ScienceLogic AI Platform

Hi All,I've Developed a Runbook Action within ScienceLogic, that triggers a Powerflow Application if certain Runbook Automation Policy conditions are met.Upon execution, it sends the following payload:"params": {     "configuration": configuration,     "event_policy_name": EM7_VALUES['%_event_policy_name'],     "event_details": EM7_VALUES,     "organization_name": EM7_VALUES['%O'],     "system_url": system_url,     "queue": queue}These parameters are specified as inputs, and some are derived from the EM7Values.When the Runbook Automation linked to this Action executes against a specific Event Policy raised on a Device, i can see a success message in the "Event Notifications" window, and i can see all inputs and variables are passed through in its entirety.The real issue comes when you open Powerflow. The Application immediately fails, and an error message stating that theres an "Internal Requ

Question about collector event management load versus number of defined event policies. We just got requirement to add some 800 trap event policies into our SL1, and I started to wonder what kind of effect that will have in collector load. So, when trap is coming in how is that checked against defined event policies. For example how much it slows collector if number of trap event policies go from 2k to 3k? Especially when there is anyway quite constant "flood" of traps anyway more or less all the time.And because there is still (SL1 12.1.*) no way to tell that "use these policies on this CUG only" but all the policies will be distributed to all CUGs, so the load is added everywhere.

We have created a custom DA and the data shows fine on aligned devices and in Dashboards.But if we run a report (e.g. Run Report -> Devices -> Performance Single Object) the custom DA is listed ok so we can select it but no data is ever returned, reports work fine for out the box DA's.So have we missed something while creating the custom DA which means the reports do not work ?

Hi All,I've Developed a Runbook Action within ScienceLogic, that triggers a Powerflow Application if certain Runbook Automation Policy conditions are met.Upon execution, it sends the following payload:"params": {     "configuration": configuration,     "event_policy_name": EM7_VALUES['%_event_policy_name'],     "event_details": EM7_VALUES,     "organization_name": EM7_VALUES['%O'],     "system_url": system_url,     "queue": queue}These parameters are specified as inputs, and some are derived from the EM7Values.When the Runbook Automation linked to this Action executes against a specific Event Policy raised on a Device, i can see a success message in the "Event Notifications" window, and i can see all inputs and variables are passed through in its entirety.The real issue comes when you open Powerflow. The Application immediately fails, giving no error and no explanation as to why it fails.I've

We are building an app that will have a component to build a virtual device, align a dynamic app and a credential to it using the SL1 API.  Looking for some guidance on how to do this as we have never done anything with device creation through the API, only /alerts creation.

When gathering information from cloud stuff, or actually doing whatever with cloud staff you most often need the object's ID, that long hexastring. That same ID is also most used identifier and required information when trying to sync those cloud "devices" into ServiceNow CMDB. The issue is that SL1 Azure PP does not gather that information too much, one device class that we have so far found it is those actual VMs in cloud. But one could say that those are the only "devices" where it is easily found.So my question is, how you have planned, or done, the CMDB integration of Azure cloud stuff. Or have you done any automation from SL1 to Azure, because also there one always(?) need that object ID.I could have written also an Idea for this, but at least for me, Nexus does not support my ideas.

Hello all! I'm sure some of you are at Cisco Live NAM right now, but if you aren't, there was a great presentation on CUCM. CentOS is being swapped out, CUCM 15 appears to be switching to Python 3, along with other security changes.  They've announced an EOL date for CUCM 14 as well. Take a look at the slide deck as it's very interesting.  Their product team also informed me that the API is unchanged from v12.5 through CUCM 15, so our integration should continue to work. Please let us know if you have any issues with the latest version of our PowerPack and CUCM 15.     

Hi All,  Whether in upcoming version Sl1 has capable of creating automatic topology creation between pingable device and SNMP device?We don't want an adhoc creation it needs to be done automatically. 

Hi All,    There is any possibility to expose the performance data with Grafana from Sceineclogic for dashboarding 

I've done some digging and so far haven't found a way to change the text in a Link-Message that's associated with an event policy.  I know we can change the name of the policy itself but not to the text that's associated with it.  The one I want to change is "161: Bandwidth usage exceeded threshold: %V".  This is the message associated with the interface utilization threshold, and the word "bandwidth" in it is confusing some users.  Is this something we can do?

Hello all!  We are working on an update to the HPE Edge Connect PowerPack that converts the dynamic applications to use the snippet framework. This will improve supportability, simplify troubleshooting, improve performance, and make it easier to customize the collections to suit your needs.  As part of this, we are considering dropping support for "cookie" auth and requiring users to use API keys to connect SL1 to the Edge Connect Orchestrator.  If you have a use case that precludes using an API key for this integration, please reach out and help us understand your parameters.  Thanks! 

Is there a plan to get also metrics retrieved from Cisco Intersight. The current version seems to be configuration and alarms -only type and there are several interesting metrics available through API, like temperature, power, cpu and memory.

I am curious if anyone has built an Equinix powerpack to collect things such as port inventory, alarms, and maintenance events from Equinix API.I'd be willing to share some of our packs in return :)Thank you,Mike

Multiple Parent Devices: we are trying to enable the Event Correlation on few devices  Is it possible to create the same child device for multiple parent devices?

Hallo This is more of a PowerFlow discussion on the CMDB Sync pack. Currently the mapping of attributes is not restricting on what class have what attributes. It is mostly coming down to what we currently have it map within ScienceLogic. The fun of that is that the PF will come down to some weird attributes association with different class, even when that attributes does not exist. Example Blade and CPU counts are certainly not an attributes of wap_network Ci class, however PF will put that together and make the payload a bit bigger and send over to ServiceNow. Then it gets ignored. While that we also cannot see the Ignore on the PF Debug.{               "className":"cmdb_ci_wap_network",               "values":{                  "x_sclo_scilogic_monitored":true,                  "x_sclo_scilogic_id":"123456",&nbs

Hi all,I am currently trying to configure some Run book automation policies to enrich data in ServiceNow incidents, sending the RBA output into the Incident worklog, and have hit a bit of a road block on the best way to configure the RBA criteria.Background: We use a dedicated "ServiceNow: [Incident] - Add/Update" RBA for each organisation, which is triggered on event creation, to effectively "Auto Ticket" on all events for specific SL orgs (excluding masked and child rollup). Challenge: In my Enrichment RBA's I want to trigger using "and external ticket IS created", to ensure that I am only posting updates when there has been a ServiceNow incident created. However the OOTB ServiceNow Incident sync pack is updating the events external ticket ref field with various messages e.g. "Sync Successful", before the event is updated with the Incident Number.As soon as the Incident Create updates the events external ticket ref field, by Automation policy gets triggered (I assume becaus

Since upgrading to 12.2.x We have noticed our collector DB sizes increase quiet dramatically and appears to be down to the filestore storage_system_package table, which contains around 6gb. I would assume that anything in the filestore system_package table can now be truncated once deployment have been completed?

I have worked with support on the UDP/TCP ports tab.  How it works was not how I thought it would or should work.   I thought it would list any open port on a server (this would be helpful) but it does not.   Based on how we use the tool I would like this changed to be able to list all open ports and then have the system load all ssl certs assigned to those ports (it only does 443 today for ssl certs).  We need an automated way to monitor SSL Certs.We built a custom dynamic app by port (one dynamic app per port number) to handle this but it is clunky and ssl monitoring should be something you address out of the box.  Knowing what ports have an SSL cert and when it expires is as important as availability.  

Hallo, I was advised by the support that this is "the way it should be" as Message collector are not log aggregator. in Version 12.1.x, the message collector will no longer record the syslog or snmp trap that is received by the MC in any of the capacity. These messages are being proceed on a memory buffer directly into the Event Engine into the Database. 1 - devices are sending syslog + trap to MC - we are able to confirm in tcpdump 2 - MC takes these packets and memory buffer it to somewhere and it get proceed by the mc event engine as ignore or proceed 3 - if proceed - we will see it on the DB  4 - if not proceed - we will see nothing on DB So now, we have no ability to know on the format or the actual message received by the message collector. There is currently no "known way" to redact this into a file or forward out to another syslog server as they are passthrough over the memory, at least we tried and no success. Docs indicated that the rsyslog

The default in SL1 is that collection for interface errors, discards and packets are disabled by default.  We can enable collection of errors and discards with via template, but packets have to be enabled on a per-interface basis.  Is there a way to change those system defaults?  Those are incredibly valuable metrics for troubleshooting, and the fact that they're disabled by default is pretty frustrating.  Thanks.

Hi Can we monitor NFS file/volume usage in SL1, if so which powerpack we can use. Kindly suggest.Regards,

Hi All, Is there anyway in SL1 to run a specific DA alone in debug mode and see the poll summary against the aligned devices.

Is there a way to retrieve a list of vanished devices with GQL? According to all-mighty AI (CoPilot) there are couple of ways to do it, though none of those seems to work.So the question is if the AI is hallucinating? Or is that possible?

Would it be possible to change or set the severity of a trap event if it occurs at a specific time.e.g. Should it occur during business hours set/change it to a minor or should it occur after hours set/change it to another severity

Hello,One of our customer is using a lot of Custom Scripts, where we are monitoring their output by syslog. There is starting a problem, when script stuck or block. Then customer don't know about it. Is there any possibilities how to monitor, If these scripts are working? We have suggestion, that Custom Scripts can send also message like OK or KO. 2 Events will match these both. There should be an action (run book) for script is running like:em7_snippets.generate_alert(xtype = 1, xid=EM7_VALUES['%x'], message = 'script heartbeat')and not running with count like:if EM7_VALUES['%c'] >= 2:    em7_snippets.generate_alert(xtype = 1, xid=EM7_VALUES['%x'], message = 'script is not running')There will be also 2 automation. For script heartbeat will be action for heartbeat every 5min (for example as schedules) and for some Device group.Second automation for not running will have action not running. I think, there will must be next two events which will be matched by