ScienceLogic AI Platform

The default in SL1 is that collection for interface errors, discards and packets are disabled by default.  We can enable collection of errors and discards with via template, but packets have to be enabled on a per-interface basis.  Is there a way to change those system defaults?  Those are incredibly valuable metrics for troubleshooting, and the fact that they're disabled by default is pretty frustrating.  Thanks.

Hi Can we monitor NFS file/volume usage in SL1, if so which powerpack we can use. Kindly suggest.Regards,

Hi All, Is there anyway in SL1 to run a specific DA alone in debug mode and see the poll summary against the aligned devices.

Is there a way to retrieve a list of vanished devices with GQL? According to all-mighty AI (CoPilot) there are couple of ways to do it, though none of those seems to work.So the question is if the AI is hallucinating? Or is that possible?

Would it be possible to change or set the severity of a trap event if it occurs at a specific time.e.g. Should it occur during business hours set/change it to a minor or should it occur after hours set/change it to another severity

Hello,One of our customer is using a lot of Custom Scripts, where we are monitoring their output by syslog. There is starting a problem, when script stuck or block. Then customer don't know about it. Is there any possibilities how to monitor, If these scripts are working? We have suggestion, that Custom Scripts can send also message like OK or KO. 2 Events will match these both. There should be an action (run book) for script is running like:em7_snippets.generate_alert(xtype = 1, xid=EM7_VALUES['%x'], message = 'script heartbeat')and not running with count like:if EM7_VALUES['%c'] >= 2:    em7_snippets.generate_alert(xtype = 1, xid=EM7_VALUES['%x'], message = 'script is not running')There will be also 2 automation. For script heartbeat will be action for heartbeat every 5min (for example as schedules) and for some Device group.Second automation for not running will have action not running. I think, there will must be next two events which will be matched by

Trying to create a DA that alerts when filesystem has x GB left rather than percentage left.This is valuable as setting current thresholds to 99% could still mean there is 100's GB still available, which for big filesystems this is not an issue.This information is available through the host resource oid's and I have created a threshold which is visible on the devices the DA is aligned to. However, this is a threshold for ALL filesystems rather than being able to specify for individual filesystems.Anyone with any ideas on how to get the same behavior as the internal filesystem thresholds where we can specify this threshold on individual filesystems? 

When SL1 sends event to, in our case, using SL PF Incindent Sync to ServiceNow, other systems it quite often includes the sub-id information also in that message. Normally that is also used as correlation ID in ServiceNow. Example here what is seen in SN:So some events utilize other sub-id's than those ootb cpu/mem/disk/etc. We would also use that kind of feature in our own event policies to send numeric (or string) information in that field. But we have not yet found a place where we can control that. So how is that information sent to servicenow. What fields in event message are used for that info?

Hey, I am wondering if there is an API logic to get all devices aligned to a snippet performance dynamic application ? regardless of whether they are collecting any data or not.

There's been a number of times where we have come across customers who have BGP peers that are not in use or sporadically in use, but they do not wish to remove it from their configs.  As a result we get perpetual alerts, but we cannot suppress them as the event suppressed would prevent all bgp peers from alerting.  Anyone have thoughts on some ways to single out peers that can be ignored on a per device level?  Side note: We are using Powerflow and ServiceNow so we can possibly do something in the path as well.  ServiceNow could take care of it, but doesn't help with the peers that flap.

Hi All, I'm new to the Low Code tools/DA builder. I just created a new DA using the DA Builder, and uploaded to my stack. I also have the Low Code Tools Powerpack v101 installed on my system. I'm seeing the following error when I try to run the DA and it seems like I'm possibly just missing some snippet or module and I was wondering if I'm missing something simple:54. Running Snippet 3586 55. Error encountered while executing snippet. Error explanation: App: 3847, Snippet: 3586 threw exception: No module named apps.errors (ImportError: No module named apps.errors File "<string>", line 1, in <module>) 56. Snippet 3586 execution failed. 

I was just using the DA builder and realized that the "Component Identifiers" field doesn't contain "Device Name %N" as a field.

Has anyone run into an issue where a few MAC addresses are being read by the snmp handler `snmp_walk` method as gibberish? Non-MAC address string data is returned on some interfaces that seems to be some form of unicode. This is an example when running the SNMP walk from bash: IP-MIB::ipNetToMediaPhysAddress.2.10.250.123.5 = STRING: 24:2a:4:f0:7a:c7 This is the same OID when read by the python SNMP handler: ('.1.3.6.1.2.1.4.22.1.2.2.10.250.123.5', '$*\x04ðzÇ') I've tested the python2.7 execution environment, and the 3.6 env from the Cisco base pack 214. Thanks! Joe

I want users default page when they login to be a Dashboard in AP2, however, in the user preferences (classic EM7) I cannot see any AP2 Dashboards. Is there a way to force this?

Anybody had any success with this?Going direct to message collectors works as expected. When we put a load balancer in the middle it does not work.As per SL1 documentation, the traffic is being forwarded from the load balancer with the original source IP. However, the source port is different (no mention about that in the documentation) and this is where I think the problem lies as the backend server is sending the tcp acknowledgements back to the source IP but to a different port (the port the LB has forwarded the traffic on).Makes sense that we also need to passthrough the source port being used, but this is not a configuration that has been used before (other apps being managed by the load balancer are mainly https with x-forwarder) and there is a reluctance to configure without evidence that this is correct. Surprising how little information there is out on the internet about configuring LB (unless my googling is not up to scratch :-) )Would be good to know how others have the

Hi All,Do we have any ways under Action Policy by which we can configure so that Parent/Root's IP address can be populated at the time of DB alerts (MSSQL, Oracle etc.) 

Rotation of password by Cyberark and the timespan defined with "CacheRefreshInterval" is causing issues with the polling interval of SL1 DAs.With CyberArk, the SL1 can source credential data from CyberARK. Respecting security policies, Cybersecurity recommends changing of password to the SL1 IDs. CyberARK can only specify a time frame during which the passwords can be changed. Within the collectors on the Cyberark agent setup CacheRefreshInterval is set up with 1500 secs (25 mins) to refresh the local cache with the Cyberark every 25 mins.As Cyberark can change the password at any minute or secs of time, SL1 still waits for CacheRefreshInterval to refresh the password. As polling frequencies are default set with 5 minutes(with password change happening at the 4th minute), often SL1 still reaches the server with old password and cause account lockouts.Is there a known way to tackle this issue?

Hello everyone Thank you!

We're looking at enabling Syslog output to a central repository from PowerFlow at an application level. We've already got this running fine at an OS level and SL1 at an application level.Has anybody setup logging for PowerFlow? We're specifically interested in any login type data and also code changes. I've been through as much doc as I can find on the topic, such as:https://docs.sciencelogic.com/pdf/sciencelogic_powerflow_2-1-1.pdfhttps://docs.docker.com/engine/logging/drivers/syslog/https://support.sciencelogic.com/s/article/10819It doesn't appear straight forward to link log files in /var/log/iservices to their respective Docker services.I'm just looking for validation as much as anything, that Docker level logging of the contentapi and gui processes would be the way forward to capture all relevant security related information, and that all other processes can be ignored.

Is there a way to prevent users seeing all public dashboards, so that the user can only see the dashboards related to their organisation.  The only way I can think at the moment is to make all dashboards private or org assigned.   

How many network adapter is supported. Currently we have migrating between datacenters and due to ACI we cannot have vrf leaking. So we need 3 network adapters to cover all requirements. can someone advice? Currently we have 2  just for info.

“If the server is in a hung state, is there any way we can trigger an event?”

We are planning to upgrade our agents to v146. What are the potential issues in data collection, alerting we might face during the upgrade process. 

Tomorrow we'll be performing the upgraded from Aurora 2 to 3? Any gotchas that you can share? I'm already on 12.1.2-p. Thanks!

Hi - We have a requirement to use TLS 1.3 for syslog on a message collector.  Is there a way to verify TLS 1.3 is supported?   I have configured TLS on a OL7 message collector using this document https://docs.sciencelogic.com/pdf/sciencelogic_sysadmin_12-1-0.pdf and can verify TLS 1.2 is working.  TLS 1.3 is not working on a OL7 collector. Thanks