Detecting when aresource is deleted
I would like to be able when a device is deleted send an email with all the important properties such as make,model and serial, ip address etc in a email to our change team before the device is removed. I have a report that filters the logs for deletes but this is after the fact. I want to generate the email at the point of deletion.
Any ideas?
Peter Hakesley
Posted 3 weeks ago · Edited 3 weeks ago·Last reply 3 weeks ago
2 comments
Andrew Berger
·3 weeks agoI don't believe LogicMonitor has a native mechanism to trigger an action before a resource is deleted. Once the resource is removed, the audit log can show the deletion event, but by that point the resource information may no longer be available for notification purposes.
A controlled deletion workflow would be the most reliable approach. Access to delete resources could be restricted by limiting the "Manage" permission to an automation service account or a small group of administrators.
The workflow could use the LogicMonitor REST API to retrieve the resource details, send the required notification to the change team, and then delete the resource. Ansible, Powershell, or another automation platform could orchestrate those steps.
Larsen Orchard
·3 weeks agoHi there. I think there's a lot of hope that one day LogicMonitor will create better reporting, but currently I don't see any way to get recently deleted device data from a built-in report. However, if you you want to figure out deltas with LM's API, I think that could work for you. Here's the documentation on it:
https://www.logicmonitor.com/support/delta-support-for-device-devices-api
You'd need some kind of 3rd party automation/scheduling tool (like cron/postman) to run create the delta, then check the previous delta for changes and send the data with an email.