LinuxNewProcesses DataSource -- Auto discovery and key off of HOST-RESOURCES-MIB::hrSWRunName
Hello all! I just wanted to share my edits. I never could get LinuxNewProcesses to work for my needs.. but we really wanted it to also have auto discovery and automatically add a list of toolsets that we have deployed across the board. I did this LONG ago and my wildvalue was the PID… but that’s dangerous and I ended up creating thousands of entries in the LM database because my processes (thousands of them) were always changing. . . .this takes a different approach and keys off of the process name. #1 You just need to have a property defined with a comma separated list These names need to be from “HOST-RESOURCES-MIB::hrSWRunName” #2 My polling is every minute but don’t alert unless it’s been down for an hour… for my scenario, I do this on purpose because some of my applications run for about 5 minutes and then aren’t kicked off again for another 10… so adjust as needed :) The status is under a security review right now.. I’ll post the lmLocator if it makes it! Otherwise here’s the autodiscovery.. the collection script wont’ work and you’ll have to modify it import com.santaba.agent.groovyapi.snmp.Snmp; def OID_NAME = ".1.3.6.1.2.1.25.4.2.1.2"; def host = hostProps.get("system.hostname"); def services = hostProps.get("linux.services").split(','); Map<String, String> result = Snmp.walkAsMap(host, OID_NAME, null) result.forEach({ index,value->index = index; value = value; for (service in services) { if (value ==~ /${service}/) { def CMD_OID = ".1.3.6.1.2.1.25.4.2.1.4." + index; def service_cmd = Snmp.get(host, CMD_OID); def desc = index + " | " + service_cmd; out.println value + "##" + value + "##" + desc } } }) Script: Line 89: if ("${name}" == "${processPath}") {
Monitoring folders on Windows servers
I was recently asked by a customer if it was possible to monitor the size of a folder or the file count in a folder on a Windows server. Well there sure is, <whistles> YO UNC Monitor- come on down. UNC Monitor- is part of the Core DS, the DSs that are installed by default when LogicMonitor is first deployed. As seen on the UNC Monitor Description section: Great, there is a way to do this. Ok how do I do this? Hmm? Well looking at the next section of the DS, Technical Notes. Add an instance manually, oooohh k. But how do I perform this specific voodoo? Hmm maybe if I look further down on the DS? Ok there is the Groovy Script, what do I get when I run the Test Script? Ok so I do have 5 folders that contain 41 files using a total of 7,013 KB. Great that’s some info but still not what I need for a path and I still don’t know how to “add the instance manually” Maybe there is some documentation on how to do this? Oh yeah it’s right here Step 2 states “click the down arrow icon button located next to the manage button for that device. From this dropdown menu, select “Add Other Monitoring” So now I know the steps I need to take and I know that there are folders that are shared. How do I know what the shared folders are without having to log onto the server? That’s where the debug facility comes in for help. The easiest way to access debug is open any raw data screen and click on debug You will be presented with all the available commands. To assist in finding the available folder shared we will be using !wmi If you aren’t familiar with any command just type the command and you will be presented with information. In this case I want to show the shared folders on this server. With a bit of knowledge on Win32 Classes we can find this info. I’ll cover Win32 Classes in another post. Now I have everything I need to get this folder monitored through UNC, RIGHT?!? RIGHT?!? I’m looking at the device and there is no DS for UNC showing How do I add it manually if I don’t have DS ugggh. Since I have my handy dandy info from the documentation I know I need to: Once you click on that you get Add a name as you want it to show up on the instance list. Then you can add a path from the list that was obtained through leveraging the debug facility. Once both of those are filled in, hit save twice and tada you get And more importantly you now have alert tuning that you can perform on this specific UNC driveOracle jdbc JAR file update
LogicMonitor's collector utilizes an outdated version of the Oracle JDBC jar file. It's essential to upgrade to the most recent version available in the Maven repository to take advantage of new secure database connection types. However, users should note a significant change in behavior with the new jar: while the old version automatically closed abandoned Oracle database connections, the new version does not, potentially leading to an excessive number of open connections. This surge in open connections can overload and crash an Oracle server where connections aren’t limited by user. Therefore, clients must either ensure that customizations explicitly close database connections or adjust their server settings to impose limits on the number of concurrent open connections. All of the newest Logicmonitor datasources properly close connections but some of the older modules did not do this. Logicmonitor has created a module to test for this problem and alert if it occurs. Oracle_Database_MonitorUser will keep track of the number of connections in use by the monitoring user and alert if the number of connections is too high. This update is scheduled for collector 35.400. Make sure this module is installed before upgrading to collect 35.400 and monitor your database connections before rolling this out to general release.
A DataSource to Troubleshoot ERI Merging
One of the most common behaviours noticed in topology maps is ERI Merging. This is caused when two or more devices share the same identifier (ERI). The example I always like to give when I’m teaching Topology Mapping is the word “football”. To a European like myself this is a game played with your feet, however in other parts of the world this is an altogether different game. Now let’s imagine we have a Topology Map connecting various sports together; what would show up if the map connects “football” to “basketball” - would it be the kicking game or the throwing game? Well, in LogicMonitor, it would be effectively indeterministic to tell. The two games would merge into a single object in the map (they merge into one of the resources at “random”). A key indicator of merging is one device showing as another device in the topology map. Luckily, there are a few out of the box ways to overcome this merging - the topo.blacklist and topo.namespace properties. If you’re interested in finding out more about merging how these are used, I have created a LearningByte which you can watch for free in LM Academy here - you will need a free Academy account created first. https://academy.logicmonitor.com/topology-mapping-toponamespace-topoblacklist/1329206 In order to use the blacklist property, you must know which ERIs are being merged. This can be discovered in the UI through a manual comparison of ERIs between resources (you can export to excel and process there if you’d like), however this can be a cumbersome process and doesn’t reveal how many resources are merged. That’s where my new ERIMergeTroubleshooter comes in. Using the LogicMonitor API to run the !erimergelist and !erimergedetail collector debug commands, it creates one instance for each merged ERI and a subsequent instance level property listing which other resources merge with that ERI. For example, we can see that this “Router” resource has merged with a “Server” resource. Applying the troubleshooter DataSource, it immediately reveals which particular ERI has merged, and which resource it has merged with (this is a trivial example, although most situations are often more complex). If you’d like to try out this custom Logicmodule, it can be imported now from the LMExchange (locator: F26PEJ); it will be great to hear some feedback from real world testing! Caveats: By default, this applies to all resources in the portal, so users should modify the appliesto if they require testing on specific devices only The module has not been tested against or developed for chained ERI merging API credentials are to be added as device properties based on the technical notes Thanks!