Jump to content

Search the Community

Showing results for tags 'monitor'.



More search options

  • Search By Tags

    Type tags separated by commas.
  • Search By Author

Content Type


Forums

  • MSPGeek
    • Announcements
    • The Geek Cast
  • ConnectWise Automate / Labtech
    • ConnectWise Automate / LabTech
    • ConnectWise Automate / LabTech - Development

Categories

  • ConnectWise Automate
    • Scripts
    • Plugins
    • SQL Snippets
    • Role Definitions
    • Automate PowerShell Code
    • Reports
    • Internal Monitors
    • Remote Monitors
  • ConnectWise Manage
    • API Interacting Code

Find results in...

Find results that contain...


Date Created

  • Start

    End


Last Updated

  • Start

    End


Filter by number of...

Joined

  • Start

    End


Group


Location


Agent Count


INTERESTS


OCCUPATION


ICQ


WEBSITE


WLM


YAHOO


AOL


FACEBOOK


GOOGLEPLUS


SKYPE


TWITTER


YOUTUBE

Found 19 results

  1. The "SW - BlackListed Install" and "SW - Unclassified Apps" monitors do not support wildcard matching, so whitelisted or blacklisted application entries with wildcards are not used in these monitor results. This causes false positives, extra ticket noise, etc. These monitors can be adjusted to support wildcards. For the "SW - Unclassified Apps" monitor, the default "Result" field value is: (Select Name from Applicationblacklist union select name from applicationwhitelist) To enable Wildcard matching, replace the Result value with the following: (SELECT DISTINCT `Name` FROM (SELECT Software.Name FROM Software JOIN (SELECT REPLACE(`Name`,'*','%') AS `Name` FROM ApplicationBlacklist WHERE INSTR(REPLACE(`Name`,'*','%'),'%')>0 UNION SELECT REPLACE(`Name`,'*','%') FROM ApplicationWhitelist WHERE INSTR(REPLACE(`Name`,'*','%'),'%')>0) AS AppMatches ON Software.`Name` LIKE AppMatches.`Name` UNION SELECT Software.Name FROM Software JOIN (SELECT `Name` FROM ApplicationBlacklist WHERE INSTR(`Name`,'%')=0 UNION SELECT `Name` FROM ApplicationWhitelist WHERE INSTR(`Name`,'%')=0) AS AppList ON Software.Name = AppList.Name) AS Applications) For the "SW - BlackListed Install" monitor, the default "Result" field value is: (Select Name from Applicationblacklist) To enable Wildcard matching, replace the Result value with the following: (SELECT DISTINCT `Name` FROM (SELECT Software.Name FROM Software JOIN (SELECT REPLACE(`Name`,'*','%') AS `Name` FROM ApplicationBlacklist WHERE INSTR(REPLACE(`Name`,'*','%'),'%')>0) AS AppMatches ON Software.`Name` LIKE AppMatches.`Name` UNION SELECT Software.Name FROM Software JOIN (SELECT `Name` FROM ApplicationBlacklist WHERE INSTR(`Name`,'%')=0) AS AppList ON Software.Name = AppList.Name) AS Applications) I hope this helps! It has been reported that some browsers are not copying the text correctly. Chrome is believed to work, Firefox may be suspect. If you have any errors try copying the text using a different browser.
  2. DarrenWhite99

    Alert When Agent Is Online

    Version 1.0.4

    432 downloads

    The Internal Monitor "Notify When Agent is Online" watches machines with the "Notify When Online" computer EDF configured. It will send an alert as soon as it finds that the agent is offline. (The offline notice is skipped if the agent was already offline when notifications were first enabled.) When the agent comes online again another alert email will be sent and the EDF will be reset. This monitor can be used to notify when a lost computer comes online, or when that machine that is only online in the office every few weeks is back. To enable notifications for an agent, you simply put your email address into the "Notify When Online" EDF. You can enter multiple addresses separated by ";". The contents of the agent's "Comments" will be included in the email also. (Helpful to remember why you wanted to be alerted, or what instructions should be followed after receiving the alert.) When the agent returns online, the Network Inventory and System Info are refreshed. The recovery email will include the following details: The last check in was at @AgentCheckIn@. Public IP Detected: %RouterAddress% Internal IP: %LocalAddress% System Uptime: %uptime% Last Logged in User: %lastuser% This bundle includes a Script+EDF XML, and a SQL file with the Internal Monitor. To import the Script and EDF, select Tools -> Import -> XML Expansion. After import the script should appear in the "\Autofix Actions" folder. To import the Internal Monitor, select Tools -> Import -> SQL File. The monitor should be imported AFTER the script bundle has already been added. After importing, verify that a valid Alert Template is selected for the monitor. The Alert Template MUST have the "Run Script" action enabled without any script specified in the template. (The script is set on the monitor) Read the Script Notes for advanced control over the number of times a notification will be triggered.
  3. jminner

    Last Contact Monitor

    All-- So I have an issue at times where the LT-Offline Server does not work correctly. Specifically the server is reporting back to the database, but overall the machine is hosed. When I look at Automate, the agent is not checked in/show as offline. When I connect to another node that is online I can ping the host, but cannot connect to it. Essentially requiring the server to be rebooted to come back up and come online. The issue here is that the offline monitor should kick off. But because it is still sending some heartbeat info to the SQL, it is essentially telling Automate that it is still on. I now have a group for server that I want to apply a new internal monitor for, but the logic is hard to come by. Would anyone be able to help me out? I have tried the below and it is not working SQL command SELECT * FROM computers WHERE lastContact <= NOW() -INTERVAL 10 MINUTE I also tried this one SELECT NAME, Lastcontact FROM computers WHERE DATE(LASTCONTACT)>NOW() -INTERVAL 10 MINUTE withing SQLyog, the second item returns 0 results. Then I would also need to understand the logic required to actually setup the monitor if someone has the time. Thanks Jason
  4. I don't know about the false positives, but you should be able to make basic edits to the created monitors. Looking at the script that adds/maintains them, "Agent Monitor Creation - Disk", it goes through these steps: 1. Retrieve list of Drive IDs (not Drive Letters) on the agent. (Have you ever seen an agent where the USB drive was swapped, and they show multiple "F:" drives and they are all red/offline except for one? Each one is a different drive id) 2. Check to see if a monitor has been created for that DriveID. If the C: drive was re-detected for some reason, it will get a new drive ID and you will see the drive listed twice. It will also end up creating a new monitor for this drive's letter. 3. Check if the monitor ID remembered exists, if it doesn't then re-add it. 4. Check that the monitor's "What" action is "3". 3 corresponds to "Greater Than", so if you tried to change the monitor to be normal when "Greater Than/Equal" 10240MB instead of 1024MB, it will re-create the monitor. If you leave the comparison to "Greater Than" it should not re-create the monitor. We addressed the uselessness of the built in monitors by using Drive percentages instead of MB Free. I copied the "Agent Monitor Creation - Disk" script and tweaked it to create a monitor that for free space, and the percentage is automatically calculated. My script does the following: 1. Retrieve list of Drive IDs on the agent. 2. Check to see if a monitor has been created for that DriveID. If it has I move on. If you deleted this monitor, then you can manually re-create it. 3. Take the current free percentage, cut it in half, then round down to the next lowest multiple of 5. So a drive with 75% free would calculate to 35%, a drive with 22% free would calculate to 10%. It has an extra check to prevent setting to anything lower than 10%, in case of drives that are already over 90% full. 4. Create the monitor using the percent threshold calculated above. When the monitor is tripped, we can just change the percentage to whatever we want, but we cannot just close the ticket, we need to return it to a normal state via adjustment to the monitor or by making enough free drive space available. That way the ticket gets auto-closed, and the monitor resets. Otherwise we wont get another warning until the drive gets under 1GB (by the default Agent Disk Monitors created by the LabTech script). I also run a second script that looks for invalid monitors. Otherwise we ended up with monitors for drives that were removed or duplicate monitors for the same drive letter. I clean off the built in disk free and my custom disk percentage monitors, and any automatically created monitors that were duplicated. I run each of these at night in our Daily Maintenance scripts. They are offline scripts, and they run through pretty quickly... I have attached both scripts here. Hope they can help! LTAgentMonitorDiskPercentFree-Creation and Cleanup Scripts.zip
  5. In case it helps anyone, I found a quick-and-dirty way to monitor Dell PowerVaults for hardware or RAID problems without mucking-around with SNMP. Dell's Modular Disk Storage Manager (MDSM) software includes a command-line tool (SMcli.exe) that can output a list of the storage arrays it knows about and a brief health-status descriptor for each. "C:\Program Files (x86)\Dell\MD Storage Software\MD Storage Manager\client\smcli.exe" -d -v The output looks something like this: MAIN-SAN-1 [ip address] [ip address] Optimal BACKUP-SAN-1 [ip address] [ip address] Needs Attention SMcli completed successfully. So I created a remote EXE monitor on the server running MDSM that runs the above command and checks if the output contains the string "needs attention".
  6. Hey everyone, I'm looking for a bit of help. I am trying to monitor HP MSA SAN devices through LT. I have read all of the threads I could find related to this topic. I have the MSA mibs installed on the LT server and I have built custom monitors using the OIDs that worked for HP servers, but they aren't alerting. I set the Community in the LT Network Device pop-out to ensure it was looking with the right community string and I set the credentials to use a monitor login that is set in the HP's User Account section. I did a SNMPwalk against the device and found that it doesn't have the OIDs to match the server. I have added a custom community string and walked against that to verify that I am getting info back, just not the info that I need Has anyone successfully built monitors for HP Storage Devices with LT? If you didn't build custom monitors, how are you monitoring yours? I know there is a built in email option, but we are trying to do this through SNMP instead. Specifically, I am trying to monitor HP MSA 2050 devices, but I know that working monitors for previous generations should work. Any help anyone can offer is greatly appreciated. Brett
  7. DarrenWhite99

    Alert When Agent Is Online

    Alert When Agent Is Online View File The Internal Monitor "Notify When Agent is Online" watches machines with the "Notify When Online" computer EDF configured. It will send an alert as soon as it finds that the agent is offline. (The offline notice is skipped if the agent was already offline when notifications were first enabled.) When the agent comes online again another alert email will be sent and the EDF will be reset. This monitor can be used to notify when a lost computer comes online, or when that machine that is only online in the office every few weeks is back. To enable notifications for an agent, you simply put your email address into the "Notify When Online" EDF. You can enter multiple addresses separated by ";". The contents of the agent's "Comments" will be included in the email also. (Helpful to remember why you wanted to be alerted, or what instructions should be followed after receiving the alert.) When the agent returns online, the Network Inventory and System Info are refreshed. The recovery email will include the following details: The last check in was at @AgentCheckIn@. Public IP Detected: %RouterAddress% Internal IP: %LocalAddress% System Uptime: %uptime% Last Logged in User: %lastuser% This bundle includes a Script+EDF XML, and a SQL file with the Internal Monitor. To import the Script and EDF, select Tools -> Import -> XML Expansion. After import the script should appear in the "\Autofix Actions" folder. To import the Internal Monitor, select Tools -> Import -> SQL File. The monitor should be imported AFTER the script bundle has already been added. After importing, verify that a valid Alert Template is selected for the monitor. The Alert Template MUST have the "Run Script" action enabled without any script specified in the template. (The script is set on the monitor) Read the Script Notes for advanced control over the number of times a notification will be triggered. Submitter DarrenWhite99 Submitted 12/21/17 Category Internal Monitors  
  8. I'm still fairly new to using Automate and getting more into customizing the system for my needs. I need to modify an internal monitor that currently reports on a specific event ID and I need it to report on that ID with a specific source. The event ID is 11 and Source is Disk in the System log. When I try adding the source nothing populates. I event tried using a source that I know currently has and event ID 11 but it does not pull when I specify the source. I would appreciate any help on this. See screenshot, I added the eventlogs.Source at the end. If you remove it the monitor will pull all logged events with ID 11 in the System log regardless of source.
  9. tomasdj

    Monitor SQL file size

    My situation is the following: I have created a SQL script which cleans up a SQL express database. I can run the command per machine on a need to run basis but would like to do this via a monitor that would monitor the file size of the mdf (master data file) and run whenever it reaches lets say +5GB. I went into the monitor wizard but was faced with the fact that I am only able to monitor file sizes up to 999,999,999 bytes. Does anyone know of a workaround or a better way of monitoring this file?
  10. Hello, we're looking for a way to take different actions based on how many results show up in the monitor that calls this script. To be more specific, we want to execute a SQL stored proc if there are fewer than 10 results, and if there are more than 10, we want to send an alert email. The way I understand it, though, when you call a script based on the results of an internal monitor, the script simply receives one row at a time and executes based on the data in that row, rather than receiving all of the rows at once and running on each one in a loop. Am I understanding this correctly, and is there a way to accomplish what we're trying to do? Thanks!
  11. I am trying to make tickets more readable coming from the stock Blacklisted Event Internal monitors, but tickets are not being created for my custom monitors, in CW Automate or CW Manage: EV - BlackListed Events Informational Errors Only EV - BlackListed Events Warnings and Errors Only To do this I have created custom Monitors, Alert Templates, Alert Actions, and Autofix Scripts by copying the stock ones used by the stock monitors above. Here is the setup for my custom Informational monitor for example: Stock Monitor : EV - BlackListed Events Informational Errors Only Custom : Event Log Errors - Informational - CUSTOM Stock Alert Template : ~Autofix Action Blacklist Events - Informational Custom : ~Autofix Action Blacklist Events - Informational CUSTOM Stock Autofix Script : Monitor Disk Blacklist Events - Informational* Custom : Monitor Disk Blacklist Events - Informational* CUSTOM The problem is, when I manually Run and Reset the custom monitors, neither of them create any tickets. The correct results DO show up under the "Status" and "Build and View Query" tabs of the custom monitor. I have narrowed it down to a problem with the custom Autofix script, because it DOES work when I change the Alert Template to use the stock Autofix script. I cannot figure out why my custom Autofix script isn't working. Here are screenshots of my configurations for the custom Monitor and AutoFix script, compared to stock: Monitor: Script:
  12. I just joined an MSP as the Automate administrator and they want a monitor that will open a ticket and close it when someone logs onto a specific server as an administrator. I know that Automate detects the last user ID to log on. Any ideas?
  13. The agent maintenance script runs daily and creates critical disk space monitors on servers and workstations by querying the database. I'd like to restrict the creation of these monitors to the C drive, as we get many false positives and we have internal monitors at the group level monitoring disk space already. I had intended to go into the _System Automation\Agent Maintenance\Agent Maintenance - Disk script and change the sql query to only return drives with the letter C. However these are system scripts and I am unable to modify them. Does anyone know of a way that I can better control this automated behavior to prevent the creation of faulty and redundant monitors?
  14. Hi, I would like one of our own servers to check daily on all our Client's router ip adresses, if a specific port is open (RDP port 3389). As ransomware often comes in to client's network by using RDP, and we normally block RDP. But to be sure, I want to check this daily I know I can make a remote network monitor, but I do not want to manually make a remote network for each client's WAN ip in order to check this. A script would be the solution which pulls all the computerRouterIp adresses from Labtech. With portqry.exe I can check to see if the TCP port 3389 is LISTENING on the clients/location WAN ip. But how would I make this into a script, do the check, and if found LISTENING then make a ticket ?
  15. I've been tasked with generating a custom alert board that we can reference for a large-format display in our NOC. One of the things we're dealing with is a large number of "No checkin for (x) days" alerts and we want to exclude those from the list, along with some other alert types that are deemed less urgent by our account team. Is it possible to create a custom alert view and use filters to exclude certain alert types, monitors or strings? We would still want to keep the master list of alerts that shows everything, but we want to have one (or more) that are custom-tailored to showing up-to-the-minute lists of alerts like circuit outages, AV warnings, and hardware failures. Thoughts on how to do this? Thanks!
  16. David Larsen

    Internal Monitor RAWSQL Hanging

    Hi, I am trying to test an internal monitor I've created. I'm using a RAWSQL monitor. Unfortunately, when in the configuration window, if I go to the "Query Results" tab, the query seems to hang, and if I mouse over the results pane, it just displays the hourglass. Running the query in my DBMS works fine. More confusingly, another user can open the monitor configuration window and see the query results, so it doesn't seem to be an issue with the query. Does anyone have any ideas or experience with this issue? Thanks!
  17. How are other people with Webroot monitoring for threat detections on Macs? The 3.0 plugin does not pull detection data from the GSM console into the plugin_webroot3_threathistory table (as it does for PC's), and thus the "Webroot 3 - Active Infection" monitor never triggers for Macs. Webroot support confirmed this is expected behavior (since the mac client isn't "fully supported" yet).
  18. You don't need to use RAWSQL. You just need a machine that you will "blame" so that the alert can be created. Try this: Table To Check: Computers Field To Check: computerID Check Condition: Equals Result: 1 (Or whatever computerid you want to be returned with the alert) Identity Field: Can be blank Additional Condition: (SELECT MAX(DynamicClients)<(SELECT COUNT(*)+100 FROM Computers) FROM config) If the current number of computers+100 (your margin) becomes greater than the number of licenses allowed, then the additional condition will become true, for every computer whose computerID EQUALS 1 (or whatever computer you select). You should leave this as a global monitor, do not select any groups or clients for the Monitor Target. For dynamic computer selection of your LabTech Server (or '1' if it is not found), replace the Result with: (SELECT IFNULL(MAX(computerid),1) FROM services WHERE `name`='LTAgent' AND state='Running') keywords: agent count license free available licenses monitor
  19. We'd like to have different offline thresholds for overnight vs daytime hours (we get a lot of ISP blips that almost always resolve themselves within 15 minutes) As you know, you cannot change offline server thresholds for different times of day. I know we could create duplicate monitors with different alert templates for different times of day.. but I was looking for a simpler and cleaner way using SQL. Here's what I have so far for an Offline Locations monitor, and its close, but still getting inconsistent results. Line 9 is where the magic should happen but I think my syntax is wrong, or its simply never going to work based on times: SELECT COUNT(locations.locationid) FROM locations LEFT JOIN Clients ON Clients.ClientID=locations.clientid WHERE locations.`LocationID` = 2 AND ( (SELECT COUNT(*) FROM Computers WHERE Computers.locationid=locations.locationid)>0 AND (SELECT COUNT(*) FROM Computers WHERE computers.OS LIKE '%server%' AND Computers.locationid=locations.locationid AND ((Computers.LastContact>DATE_ADD(NOW(),INTERVAL -4 MINUTE) AND CURTIME() BETWEEN '7:00:00' AND '21:59:59') OR (Computers.LastContact>DATE_ADD(NOW(),INTERVAL -14 MINUTE) AND (CURTIME() < '6:00:00' OR CURTIME() >= '22:00:00')))) =0 AND (SELECT COUNT(*) FROM Computers WHERE computers.OS LIKE '%server%' AND Computers.locationid=locations.locationid)>1 AND locations.LocationID NOT IN ('1') AND (SELECT `Exclude Offline Check` <> 1 FROM v_extradatalocations WHERE v_extradatalocations.locationid=locations.locationid) ) To give you a little background, I already have customized both offline location and offline server monitors. Basically, the Offline Location runs similar to above (without the curtime stuff). The offline server monitor calls a script which checks if the offline locations monitor already tripped for that site, and if so, does nothing. Otherwise, it alerts for the offline server. This was done to reduce noise by essentially nesting offline servers within offline locations. I can provide that script if you'd like. thanks in advance for any assistance -- even if the answer is "it can't be done like this" I'd love to know so I can quit trying!
×