ScienceLogic AI Platform

We would like to get an update for following disclaimer for on Linux Base Pack v114. Reason being, it has been almost 5 months, and it has not been update on SL Support Portal ** We are currently reviewing a potential performance-related issue that we have identified internally with Linux Base Pack v114. We will provide an update on next steps once our evaluation is complete. **

I recently created a Runbook Automation/Action whose job it is to set newly discovered components to a different Organization. It triggers off the “Component Device Discovered” Event Policy.I ran into a handful of the following errors when a group of Aruba APs was added to Central around the same time:Snippet (723) failed to execute with exception: Failed to acquire lock /tmp/envmanlock-83EF68E00F35226911E02C49561FADFA within 60 secondsResult:NoneThis particular Aruba environment is known for how big it is, so there could be some issue with volume of devices getting discovered at the same time, but is anyone familiar with the error and why it could be happening?

I am sending events to the SL API to create an Event with ‘Use Message-match’ enabled. Sometimes the source will send events to the API which would just have a issue ID changed, but relating to the same event.  For example. First post: Issue: broken ID: 39393Second post: Issue: broken ID: 53291 I want SL to group the events based on the issue, at the moment it would create a new event.  This is my regexpartner=(.*?),sndinterface=(.*?),resourcetype=(.*?),rcvid=(.*?),rcvinterface=(.*?),status=(.*?),glbID=(.*?) In essence, i want SL to ignore the last field (glbID) when it tries to match the events.  Is this possible? Thanks  

It has been observed that SNMP credentials (such as community strings, SNMPv3 authentication/privacy keys, and SSH credentials) are retrievable in a readable format through authenticated API access.This behavior represents a significant security vulnerability, as sensitive credentials should never be exposed in plaintext. If the exposed credentials have Read-Write privileges, an attacker who gains API access could potentially modify device configurations, disrupt services, or compromise the integrity of managed systems.As a security best practice, all sensitive credentials should be encrypted at rest and should not be retrievable in a user-readable format through any API response. Where credential validation is required, mechanisms such as secure storage, tokenization, hashing (where applicable), or masked values should be implemented instead of returning the actual credentials.We recommend remediating this issue by ensuring that sensitive credentials are securely encrypted and inacces

Two recent Cisco Unified Communications Manager advisories — one an actively-exploited zero-day — can be scoped today using data the CUCM PowerPack already collects. 1. SummaryCisco has disclosed two vulnerabilities affecting Unified Communications Manager. If you monitor CUCM with ScienceLogic AI Platform, you already hold the two data points needed to scope exposure: each cluster's running software release, and which services (including WebDialer) are active.CVE Type Severity Status CVE-2026-20045 Remote code execution via the web management interface, no authentication required CVSS 8.2 Critical (SIR) CISA KEV Actively exploited in the wild CVE-2026-20230 Server-side request forgery (SSRF) that can escalate to root CVSS 8.6 Critical (SIR) PoC code available; no confirmed in-the-wild use. Conditional — see note.  Why "Critical" with a sub-9 score? Cisco assigns both a Security Impact Rating of Critical — higher than the numeric CVSS suggests — because successful

Hi All,  As of now all the filesystem for SL1 data collector and message collector type is showing as other where monitoring of FS is disabled at default. The Appliance must be customized to make  valid type so that this will not be hidden at default. 

Hi ,  Whether SL1 does has the Intelligence  to detect the parent and child relationship based on CDP and LLDP information . If it works means can you let us know how device is picked as parent and child. 

Hi All,  We have most of devices enabled with CDP and LLDP , if we see the view in the map the both the devices are connected to each other in view which is not helpful . Device A is parent and device B is child , But in maps both the device is showing as parent as well child. Whether everyone has this issue ?  

The process Process 'Update Device State' has a default frequency of 1 min, but we have a large number of device groups, over a thousand, i see this every minute 'already running, not starting, proc name Update Device State' And after a few minutes it then sends a signal 15, and terminals the process 'Process Update Device State has caught signal 15 and is exiting.'I'm wondering whats the implications if i change the time factor to allow the process to run longer, or if there is an limitation to the number of device groups that should be allowed?     

Hi All, Anyone upgraded the Skylar one to 12.5.1 ? Looks like the new feature Enhanced Topology process is not working for us .. is it for anyone else as well?

We believe that our Concurrent powershell collections are running into some security software we have running on 0, 5, 10, 15, 20, etc minutes. We wanted to try to offset ScienceLogic Powershell to run on 2, 7, 12, etc if possible.I am familiar with System > Settings > Process > Data Collection: Dynamic App… I changed this one to offset by 2 which worked for non Powershell collections but didn’t work for Powershell… I also found “Data Collection: PowerShell Collector”, but this process does not have an offset setting.

Implementing SSL Cert monitoring due to the new policy for Certificate renewal times, i have discovered that you cannot easily only allow SSL Expiry Events for listed servers.As we have thousands of “internal” self-signed certs, a lot of these have expired but do not need to be re-issued.What i’d like to be able to do is to create a “Device Group” and add in the Servers that i DO want to alert on…using a Dynamic Rule to look for a custom “Atribute” on the device for “SSL_Monitoring” but use a “!*” rule to invert the device group.that way this Device Group can be added into the “Suppressions” on the SSL Events.Currently this does not work and i wold need to add Device names into the Rule manually as an inverse.this method will work but will get very messy and will reply solely on my as the administrator to update the list, Ideally other staff should just be able to add that custom “Attribute” and the server will be added automatically and the Inverse rule would flip the logic and allow

I recently had a request from a user asking if there was a way to quickly look at the device logs for multiple devices all at once.  I looked at the reporting tool for a bit and didn’t find anything there, then went to see if I could provide that in an AP2 dashboard.  I know device logs in a widget are technically possible because they’re right there on the default device investigator tab but I cannot for the life of me figure out how to get that data displayed in a dashboard.  Events no problem.  Device logs not so much.  Any suggestions or ideas on how to make this happen?  Thanks.

Hi to all, we configured a Global Manager in our QA env for 2 stacks but there is something that it's not really clear to me.The global manager is not capable to manage PP on the stacks (in AP2 UI there is any menu entry for PP), is not capable to retrieve device groups defined on the stacks, is not capable to retrieve device class from the stack, is not possible create device groups and add devices monitored by the stacks.My first question is: how can we create a dashboard that can filter panels based on custom device group?

I'm looking for information on internal tie-breaking logic when multiple event policies match the same event and have the same weight.  From what I have read, this logic is typically based on policy ID or creation order - but which way ?   oldest wins OR newest wins ?My team have a set up meant to handle VMware events (API) differently based on the Organization.  However they are doing this using device groups in the suppression tab which isn't effective if the event match is the same. 

Good morning ScienceLogic Community, with the rapid adoption of Artificial Intelligence I am seeing a lot of GPU's being deployed and since these GPU's are not cheap there are lots of people asking if they can be monitored. Anyone monitoring GPU's already?Thanks. Jason. 

OK.  So I'm fairly new to modifying events in SL1, but our NOC has requested that we research suppressing the "Poller: Interface operationally down" event if "Poller: Interface Admin down" is active on a given interface.  That makes perfect sense to me.  If an interface is admin down, then there is absolutely no need for the operationally down event/alert.  Other tools I have administered in the past had this logic baked in out of the box, but that doesn't seem to be the case with SL1.  I looked at using the Autoclear option for the Admin down event to have it clear the operationally down message, but I'd much rather just not have the operationally down event trigger at all if the interface is admin down.Any thoughts on how to get this configured?  Thank you.

I'm working on building out a dashboard for IPSLA tests.  I'd like one widget for the devices that drives another widget showing a list of the IPSLA tests on the selected device.  I'd then like to have the widget with the list of tests drive the widget with the line graph visualization.  Should be simple, right?  The issue I'm running in to is with the widget for the list of IPSLA tests.  If I select a Table visualization, it only shows one of the tests configured on the selected device.  If I select a Configuration Table visualization, it shows a list of all of the tests on the selected device.  The problem is that the Configuration Table visualization does not support driving other widgets (like the one with the line graph visualization).Any thoughts on how to make this work?  Thanks. 

Hi,We have moved away from using the ISadmin account for Skylar Automate. Instead of the we using a SSO integration for the users and for integrations the API-Key possibilities.Looking at Skylar AutomationPowerPack v108 I can't see the option to use an API-Key in the SOAP/XML credential. My questions:Did I overlooked something?If not, how can we implement the API-Key?I think the usage of API-Key is applicable for more ScienceLogic clients.Thanks in advance.Alfred   

How can we do the Event Log Monitoring for Window machines.

  When is the 12.5.2 release is planned? We need to sort the below mentioned issue . Any tentative dates?https://support.sciencelogic.com/s/article/19184 

Py2 libraries are not removed automatically after upgrade 12.5.1 upgrade. 

 Regarding latest release vSphere PowerPack v309vSphere version 6.7.0 is supporting and working fine with the current running Vcenter base pack version v308, But the latest Vcenter base pack version 309 will not support vSphere version 6.7.0. (below 7)Hence with this how how we can proceed with upgrade to v309. Please suggest.

Is there somewhere documentation that explains tables in event_insight database.We would like to understand what are the alert_type and alert_category values used there. This database could be really interesting place to find for example alert statistics per organization or the noisiest collectors etc. Those things are otherwise pretty difficult to find.

Whether it is possible to monitor the runbook schedules ? We have some critical run book which used to run every day , some times it not running , we need an alert for this.