Cisco Umbrella Virtual Appliance Datasource and Proprtysource
Update: I jumped the gun…they aren’t out of security review yet…will update once they are... I have shared a datasource and propertysource I’ve created for monitoring the health of Cisco Umbrella Virtual Appliances in my environment. Thought they could help out other that might be using them as well.
AutoProperties for Cloud resources
I need to be able to create AutoProperties on Cloud Resources, which don’t require interacting with the Cloud Resource itself. This pageindicates that you cannot apply AutoProperties to cloud devices unless monitoring is enabled via a local Collector. Could this requirement be relaxed?
DataSources_List PropertySource
(Edit, October 2020 - see later comment below for a version that does all this without needing an API call) Q: What does it do? A: Calls the LogicMonitor API and finds, for each applicable device, a list of DataSource Names that exist on the Device, i.e. have at least one instance. This also includes ConfigSources active on the Device. These are put together as a semicolon-seperated list in the property auto.activedatasources: Q: Why? I can just look at the Device in the Device tree. A: You can, but... This PropertySource means you can create Dynamic Groups and Device Inventory Reports based on the presence or absence of *any* combination of DataSources on Devices. Q: Can you give me a real-world example of this being useful? A: Yes. On a MicrosoftSQL server, LogicMonitor will find the SQL Services via WMI, but the actual SQL Server metrics are found via Perfmon or JDBC methods. If we can't access Perfmon or JDBC for any reason (required services not running, lack of credentials, etc) we'll be missing the SQL stats but quite probably getting all the other Windows metrics (via WMI). This can be very difficult to spot if you have one affected SQL server out of 1,000. With this PropertySource running, you could create a Dynamic Group with a custom query of: auto.ActiveDataSources =~ "WinSQLServices-" && auto.ActiveDataSources !~ "WinSQLServer-"&& auto.ActiveDataSources !~ "WinSQLServer_JDBC-" This will list all the devices on which we've found SQL Services but have failed to find any SQL metrics. Similarly Exchange Services are discovered via WMI, whilst most Exchange metrics come from Perfmon. Or, maybe you want to create a Group to contain all your Linux servers that are running Apache web server andMySQL: isLinux() &&auto.ActiveDataSources =~ "Apache-" &&auto.ActiveDataSources =~ "Mysql-" You will need: A REST API Access ID and Access Key for a user with permissions to at least view all Devices within the account (or all Devices in whichever Groups you wish to consider). These should be set as properties 'apiaccessid.key' and 'apiaccesskey.key' within the Devices tree (generallythe root level,or a Group level if appropriate). The PropertySource will use these to find the list of DataSources present onthe Device, and create theauto.activedatasources property for all devices. auto.activedatasources will have one of two error messages if the required API details are not present or do not give sufficient access to query the Device; this could of course also be used to create Dynamic Groups and in Device Inventory Reports. Note that DataSources are listed by their (unique) 'Name' rather than their (not necessarily unique) 'Displayed As' string seen in the Device tree. v1.0.0:ZLTDWM Current limitations: The auto.property fields are limited to 2,000 characters, so if the list of DataSource Names exceeds this size, the data will be truncated. This is likely to be an edge case only seen on test Devices with multiple custom DataSources applied. Auto Properties are updated daily or when Active Discovery is run for a Device, so there may (will!) be a time lag between DataSources being applied to a Device and those DataSources appearing in this auto.activedatasources property list.
Use a Property Source to find dead devices
This is a PropertySourcewhich runs with active discovery and adds the property auto.lmstatus to the device properties with the current Hoststatus value. It does this using the REST API and It works great with Dynamic grouping, for example if you wanted to know which device in your portal were currently in a dead status you could create a dynamic group with the applies to of “auto.lmstatus=="dead". One advantage to using a property source is if the device comes back on-line, Active Discovery will immediately run and change the property to "normal" removing the device from the group. A copy of the PropertySource is at the bottom of the post. Let’s walk through the groovy script. Define the account information This is polling the device properties. I recommend setting this at the group level so they are inherited to the devices. an example of the properties would be api.user =5kCPqLgY4DGYP27uw2hc api.pass =ye[$3y7)_4g6L6uH2TC72k{V6HBUf]Ys+9!vB)[9 *note, any property with .pass in the name will not have visible data. api.account = lmjeffwoeber //Account Info def accessId = hostProps.get("api.user"); def accessKey = hostProps.get("api.pass"); def account = hostProps.get("api.account"); Define the Query. We just need the HostSatatus for the device the script is running on. def queryParams = '?fields=hostStatus&filter=displayName:'+hostName; def resourcePath = "/device/devices" Next we build the URL for the API. def url = "https://" + account + ".logicmonitor.com" + "/santaba/rest" + resourcePath + queryParams; This next part builds the security and runs the API. It can pretty much be copy\pasted into any groovy scripts that use the REST API. //get current time epoch = System.currentTimeMillis(); //calculate signature requestVars = "GET" + epoch + resourcePath; hmac = Mac.getInstance("HmacSHA256"); secret = new SecretKeySpec(accessKey.getBytes(), "HmacSHA256"); hmac.init(secret); hmac_signed = Hex.encodeHexString(hmac.doFinal(requestVars.getBytes())); signature = hmac_signed.bytes.encodeBase64(); // HTTP Get CloseableHttpClient httpclient = HttpClients.createDefault(); httpGet = new HttpGet(url); httpGet.addHeader("Authorization" , "LMv1 " + accessId + ":" + signature + ":" + epoch); response = httpclient.execute(httpGet); responseBody = EntityUtils.toString(response.getEntity()); code = response.getStatusLine().getStatusCode(); The API will return a JSON payload. We use the Groovy Slurper to transfer the payload to respose_obj were we can use the data. // user groovy slurper json_slurper = new JsonSlurper(); response_obj = json_slurper.parseText(responseBody); They JSON will look like data=[total:1, items:[[hostStatus:dead]] We can use the value with response_obj.data.items[0].hostStatus.value Now we print the Key=Value for the property source //print output println "LMStatus=" +response_obj.data.items[0].hostStatus.value; httpclient.close(); This will add the property source "auto.lmstatus" to the device finally we return 0 do indicate a success. return (0); This is how the PropertySource will appear on the device Lastly, we can create Dynamic Groups based off the Hostatus. For example use an applies to auto.lmstatus=="dead" to group all of the dead devices into one group, or auto.lmstatus=~"dead" to also include Dead-Collector LMStatus PropertySource import org.apache.http.HttpEntity import org.apache.http.client.methods.CloseableHttpResponse import org.apache.http.client.methods.HttpGet import org.apache.http.impl.client.CloseableHttpClient import org.apache.http.impl.client.HttpClients import org.apache.http.util.EntityUtils import javax.crypto.Mac; import javax.crypto.spec.SecretKeySpec; import org.apache.commons.codec.binary.Hex;import com.santaba.agent.groovyapi.http.*; import groovy.json.JsonSlurper; def hostName = hostProps.get("system.displayname"); //Account Info def accessId = hostProps.get("api.user"); def accessKey = hostProps.get("api.pass"); def account = hostProps.get("api.account"); data = '' def queryParams = '?fields=hostStatus&filter=displayName:'+hostName; def resourcePath = "/device/devices" def url = "https://" + account + ".logicmonitor.com" + "/santaba/rest" + resourcePath + queryParams; //get current time epoch = System.currentTimeMillis(); //calculate signature requestVars = "GET" + epoch + resourcePath; hmac = Mac.getInstance("HmacSHA256"); secret = new SecretKeySpec(accessKey.getBytes(), "HmacSHA256"); hmac.init(secret); hmac_signed = Hex.encodeHexString(hmac.doFinal(requestVars.getBytes())); signature = hmac_signed.bytes.encodeBase64(); // HTTP Get CloseableHttpClient httpclient = HttpClients.createDefault(); httpGet = new HttpGet(url); httpGet.addHeader("Authorization" , "LMv1 " + accessId + ":" + signature + ":" + epoch); response = httpclient.execute(httpGet); responseBody = EntityUtils.toString(response.getEntity()); code = response.getStatusLine().getStatusCode(); // user groovy slurper json_slurper = new JsonSlurper(); response_obj = json_slurper.parseText(responseBody); //print output println "LMStatus=" +response_obj.data.items[0].hostStatus.value; httpclient.close(); return (0);
Easier way of disabling Property Sources for device(s)
It would be nice to have a easier way to disable/manageProperty Sources (just like we have for DataSources - at a group level, devicelevel, etc...). I know we can disable those in the 'AppliesTo' field (at the PropertySource level) and/or we can createa custom property (& then having devices automatically assigned to a dynamic group by using that property, etc...). However, we shouldn't require to create extra properties and/or modify the 'AppliesTo' with extra stuff. It would be way easier having the possibility to do this like we do for the DataSources (even in terms of management, understanding what's applied vs. what isn't). Not sure if this was suggested in the past but, it would be a great improvement in my opinion. Regards,PaloAlto 'apikey' PropertySource
Hello! I've created a property source (PS script) that will retrieve/populate automatically the 'paloalto.apikey.pass' property withinPalo Alto firewalls (since a bunch of datasources require that key). This will be easier than retrieving the api key manually & then createthe custom propertyfor each firewall. this will makeuse of the ssh credentials & also requires aLM apikey in order to actually PATCH the device in question. Sharing this with everyone in case it is useful for you guys as well. I've tried to publish it in LM Exchange but I'm retrieving theerror below: I'm new to LM so, excuse me if I'm being noob &missing an obvious thing? Shared the PS script within GitHub ->https://github.com/vitor7santos/LogicMonitor.git Feel free to use it & let me know your comments/suggestions/etc... Regards,