br/><br/>def calcSignature(_verb,_resourcePath,_accessKey,_accessId,_data = '') {<br/>    epoch = System.currentTimeMillis()<br/>    requestVars = _verb + epoch + _data + _resourcePath<br/>    hmac = Mac.getInstance("HmacSHA256")<br/>    secret = new SecretKeySpec(_accessKey.getBytes(), "HmacSHA256")<br/>    hmac.init(secret)<br/>    hmac_signed = Hex.encodeHexString(hmac.doFinal(requestVars.getBytes()))<br/>    signature = hmac_signed.bytes.encodeBase64()<br/>    headers = [:]<br/>    headers.put("Authorization" , "LMv1 " + _accessId + ":" + signature + ":" + epoch)<br/>    return headers<br/>}<br/><br/>lm_get_request("/device/devices/${hostProps.get('system.deviceId')}",'?fields=disableAlerting').each{println(it)}<br/>return 0

Create an API token and put in the note that this is for the alerting_status PS.
Take the ID and key and store them as properties on your root with the name alerting_status.id and alerting_status.key, respectively.
Create a propertysource with appliesto of “alerting_status.id && alerting_status.key”
Use the above as the code.
Test it then send it.

It should create a property called “auto.disablealerting” with a value of true or false. YMMV, test in sandbox, with great power, yadda-yadda-yadda. FYI, a value of false means that alerting is not disabled. A value of true means alerting is disabled.

lmsdcr

·2 years ago

Hey @lroussell this would be a good situation to use our Alert Threshold report:

https://www.logicmonitor.com/support/reports/report-types/alert-threshold-report

It will deliver a report on alert thresholds that override the global thresholds and will also report on which resources have alerting disabled.

I hope this helps!

1	SUYASH GAIKWAD
2	NA Nazmeen Ali
3	DK Deepak Kumar
4	PG Phillip Green
5	SS Sean Staats
6	AH Arno haverlach