v.148 Release

v.148 of the LogicMonitor portal is scheduled to roll out to customers from February 17 through March 1.

Feature Highlight: Log Alerting

You can now generate alerts automatically on logs!

This release introduces a new concept called Pipelines, which are used to define filters and processing steps on logs as they are ingested. Pipelines are currently scoped to match one resource, but we’ll expand this scope with an upcoming release.

• Add a pipeline to filter logs from resources you always want to track. Manage pipelines in the new Logs > Pipelines page. See Log Processing Pipelines.

The first processing step lets you add alert conditions using regular expressions to match the logs in a pipeline.

• Create alerts directly from any log event or anomaly listed in the Logs page or from a configured Pipeline. Manage alerts from Logs > Pipelines > Pipeline alerts. See Log Alert Conditions.

When log alerts conditions are matched, they trigger standard LogicMonitor alert notifications based on the alert settings (critical, warning, error). You can also view the log alert in the Logs graph, where it will display as a line alongside the alerting log event, and acknowledge the alert in the log list.

You may find this new functionality useful for making logs more actionable, and automating the process of notifying someone when known issues occur.

General Enhancements and Fixes

Alerting

• (FIX) Dynamic thresholds display on Alert Tuning tab. Previously, dynamic thresholds set at the resource group and DataSource levels were not displaying on Alert Tuning tabs. These inherited thresholds are now displayed appropriately in the Dynamic Threshold column, consistent with how inherited static thresholds display in the Static Threshold column.
• (FIX) SDT icon displaying for future SDT time window. On the Alerts page, alerts associated with resources/instances with scheduled downtime (SDT) for a future time window were erroneously displaying the SDT icon for a brief period of time after being selected. This has been fixed and alerts will now only display the SDT icon when the SDT is currently active.

Collectors

• EA 29.106. Collector version EA 29.106 was released on February 10. This version fixes the known issue present in versions 29.101 through 29.105 that was resulting in resources with heartbeats to be incorrectly marked as dead/down. Collector releases are deployed independently of LogicMonitor platform releases. For more information on the various Collector versions available for upgrade and the differences between EA (early access), GD (general deployment), and MGD (minimum general deployment) versions, see Collector Versions.

LM Logs

• (FIX) Timeout issue preventing log display. Previously, a timeout issue was preventing the Logs page from displaying larger numbers of logs as a result of longer time range filters. This has been fixed.

Reporting

• (ENHANCEMENT) More secure report URLs. Reports generated by LogicMonitor (either manually or scheduled) are accessible via a short link URL for a configurable period of time. Previously, the short link URL to access the report consisted of five characters. Conceivably, an attacker could brute-force this value to retrieve and access unexpired links. To safeguard report URLs from being guessed through brute force, report URLs now incorporate 17-character strings that are created by base62-encoding randomly generated 96-bit numbers.
• (ENHANCEMENT) Interface Bandwidth report. The Interface Bandwidth report now features a new Scale by units of 1024 checkbox. (By default, this report is scaled by units of 1000.)

REST API

• (Enhancement) Users with read-only privileges for LogicModules prohibited from passing any values to AppliesTo logic. Previously, users with read-only privileges for LogicModules were able to pass anything to AppliesTo logic. These users are now restricted to default values only when making updates in AppliesTo logic.

Topology Mapping

• Edge filter available when viewing topology maps from the Alerts page. When viewing topology maps associated with alerts from the Maps tab of the alert detail pane, you can now filter the maps by edges. Edge filtering is activated by selecting it as a filter from the dropdown of the funnel icon. When activated, deselected edge types will be removed from the topology map along with any unfocused nodes that are connected to them. Edge filters are not persisted and will reset upon page refresh, tab change, or other context change. The ability to remove edges and nodes that are not relevant can aid in faster troubleshooting.
• Access to relevant, previously-saved topology maps from the Alerts page. When viewing topology maps associated with alerts from the Maps tab of the alert detail pane, you are now able to access and display saved topology maps that incorporate the alerts’ triggering resources/instances. Use the dropdown, initially named after the alert ID, to select a saved map. If the dropdown is disabled, no relevant saved topology maps are available.

User Interface

• (FIX) Payment method edits. An “Unknown error” exception was occurring when attempting to edit the payment method listed in the platform’s financial settings (Settings | Account Information | Financial). This has been fixed.
• (FIX) Erroneous redirect on Resources page. Previously, when selecting the Manage Alert Tuning option for a DataSource listed in the Graphs tab for a selected resource, the user was not being appropriately directed to the Alert Tuning tab for the DataSource. This has been fixed.

New, Updated, and Deprecated LogicModules

Recently released to the LogicMonitor public repository, our new and updated LogicModules are available for import to expand and enhance your monitoring coverage.

New LogicModules

Updated LogicModules

Deprecated LogicModules

LogicMonitor deprecates LogicModules for a variety of reasons. Most often, it is because we have published a replacement LogicModule that provides superior access to the monitored technology (for example, supports more versions of the technology or provides improved scalability).

However, there are times when a LogicModule is deprecated with no replacement (for example, when a technology becomes defunct or security issues beyond LogicMonitor’s control arise).

Note: When importing a replacement LogicModule, you will not experience any immediate data loss due to the name variation that LogicMonitor expressly adds. However, there will be a diversion in data collection between the deprecated and new LogicModule, and you will potentially collect duplicate data and receive duplicate alerts for as long as both LogicModules are active. For this reason, we recommend that you disable monitoring of the DataSource instances at the resource or resource group level after you have imported its replacement. When DataSource monitoring is disabled in this way, it stops querying the host and generating alerts, but maintains all historical data. At some point in time, you may want to delete the legacy DataSource altogether, but consider this move carefully as all historical data will be lost upon deletion. For more information on disabling DataSource monitoring, see Disabling Monitoring for a DataSource or Instance.

Entering Beta

Python SDK for Push Metrics API

LogicMonitor is developing a Push Metric API in order to allow metrics to be sent directly to LogicMonitor without the use of a Collector.

The first phase of the beta is continuing and we are now opening up the second phase of the beta which features a Python SDK for the Push Metrics API.

If you are currently participating in the first phase and would like to expand your testing to include the new Python SDK, see the Push Metrics API Solution guide (this guide will be updated shortly with SDK details).

If you are not currently participating in the first phase, please complete the Customer Beta survey and use the comments section to indicate your interest in participating in testing for the Push Metrics API Python SDK.

Easy Alert Grouping with New Header Graph on Alerts Page

Available as a beta feature for all Enterprise and Enterprise MSP customer accounts, the Alerts page incorporates a brand new time-series header graph that provides immediate visual insight into an alert storm or other event requiring investigation.

Mirroring the alerts currently displayed in the alert table, this graph’s aggregated alert counts can be grouped by a number of dimensions including alert severity, associated alert triggers (resource, LogicModule, instance, datapoint), matching alert rules, or the escalations chains used to deliver alert notifications.

Available by clicking the more options icon located in the upper right corner of the Alerts page, the header graph is highly interactive, allowing you to zoom in on a time range or use the graph’s legend to quickly include/exclude a group of alerts. As you interactively change the graph’s filters, the alert table will automatically update to remain in sync.

Note: As a beta feature, this header graph may exhibit some performance or functional issues; closing the graph will eliminate any potential impacts you experience when using other aspects of the Alerts page.

For more information on using this new alert header graph, see Managing Alerts from the Alerts Page.

In the following months, LogicMonitor will continue enhancing alert grouping capabilities with the addition of treemap graphs for subgrouping and new grouping dimensions.