ScienceLogic AI Platform

Hi, I have a question about the GQL updateEvent mutation. I'm trying to use it to change the severity of an existing event, but I'm getting a Bad Request response when executing the mutation:mutation changeEvent($eventId: ID!, $severity: String) {  updateEvent(id: $eventId, severity: $severity) {    id  }} Is changing the event severity supported with this mutation? If it is, could you let me know how the severity value should be provided?Thanks!

For powershell devices, when a device is first discovered, the cred used to added into this cred keys table, and then nightly discovery will also use that cred. You can also add a second cred from the properties page. The issue i found is that if you change creds, for whatever reason the cred key table doesn’t get updated. We have created a DA which dynamically aligns DAs using ‘from sl_credentials.constants import CRED_POWERSHELL’ to pull the credentials. because its not updated the DA doesn’t work Is there a way to pull the credential for a powershell device more dynamically, also, i think the nightly discovery also uses the same, so I think that it would also fail?Or is there a process which updates the table? 

The vEdge Container availability check does not currently validate vManage REST API availability. Because of this limitation, the vEdge Container can remain available even when API-dependent vEdge devices, which are child components under the vEdge Container, are impacted. This prevents topology-based event suppression from working as expected and can result in multiple child component availability alerts for a single API-related outage.Proposed Enhancement: -Enhance the vEdge Container availability logic by adding an availability check via the vManage REST API. If the API is unavailable, the vEdge Container should also fail the availability check and move to an unavailable state.Expected Behavior: -When the vManage REST API is unavailable, the vEdge Container should fail its availability check. The vEdge Container should be marked as unavailable before the child vEdge devices generate individual availability alerts. Topology-based event suppression should suppress availability alerts

Hello Team,There is a requirement coming from our client to monitor all the certificates configured on v-centersThe certificate includes Machine SSL, trusted root certificate,Below are the some sample certificates which is required to be monitored. 

As of now topology for CPD,LLDP,L2 and L3  Skylar one doesn't detect parent and child correctly for some devices ,during these case users must have the option to interchange the connection in relationship tab or map . And the database crunch process  should not revert the direction back as well.

Current Situation / Problem StatementDuring a recent vulnerability assessment of the ScienceLogic SL1 platform, the security team identified finding FND-295942 – Unsafe Third-Party Link (target="_blank" without noopener/noreferrer).The assessment found that certain links within the SL1 web application open external pages in a new browser tab or window using the target="_blank" attribute without implementing the recommended security controls rel="noopener noreferrer".This behavior may allow the newly opened page to access the originating window through the browser's window.opener functionality, creating a potential security risk and resulting in repeated vulnerability findings during security scans.Proposed SolutionUpdate all SL1 web application hyperlinks that use target="_blank" to include: Additionally:Review all external and third-party links across the SL1 UI. Implement secure coding standards for future development. Include the validation of noopener and noreferrer attributes as p

Hi All.Are there any who have have success with having a Dynamic Device group added to an User initiated Action?Our setup requires that we have auto discovery on new servers as we enroll up to 10 new servers pr week.So they all need to be added automatic to safe time.But I have 1 action that with Device Group cant be found under tools. Only If I select specific devices. 

We use the Dynamic App inspector report to find devices that have fallen out of monitoring for a long period of time, which is mostly due to an issue on the device. Any device that has an object with this would be one we’d need to look into:Found = YES / Collect = NO The trouble we have is that there is too much data that doesn’t require attention. For example SQL clusters, where Databases have moved to a secondary, but the DBs are still present on the primary but you cant read them, so this generates a YES found NO collect. And other DAs, where features are not enabled, but the DAs will align, like DB mirroring which can be disabled. Azure is a big one, where subscriptions are not including certain data sets, but the DA still attempts, and you end up with a YES found and NO collect. With so many devices, under Azure, ACI, Netapp for example, this data set is massive hard to find what is truly an issue sometimes.  I’m looking to see if there is a better way to manage the YES/NO devices

I am just browsing through release notes of latest Skylar 12.5.* and found out some interesting issues like ---In the Skylar One user interface, the End User License Agreement (EULA) page is displayed on allpages that were iframed from the classic user interface, even after the user agrees to the EULA. Thisissue is occurring for ADFS, CAC, and AD authentication methods. (Jira ID: EM-67851)--Ok that sounds pretty nasty for users. So I sent a question directly to SL people and learnt that this was an issue in AP2 Gelato, fixed in Ice-Pop, and this known issue has been on the list at list from 12.5.8 to 12.5.22. I then checked some other issues also and also them were closed already internally. So the discussion here should be like where could we get updated known issues list for each release version, hopefully on a table format which clearly explains which version has that issue and in which version it is fixed or is it actually still an issue. For example that EULA issue is not listed o

I have created a low-code tools DA that is set to run a snippet of powershell. It is a multi-line powershell script that has been tested on a live server and returns the results we’re looking for, however it seems to break when I put it into the low-code snippet window.It seems to be erroring out due to syntax of the script, I’m wondering if there is a way to enter a multi-line script into low-code tools that I am missing? (for a similar example, in curl you surround a multi-line script in 3 quotes)Here’s an example of the beginning of the script:low_code:  version: 2  steps:    - powershell:        command: $Domain = "#####"$Limit  = 120 try {    # Find one Domain Controller    $DC = (Resolve-DnsName "_ldap._tcp.dc._msdcs.$Domain" -Type SRV -ErrorAction Stop |           Select-Object -First 1 -ExpandProperty NameTarget).TrimEnd('.') 

I am looking to determine missing items not available in the New Interface (AP2).  We recently updated our Development Environment to 12.5.21 and found that they are deprecating the Events tab in the text of the tab and on the page they placed a URL link to AP2.   Thus for us to use 12.5.21 we will be forced to move to AP2.  Thus I need to do a gap analysis between the two interfaces.1. AP2 dashboards do not have the ability be secured using access keys and only support Private, Public, or Organizations A user in Classic can login and be presented with a Classic dashboard only..  This is not possible in 12.5.21

Using version 104 of the Power Pack in Linux queues other than the Transmission and Dead Letter queues have to be listed within the snippet. In a large account with 100’s of queues this is really not feasible to maintain.  Other queues should have the ability to be added by type such as Local Queues or by using wild cards or Regex in the snippet.

Hi All,Someone internally has requested that we create some custom Linux/Docker service monitoring. We have the exact shell command that we need to run to get the data we’re looking to alert on. I was going to create a custom Dynamic Application that uses Python to initiate an SSH connection using our standard credential and run the command.Question here: Does anyone have any experience using ScienceLogic’s built-in SSH python library? I searched the support site for documentation, but no luck. I also tried to open a handful of the out of the box DAs, but the actual SSH Connection is compiled in the library as far as I can tell. Otherwise my trusty Claude has recommended that I use the Paramiko library, which is also a possibility. Anyone have any recommendations?

It has been observed that SNMP credentials (such as community strings, SNMPv3 authentication/privacy keys, and SSH credentials) are retrievable in a readable format through authenticated API access.This behavior represents a significant security vulnerability, as sensitive credentials should never be exposed in plaintext. If the exposed credentials have Read-Write privileges, an attacker who gains API access could potentially modify device configurations, disrupt services, or compromise the integrity of managed systems.As a security best practice, all sensitive credentials should be encrypted at rest and should not be retrievable in a user-readable format through any API response. Where credential validation is required, mechanisms such as secure storage, tokenization, hashing (where applicable), or masked values should be implemented instead of returning the actual credentials.We recommend remediating this issue by ensuring that sensitive credentials are securely encrypted and inacces

We have been dealing with unknown behavior in our ScienceLogic Environment, and we would like to explain point wise to keep it clean.Application Team has reported us that File system Unavailable events are landing in their SNOW queue in the form of ticket. We have investigated and File System unavailable major events have been triggered. Furthermore, we have navigated into Registry » Hardware » searched with specific server name to find out reported File System have been discovered or not. We have found that those are not discovered and when connected back to the application team. we have got two types of inputs. 1st » multiple File System unavailable event are trigger for user profile for example /home/baljeets [whenever user log into Solaris Server. there profile will be created and once they logoff from the server FS related to their profile will be unmounted and ScienceLogic triggers major] 2nd » backup job will be triggering time to time and once the backup job is complete. same k

Hi to all, we configured a Global Manager in our QA env for 2 stacks but there is something that it's not really clear to me.The global manager is not capable to manage PP on the stacks (in AP2 UI there is any menu entry for PP), is not capable to retrieve device groups defined on the stacks, is not capable to retrieve device class from the stack, is not possible create device groups and add devices monitored by the stacks.My first question is: how can we create a dashboard that can filter panels based on custom device group?

Hello Community,We have a requirement to automatically discover newly created queues within an already monitored IBM MQ Queue Manager.Currently, when a new queue is created, the queue name must be manually added to the discovery snippet before SL1 can discover and monitor it. In environments where queues are created frequently, this creates additional operational overhead and increases the risk of queues not being monitored until manual intervention occurs.Requested EnhancementAutomatically discover newly created queues under monitored Queue Managers. Detect new queues during scheduled discovery/re-discovery cycles. Automatically create queue components and apply existing monitoring policies. Support include/exclude patterns to control which queues are monitored. Eliminate the need to update discovery snippets whenever queues are added.Use CaseOur MQ environment is dynamic, and new application queues are introduced regularly. Having to manually maintain queue names in the discovery con

Hi Team,  We need to have flexible options in behavior page to select as per our need . We need to have all the above four option as a drop down box in behavior page to selection as per our wish, as of now it is limited only to Collection and processing Enabled . 

I am looking for advice/help on monitoring Cisco Nexus 9000 Series switches.  The metrics the business is asking to monitor are: Metric   CPU Utilization   Memory Utilization   Device reload Alert   Interface errors (ifInErrors and ifOutErrors) (CRC, FCS)   Interface Discards ( ifInDiscards and ifOutDiscards)   Interface status   Utilization Bandwidth   PSU status   Fans   BGP/OSPF status   SNMP availability   TCAM Utilization monitoring (working to get MIB/OID from Cisco)   MAC Table Exhaustion  

We would like to get an update for following disclaimer for on Linux Base Pack v114. Reason being, it has been almost 5 months, and it has not been update on SL Support Portal ** We are currently reviewing a potential performance-related issue that we have identified internally with Linux Base Pack v114. We will provide an update on next steps once our evaluation is complete. **

I recently created a Runbook Automation/Action whose job it is to set newly discovered components to a different Organization. It triggers off the “Component Device Discovered” Event Policy.I ran into a handful of the following errors when a group of Aruba APs was added to Central around the same time:Snippet (723) failed to execute with exception: Failed to acquire lock /tmp/envmanlock-83EF68E00F35226911E02C49561FADFA within 60 secondsResult:NoneThis particular Aruba environment is known for how big it is, so there could be some issue with volume of devices getting discovered at the same time, but is anyone familiar with the error and why it could be happening?

I am sending events to the SL API to create an Event with ‘Use Message-match’ enabled. Sometimes the source will send events to the API which would just have a issue ID changed, but relating to the same event.  For example. First post: Issue: broken ID: 39393Second post: Issue: broken ID: 53291 I want SL to group the events based on the issue, at the moment it would create a new event.  This is my regexpartner=(.*?),sndinterface=(.*?),resourcetype=(.*?),rcvid=(.*?),rcvinterface=(.*?),status=(.*?),glbID=(.*?) In essence, i want SL to ignore the last field (glbID) when it tries to match the events.  Is this possible? Thanks  

Two recent Cisco Unified Communications Manager advisories — one an actively-exploited zero-day — can be scoped today using data the CUCM PowerPack already collects. 1. SummaryCisco has disclosed two vulnerabilities affecting Unified Communications Manager. If you monitor CUCM with ScienceLogic AI Platform, you already hold the two data points needed to scope exposure: each cluster's running software release, and which services (including WebDialer) are active.CVE Type Severity Status CVE-2026-20045 Remote code execution via the web management interface, no authentication required CVSS 8.2 Critical (SIR) CISA KEV Actively exploited in the wild CVE-2026-20230 Server-side request forgery (SSRF) that can escalate to root CVSS 8.6 Critical (SIR) PoC code available; no confirmed in-the-wild use. Conditional — see note.  Why "Critical" with a sub-9 score? Cisco assigns both a Security Impact Rating of Critical — higher than the numeric CVSS suggests — because successful

Hi All,  As of now all the filesystem for SL1 data collector and message collector type is showing as other where monitoring of FS is disabled at default. The Appliance must be customized to make  valid type so that this will not be hidden at default. 

Hi ,  Whether SL1 does has the Intelligence  to detect the parent and child relationship based on CDP and LLDP information . If it works means can you let us know how device is picked as parent and child.