ScienceLogic AI Platform

“If the server is in a hung state, is there any way we can trigger an event?”

We are planning to upgrade our agents to v146. What are the potential issues in data collection, alerting we might face during the upgrade process. 

Tomorrow we'll be performing the upgraded from Aurora 2 to 3? Any gotchas that you can share? I'm already on 12.1.2-p. Thanks!

Hi - We have a requirement to use TLS 1.3 for syslog on a message collector.  Is there a way to verify TLS 1.3 is supported?   I have configured TLS on a OL7 message collector using this document https://docs.sciencelogic.com/pdf/sciencelogic_sysadmin_12-1-0.pdf and can verify TLS 1.2 is working.  TLS 1.3 is not working on a OL7 collector. Thanks 

Hi All,We have some custom SNMP DA where we are seeing missed polls , the same SNMP oid is working fine with OOB DA without missed polls. There is no network issue.Anyone facing this issue ? 

We are currently facing a scenario where the IP address of our Meraki devices changes upon reboot, which subsequently triggers a DFA alert. To streamline our operations and reduce manual intervention, we are exploring the possibility of capturing these IP changes and updating them automatically in SL.Meraki assets are onboarded through SNMP. 

Hi all,We are in the process of setting up SL1 to monitor a mix of Azure and on-prem VMWare devices.The Azure subscription monitors repeatedly error with:"Azure: Network Failure on App: ARMVMPerformance, Message: HTTPSConnectionPool(host='management.azure.com', port=443): Max retries exceeded with url:Failed to establish a new connection: [Errno -2] Name or service not known',)),".We have 14 subscriptions setup and some don't show the error at all, some show it weekly and 1 shows it every 15 minutes generating 1000's of critical alerts a month.SL1 support/PS say it is down to a DNS issue: We have checked with the ENG Team and it looks like a random DNS issue where it can't resolve "management.azure.com" from the collector and it looks transient. The error message points to a failure to resolve the hostname when the config da’s are run.However we use the same DNS server for all collectors and some subscriptions don't see the error. I can also do successful nslookups/pings/nmaps from the

Situation: A map is created and includes network devices which automatically displays layer 2 and layer 3 (including CDP and LLDP) relationships when they are available. The user has the configuration option to filter these out. The layer 4 transport protocol is not displayed. See OC7 model below.Desired outcome: The user is able to switch between layer 3 and layer 4 protocols.

Hi is there a way to create new ticket status just like we would do with other fields using Select Objects Editor feature? We currently have below options that came with the system, and i would like to add more. Is there a way to do that? Status. Status of the ticket. The choices are:Open. Ticket has been created.Pending. Ticket has been acknowledged.Working. Someone is working on the ticket.Resolved. Issue has been resolved.Regards,Tumelo 

I'm trying to use GQL to extract detail about our event policies, as the API give very little detail.And as we have a SL hosted system, DB access is only available to us via the Web UI. I've been building the query up, but I'm getting lost on the eventPolicySuppressions.Here's the code:query Event_Policies { eventPolicy(id:4075) { id name editedBy {id user} dateEdited severity { id name } enabled source {name} regularExpression1 regularExpression2 regularExpressionSearch autoClearedEvents { id name editedBy {user} } eventPolicySuppressions { entity {__typename}} } }I only seem to be able to get the entity {_typename} (which is "device") or the entityType ("entityType": "device") as a result. There don't appear to be any other options being offered from the UI suggestions.Does anyone know how I can get the eventPolicySuppressions device or device groups information?Thanks,Richard 

Which Dynamic Application is more efficient for File System UtilizationSL1 can trigger two different type of events for when a File System exceeds a threshold:File System exceeded events are generated via an Internal DA by SL1 and is executed every 5 minutesHost Resource Storage Utilization events are generated via a Discovered DA from the SNMP agent on the host and can be collected at 5, 10, or 15-minute intervalI am trying to determine which one make more sense to use on linux servers and is not as taxing the data collectors.

We're having problems with a few windows servers where after a day or two, the server no longer communicates with SL1 and reports the Major event "Device Failed Availability Check: Unknown".  When checking the server, we see that the SiloAgent service is no longer running.  Startup Type is set to Automatic.  Restarting the service fails.We have tried reinstalling the agent only to find that after a day or two, the service fails to run.  Anyone else experience this or have any suggestions on what we might do to resolve this?

Last week we upgraded our Lab Env to 12.1.2 and the DB's to OL8. Tried the in-place collector upgrade to OL8 and only one of the two collectors upgraded. The other is still at OL7. Each collector is in it's own collector group.We have Windows devices 3 of them at ver 2019, 2016, & 2012 using AD credentials and port 5986. Concurrent Powershell is enabled. The servers were on the OL7 collector and data collection was working just fine.I moved the Windows devices to the Collector running OL8 and data collection stopped working. If I disabled Concurrent Powershell for that OL8 collector, data started collecting again. So far I have not found anything in the logs.Linux and MSSql are working fine with out issue (so far).Has anyone else seen this with Windows since upgrading DB's and Collectors to 12.1.2 OL8

We are looking for a solution to a way where we can bulk discover servers which are not centralized/managed by Active Directory. In our environment where AIX/Linux is decentralized and not managed by Active Directory. Currently, as per understanding this is a one by one onboarding of such devices. Condition: Server SL1 user id password to be managed by CyberARK.Cons: Too many individual credential for each discovery.

We were supposed to be upgraded to v12.2 but problems with Aurora (the AWS database offering) we have ben placed onto v12.1.2.We were handed the system on September the 9th, and the release notes are dated the 10th. It has zero backward compatibility with collectors (all must be on 12.1.2) and we've been plagued with critical system alerts before we even attached a collector. I kind of get the feeling that we're alpha testing this release.... ☹️Can anyone else, give me some comfort and confirm that we are not the Guinea Pigs for this release?

Upgraded to SL1 v12.2.1.2 last night and had some bumps but for most part my organization is doing okay. Seen several positive changes in the UI like a much improved Events page however I'm having problems with my themes. I have both a lab and a production systems. To keep myself from accidentally doing stuff in production when I think I'm in the lab, in the past I put a dark theme on production and a light theme on my lab. Since the upgrade I'm seeing light theme pages in certain pages, despite the fact that the dark theme is applied (and reapplied for good measure).Is this a known issue?Anyone else seeing this behavior?

How might one go about suppressing a syslog event for a specific interface, but still receive all other events for that device and interface?For example, you have a syslog event message like: 5238379<187>267450: LC/0/1/CPU0:Aug 20 17:38:21.939 EDT: ifmgr[214]: %PKT_INFRA-LINK-3-UPDOWN : Interface TenGigE0/1/1/7, changed state to DownYour existing event policy uses regex match logic as follows:First Regular Expression:PKT_INFRA-LINK-[35]+-[^\s]+Second Regular Expression:to.*(DOWN|Down|down)Identifier Pattern:Interface\s+([^ ,]+)Identifier Format:Interface: %1Would you modify the event policy in some way? Is there other levers/knobs to in the system to tinker with that might get you the desired result?

Hi - Where would a person find the last login time for accounts that login with the API?  I have checked Access Sessions and the report Inactive User and the API sessions do not get logged.  I am not able to load Audit Logs without a timeout to see if the API sessions would be available there.Thanks 

How can I get server device CPU or Memory utilisation data from the API in bulk. I can get this from individual servers by specifying the device_id (i.e. /api/device/<device_id>/performance_data/838/data?duration=24h) but there must be a faster and less system taxing way? The documentation specifies how to get performance data in bulk (Requesting Performance Data from the API in Bulk (sciencelogic.com)), but not for all servers where class_type=linux as an example. 

This might be an oldie...How should we manage devices which have multiple overlapping IP addresses. For example Layer3 switches or router HA pairs can have same IP addresses set up to two or multiple devices for routing high availability or management reasons. This then makes SL1 see same IP addresses in multiple devices. And that then generates events into System organization, events like: A Message Collector is managing multiple devices with an overlapping secondary IP address: Secondary IP address overlap on devices managed by Message Collector: 101 | Collector Groups: 44 | IP Address: 128.0.0.127 | Device IDs: 70999, 70998, 71001, 71009, 71005, 71003, 71006, 71004, 71007, 71002, 71013, 71012, 71015, 71010, 71014, 71008, 71016Ok, that IP address can be deleted from database, but the nightly discovery again brings up the same issue next day. And because those are network devices where every now and then are some changes done in interfaces I believe we just have to have the Auto-

Hello ALLI have the following formula for an unhealthy alert object: result('o_31218', label="DataGuard is o_31218 logs behind in following Env:PrimaryDB:o_31214  SecondaryDB: o_31215 LastLogRec: o_31217 Difference: o_31218 ") >= 0 How can I get the Subject to contain object o_31214 and the body of the email to display what is listed in the above Policy Formula with the objects replaced with actual values ?

Is it possible to make a dynamic app to keep collecting data even when a device becomes unavailable(e.g. Device failed availability check: icmp) ?

We trying to pull the details of thresholds configured for individual devices through API,The system threshold API has the information of latency, availability and data retention related information's, whereas the required details like CPU, Memory and disk space related details are not coming up, is there any way to pull these information through API? /api/device/3/device_thresholds3 is one of our device ID. ThanksGautham 

Hi EveryoneI am currently trying to gather information about low-code in ScienceLogic, including how it works, what updates and changes have been made, how it can be implemented, and how we can effectively use it. If anyone can provide related documents or resources, it would be very helpful for me

The versions of the agents are more or less independent from the SL1 releases. This is giving the flexibility to release and install agents in faster cycle. By making it a independent software component the need for release information becomes crucial. The information in the SL1 release notes does not comply anymore.Is it possible to post the Release Note for agents on a site?It should contain the normal topics, versions, fixed issues, new features, known issues, dependencies etc.Thanks in advance.