topic Re: Agent Status Alert in Alerting

Agent Status Alert

oakdag — Wed, 19 Jan 2022 11:13:52 GMT

Hi,

How can I send it as an alarm when Oneagent does not start or gets an error? Is there anyone have an idea?
By the way, host availability is not oneagent availibility.

Regards,

Oakdag

Re: Agent Status Alert

ChadTurner — Wed, 30 Mar 2022 16:04:52 GMT

Yes this is configurable. you can set an alert via Custom event for alerting to say If data is missing alert, because that would simulate the Oneagent traffic ending or the oneagent stopped. You can also be alerted on entities being unmonitored and that is when hosts communication drops out but the host is not turned off - so the Oneagent is not talking or the communication is blocked/non existent.

Re: Agent Status Alert

AntonioSousa — Wed, 30 Mar 2022 17:18:27 GMT

In cases where I need to have that information, you can go to the Process group settings for each of the OneAgent PGs, and activate availability monitoring:

Re: Agent Status Alert

Yosi_Neuman — Sun, 05 Mar 2023 17:42:53 GMT

Hi @AntonioSousa

We have activated the availability monitoring on:

OneAgent system monitoring
OneAgent network monitoring
OneAgent monitoring extensions

Shout down the one agent service but no problem was opened 🙄

Tried also with OS service monitoring again with no success 😭

What are we missing here 🤔?

Thanks in advance for your inputs

Yos

Re: Agent Status Alert

AntonPineiro — Thu, 03 Aug 2023 23:01:15 GMT

Hi,

Same than you. Only working creating a metric selector event about missing data. But it has a limitation about how many you can create per environment.

Best regards

Re: Agent Status Alert

lucas_hocker — Fri, 04 Aug 2023 07:47:52 GMT

@AntonPineiro & @Yosi_Neuman , I'm struggling to understand this use case a bit. So the user is performing a graceful shutdown of OneAgent, i.e. intentionally. The host itself is not shutdown. And this is a condition you wish to be alerted on? Always? After some amount of time?

Re: Agent Status Alert

AntonPineiro — Fri, 04 Aug 2023 08:16:34 GMT

Hi,

It means, it is not powered off hosts itself. If I shutdown host, yes, I get an alert with that config.

It is more if I execute "systemctl stop oneagent.service" for stopping OneAgent service. In that case, we are not getting monitoring information and you can see a gap in metrics but no alert is triggered.

Only way is creating a metric event for some Oneagent process metric (CPU, memory...) and turning on alert me if missing data.

As a summary, it is be alerted when, for some reason, OneAgent itself is stopped / crashed and we are not monitoring host, processes... It means, be alerted when OneAgent status is no "Up".

Re: Agent Status Alert

AntonioSousa — Fri, 04 Aug 2023 08:27:19 GMT

@lucas_hocker,

I remember two use-cases for configuring this:

A case where OneAgent was being shut down without justification by an administrator
A bad interaction with an anti-virus

In my case, I don't remember it misbehaving. But the use-case was certainly there.

Re: Agent Status Alert

Yosi_Neuman — Sat, 05 Aug 2023 08:40:19 GMT

Hi @lucas_hocker

The most obvious use case is when security guys delete FW rules that allows OAs communicate with AGs or cluster.

Shutting down the OA service was just a way to try and see if the configured alert is working.

Next step will be to mark KEY HOSTs that must be on and connected in cases of HU license shortage but first lets get alert for OA that is down.

HTH

Yos

Re: Agent Status Alert

Yosi_Neuman — Sat, 05 Aug 2023 09:02:10 GMT

IMO builtin:host.availability.state metric can help us here

HTH

Yos

Re: Agent Status Alert

AntonPineiro — Tue, 08 Aug 2023 08:05:41 GMT

Hi,

Yes, but it still has a limitation about how many you can create. It means, alert missing data require a metric-selector-based query.

Best regards

Agent Status Alert

Peter_Youssef — Wed, 18 Sep 2024 15:26:54 GMT

hi @oakdag
Consider the path of the deployment on either windows and Linux and installed Oneagent service name

Simple solution:

Windows

create OS service monitoring rule and provide the below parameters

optionally add property

Linux

create OS service monitoring rule

add property as well

Thanks