ScienceLogic AI Platform

Hi all,I am currently trying to configure some Run book automation policies to enrich data in ServiceNow incidents, sending the RBA output into the Incident worklog, and have hit a bit of a road block on the best way to configure the RBA criteria.Background: We use a dedicated "ServiceNow: [Incident] - Add/Update" RBA for each organisation, which is triggered on event creation, to effectively "Auto Ticket" on all events for specific SL orgs (excluding masked and child rollup). Challenge: In my Enrichment RBA's I want to trigger using "and external ticket IS created", to ensure that I am only posting updates when there has been a ServiceNow incident created. However the OOTB ServiceNow Incident sync pack is updating the events external ticket ref field with various messages e.g. "Sync Successful", before the event is updated with the Incident Number.As soon as the Incident Create updates the events external ticket ref field, by Automation policy gets triggered (I assume becaus

Since upgrading to 12.2.x We have noticed our collector DB sizes increase quiet dramatically and appears to be down to the filestore storage_system_package table, which contains around 6gb. I would assume that anything in the filestore system_package table can now be truncated once deployment have been completed?

I have worked with support on the UDP/TCP ports tab.  How it works was not how I thought it would or should work.   I thought it would list any open port on a server (this would be helpful) but it does not.   Based on how we use the tool I would like this changed to be able to list all open ports and then have the system load all ssl certs assigned to those ports (it only does 443 today for ssl certs).  We need an automated way to monitor SSL Certs.We built a custom dynamic app by port (one dynamic app per port number) to handle this but it is clunky and ssl monitoring should be something you address out of the box.  Knowing what ports have an SSL cert and when it expires is as important as availability.  

Hallo, I was advised by the support that this is "the way it should be" as Message collector are not log aggregator. in Version 12.1.x, the message collector will no longer record the syslog or snmp trap that is received by the MC in any of the capacity. These messages are being proceed on a memory buffer directly into the Event Engine into the Database. 1 - devices are sending syslog + trap to MC - we are able to confirm in tcpdump 2 - MC takes these packets and memory buffer it to somewhere and it get proceed by the mc event engine as ignore or proceed 3 - if proceed - we will see it on the DB  4 - if not proceed - we will see nothing on DB So now, we have no ability to know on the format or the actual message received by the message collector. There is currently no "known way" to redact this into a file or forward out to another syslog server as they are passthrough over the memory, at least we tried and no success. Docs indicated that the rsyslog

The default in SL1 is that collection for interface errors, discards and packets are disabled by default.  We can enable collection of errors and discards with via template, but packets have to be enabled on a per-interface basis.  Is there a way to change those system defaults?  Those are incredibly valuable metrics for troubleshooting, and the fact that they're disabled by default is pretty frustrating.  Thanks.

Hi Can we monitor NFS file/volume usage in SL1, if so which powerpack we can use. Kindly suggest.Regards,

Hi All, Is there anyway in SL1 to run a specific DA alone in debug mode and see the poll summary against the aligned devices.

Is there a way to retrieve a list of vanished devices with GQL? According to all-mighty AI (CoPilot) there are couple of ways to do it, though none of those seems to work.So the question is if the AI is hallucinating? Or is that possible?

Would it be possible to change or set the severity of a trap event if it occurs at a specific time.e.g. Should it occur during business hours set/change it to a minor or should it occur after hours set/change it to another severity

Hello,One of our customer is using a lot of Custom Scripts, where we are monitoring their output by syslog. There is starting a problem, when script stuck or block. Then customer don't know about it. Is there any possibilities how to monitor, If these scripts are working? We have suggestion, that Custom Scripts can send also message like OK or KO. 2 Events will match these both. There should be an action (run book) for script is running like:em7_snippets.generate_alert(xtype = 1, xid=EM7_VALUES['%x'], message = 'script heartbeat')and not running with count like:if EM7_VALUES['%c'] >= 2:    em7_snippets.generate_alert(xtype = 1, xid=EM7_VALUES['%x'], message = 'script is not running')There will be also 2 automation. For script heartbeat will be action for heartbeat every 5min (for example as schedules) and for some Device group.Second automation for not running will have action not running. I think, there will must be next two events which will be matched by

Trying to create a DA that alerts when filesystem has x GB left rather than percentage left.This is valuable as setting current thresholds to 99% could still mean there is 100's GB still available, which for big filesystems this is not an issue.This information is available through the host resource oid's and I have created a threshold which is visible on the devices the DA is aligned to. However, this is a threshold for ALL filesystems rather than being able to specify for individual filesystems.Anyone with any ideas on how to get the same behavior as the internal filesystem thresholds where we can specify this threshold on individual filesystems? 

When SL1 sends event to, in our case, using SL PF Incindent Sync to ServiceNow, other systems it quite often includes the sub-id information also in that message. Normally that is also used as correlation ID in ServiceNow. Example here what is seen in SN:So some events utilize other sub-id's than those ootb cpu/mem/disk/etc. We would also use that kind of feature in our own event policies to send numeric (or string) information in that field. But we have not yet found a place where we can control that. So how is that information sent to servicenow. What fields in event message are used for that info?

Hey, I am wondering if there is an API logic to get all devices aligned to a snippet performance dynamic application ? regardless of whether they are collecting any data or not.

There's been a number of times where we have come across customers who have BGP peers that are not in use or sporadically in use, but they do not wish to remove it from their configs.  As a result we get perpetual alerts, but we cannot suppress them as the event suppressed would prevent all bgp peers from alerting.  Anyone have thoughts on some ways to single out peers that can be ignored on a per device level?  Side note: We are using Powerflow and ServiceNow so we can possibly do something in the path as well.  ServiceNow could take care of it, but doesn't help with the peers that flap.

Hi All, I'm new to the Low Code tools/DA builder. I just created a new DA using the DA Builder, and uploaded to my stack. I also have the Low Code Tools Powerpack v101 installed on my system. I'm seeing the following error when I try to run the DA and it seems like I'm possibly just missing some snippet or module and I was wondering if I'm missing something simple:54. Running Snippet 3586 55. Error encountered while executing snippet. Error explanation: App: 3847, Snippet: 3586 threw exception: No module named apps.errors (ImportError: No module named apps.errors File "<string>", line 1, in <module>) 56. Snippet 3586 execution failed. 

I was just using the DA builder and realized that the "Component Identifiers" field doesn't contain "Device Name %N" as a field.

Has anyone run into an issue where a few MAC addresses are being read by the snmp handler `snmp_walk` method as gibberish? Non-MAC address string data is returned on some interfaces that seems to be some form of unicode. This is an example when running the SNMP walk from bash: IP-MIB::ipNetToMediaPhysAddress.2.10.250.123.5 = STRING: 24:2a:4:f0:7a:c7 This is the same OID when read by the python SNMP handler: ('.1.3.6.1.2.1.4.22.1.2.2.10.250.123.5', '$*\x04ðzÇ') I've tested the python2.7 execution environment, and the 3.6 env from the Cisco base pack 214. Thanks! Joe

I want users default page when they login to be a Dashboard in AP2, however, in the user preferences (classic EM7) I cannot see any AP2 Dashboards. Is there a way to force this?

Anybody had any success with this?Going direct to message collectors works as expected. When we put a load balancer in the middle it does not work.As per SL1 documentation, the traffic is being forwarded from the load balancer with the original source IP. However, the source port is different (no mention about that in the documentation) and this is where I think the problem lies as the backend server is sending the tcp acknowledgements back to the source IP but to a different port (the port the LB has forwarded the traffic on).Makes sense that we also need to passthrough the source port being used, but this is not a configuration that has been used before (other apps being managed by the load balancer are mainly https with x-forwarder) and there is a reluctance to configure without evidence that this is correct. Surprising how little information there is out on the internet about configuring LB (unless my googling is not up to scratch :-) )Would be good to know how others have the

Hi All,Do we have any ways under Action Policy by which we can configure so that Parent/Root's IP address can be populated at the time of DB alerts (MSSQL, Oracle etc.) 

Rotation of password by Cyberark and the timespan defined with "CacheRefreshInterval" is causing issues with the polling interval of SL1 DAs.With CyberArk, the SL1 can source credential data from CyberARK. Respecting security policies, Cybersecurity recommends changing of password to the SL1 IDs. CyberARK can only specify a time frame during which the passwords can be changed. Within the collectors on the Cyberark agent setup CacheRefreshInterval is set up with 1500 secs (25 mins) to refresh the local cache with the Cyberark every 25 mins.As Cyberark can change the password at any minute or secs of time, SL1 still waits for CacheRefreshInterval to refresh the password. As polling frequencies are default set with 5 minutes(with password change happening at the 4th minute), often SL1 still reaches the server with old password and cause account lockouts.Is there a known way to tackle this issue?

Hello everyone Thank you!

We're looking at enabling Syslog output to a central repository from PowerFlow at an application level. We've already got this running fine at an OS level and SL1 at an application level.Has anybody setup logging for PowerFlow? We're specifically interested in any login type data and also code changes. I've been through as much doc as I can find on the topic, such as:https://docs.sciencelogic.com/pdf/sciencelogic_powerflow_2-1-1.pdfhttps://docs.docker.com/engine/logging/drivers/syslog/https://support.sciencelogic.com/s/article/10819It doesn't appear straight forward to link log files in /var/log/iservices to their respective Docker services.I'm just looking for validation as much as anything, that Docker level logging of the contentapi and gui processes would be the way forward to capture all relevant security related information, and that all other processes can be ignored.

Is there a way to prevent users seeing all public dashboards, so that the user can only see the dashboards related to their organisation.  The only way I can think at the moment is to make all dashboards private or org assigned.   

How many network adapter is supported. Currently we have migrating between datacenters and due to ACI we cannot have vrf leaking. So we need 3 network adapters to cover all requirements. can someone advice? Currently we have 2  just for info.