Discussion Forums

Hello,One of our customer is using a lot of Custom Scripts, where we are monitoring their output by syslog. There is starting a problem, when script stuck or block. Then customer don't know about it. Is there any possibilities how to monitor, If these scripts are working? We have suggestion, that Custom Scripts can send also message like OK or KO. 2 Events will match these both. There should be an action (run book) for script is running like:em7_snippets.generate_alert(xtype = 1, xid=EM7_VALUES['%x'], message = 'script heartbeat')and not running with count like:if EM7_VALUES['%c'] >= 2:    em7_snippets.generate_alert(xtype = 1, xid=EM7_VALUES['%x'], message = 'script is not running')There will be also 2 automation. For script heartbeat will be action for heartbeat every 5min (for example as schedules) and for some Device group.Second automation for not running will have action not running. I think, there will must be next two events which will be matched by

Hello Nexus Community Members,  Have you had a chance to visit our User Groups? Most of our user groups are organized around topic, event, location or audience. They are all pertinent to ScienceLogic Products, Services and Customers. There are varying levels of privacy depending on the audience and content.  Log In to the Nexus Community Click on the User Group you would like to Join Click on the Send Request to Join button  If you think you would like to create and co-manage a user group with us, please message me directly and we can talk about the launch process and how this might benefit the community.  Cheers, Sara   

Hello Nexus Community Members,  We want to continue to welcome new members- we look forward to working with you.  @Pritam  @Wiseman  @AbsoluteBore  @vugale  @IvanP  @Radhika  @John4KBRSL1  @jimco  @KyleTanaka  @Jeff_Kinny  Feel free to share your ideas and feedback so we can get you the most helpful resources and information.   Cheers,   Sara- Community Manager 

Trying to create a DA that alerts when filesystem has x GB left rather than percentage left.This is valuable as setting current thresholds to 99% could still mean there is 100's GB still available, which for big filesystems this is not an issue.This information is available through the host resource oid's and I have created a threshold which is visible on the devices the DA is aligned to. However, this is a threshold for ALL filesystems rather than being able to specify for individual filesystems.Anyone with any ideas on how to get the same behavior as the internal filesystem thresholds where we can specify this threshold on individual filesystems? 

When SL1 sends event to, in our case, using SL PF Incindent Sync to ServiceNow, other systems it quite often includes the sub-id information also in that message. Normally that is also used as correlation ID in ServiceNow. Example here what is seen in SN:So some events utilize other sub-id's than those ootb cpu/mem/disk/etc. We would also use that kind of feature in our own event policies to send numeric (or string) information in that field. But we have not yet found a place where we can control that. So how is that information sent to servicenow. What fields in event message are used for that info?

Hey, I am wondering if there is an API logic to get all devices aligned to a snippet performance dynamic application ? regardless of whether they are collecting any data or not.

There's been a number of times where we have come across customers who have BGP peers that are not in use or sporadically in use, but they do not wish to remove it from their configs.  As a result we get perpetual alerts, but we cannot suppress them as the event suppressed would prevent all bgp peers from alerting.  Anyone have thoughts on some ways to single out peers that can be ignored on a per device level?  Side note: We are using Powerflow and ServiceNow so we can possibly do something in the path as well.  ServiceNow could take care of it, but doesn't help with the peers that flap.

Hi All, I'm new to the Low Code tools/DA builder. I just created a new DA using the DA Builder, and uploaded to my stack. I also have the Low Code Tools Powerpack v101 installed on my system. I'm seeing the following error when I try to run the DA and it seems like I'm possibly just missing some snippet or module and I was wondering if I'm missing something simple:54. Running Snippet 3586 55. Error encountered while executing snippet. Error explanation: App: 3847, Snippet: 3586 threw exception: No module named apps.errors (ImportError: No module named apps.errors File "<string>", line 1, in <module>) 56. Snippet 3586 execution failed. 

I was just using the DA builder and realized that the "Component Identifiers" field doesn't contain "Device Name %N" as a field.

Has anyone run into an issue where a few MAC addresses are being read by the snmp handler `snmp_walk` method as gibberish? Non-MAC address string data is returned on some interfaces that seems to be some form of unicode. This is an example when running the SNMP walk from bash: IP-MIB::ipNetToMediaPhysAddress.2.10.250.123.5 = STRING: 24:2a:4:f0:7a:c7 This is the same OID when read by the python SNMP handler: ('.1.3.6.1.2.1.4.22.1.2.2.10.250.123.5', '$*\x04ðzÇ') I've tested the python2.7 execution environment, and the 3.6 env from the Cisco base pack 214. Thanks! Joe

I want users default page when they login to be a Dashboard in AP2, however, in the user preferences (classic EM7) I cannot see any AP2 Dashboards. Is there a way to force this?

Anybody had any success with this?Going direct to message collectors works as expected. When we put a load balancer in the middle it does not work.As per SL1 documentation, the traffic is being forwarded from the load balancer with the original source IP. However, the source port is different (no mention about that in the documentation) and this is where I think the problem lies as the backend server is sending the tcp acknowledgements back to the source IP but to a different port (the port the LB has forwarded the traffic on).Makes sense that we also need to passthrough the source port being used, but this is not a configuration that has been used before (other apps being managed by the load balancer are mainly https with x-forwarder) and there is a reluctance to configure without evidence that this is correct. Surprising how little information there is out on the internet about configuring LB (unless my googling is not up to scratch :-) )Would be good to know how others have the

Hi All,Do we have any ways under Action Policy by which we can configure so that Parent/Root's IP address can be populated at the time of DB alerts (MSSQL, Oracle etc.) 

Rotation of password by Cyberark and the timespan defined with "CacheRefreshInterval" is causing issues with the polling interval of SL1 DAs.With CyberArk, the SL1 can source credential data from CyberARK. Respecting security policies, Cybersecurity recommends changing of password to the SL1 IDs. CyberARK can only specify a time frame during which the passwords can be changed. Within the collectors on the Cyberark agent setup CacheRefreshInterval is set up with 1500 secs (25 mins) to refresh the local cache with the Cyberark every 25 mins.As Cyberark can change the password at any minute or secs of time, SL1 still waits for CacheRefreshInterval to refresh the password. As polling frequencies are default set with 5 minutes(with password change happening at the 4th minute), often SL1 still reaches the server with old password and cause account lockouts.Is there a known way to tackle this issue?

Hello everyone Thank you!

We're looking at enabling Syslog output to a central repository from PowerFlow at an application level. We've already got this running fine at an OS level and SL1 at an application level.Has anybody setup logging for PowerFlow? We're specifically interested in any login type data and also code changes. I've been through as much doc as I can find on the topic, such as:https://docs.sciencelogic.com/pdf/sciencelogic_powerflow_2-1-1.pdfhttps://docs.docker.com/engine/logging/drivers/syslog/https://support.sciencelogic.com/s/article/10819It doesn't appear straight forward to link log files in /var/log/iservices to their respective Docker services.I'm just looking for validation as much as anything, that Docker level logging of the contentapi and gui processes would be the way forward to capture all relevant security related information, and that all other processes can be ignored.

Is there a way to prevent users seeing all public dashboards, so that the user can only see the dashboards related to their organisation.  The only way I can think at the moment is to make all dashboards private or org assigned.   

How many network adapter is supported. Currently we have migrating between datacenters and due to ACI we cannot have vrf leaking. So we need 3 network adapters to cover all requirements. can someone advice? Currently we have 2  just for info.

“If the server is in a hung state, is there any way we can trigger an event?”

We are planning to upgrade our agents to v146. What are the potential issues in data collection, alerting we might face during the upgrade process. 

Tomorrow we'll be performing the upgraded from Aurora 2 to 3? Any gotchas that you can share? I'm already on 12.1.2-p. Thanks!

Hi - We have a requirement to use TLS 1.3 for syslog on a message collector.  Is there a way to verify TLS 1.3 is supported?   I have configured TLS on a OL7 message collector using this document https://docs.sciencelogic.com/pdf/sciencelogic_sysadmin_12-1-0.pdf and can verify TLS 1.2 is working.  TLS 1.3 is not working on a OL7 collector. Thanks 

Hi All,We have some custom SNMP DA where we are seeing missed polls , the same SNMP oid is working fine with OOB DA without missed polls. There is no network issue.Anyone facing this issue ? 

We are currently facing a scenario where the IP address of our Meraki devices changes upon reboot, which subsequently triggers a DFA alert. To streamline our operations and reduce manual intervention, we are exploring the possibility of capturing these IP changes and updating them automatically in SL.Meraki assets are onboarded through SNMP. 

Call out for content ideas:  What types of content would you find the most interesting in the Nexus Community?  In previous communities I have had good success with shared documents where all members can contribute- Topics included: Favorite Resources- inks to other sites, learning and content)- the limitations are that they are public and no fee is required to access the links.   Tech Tips- working document where members can each add tips that they think help with different stages of working with the product (Implementation, Maintenance etc.  Center of Excellence- working document where members share governance and business practices that help their organizations use this and other technology successfully.  We were hoping you could weigh in on your thoughts about ways you would like to be highlighted in the community and resources you would like to see.  In return we will send some swag to the members with the 5 new ideas with the most likes over