DQL to Get specific process in availability monitoring on multiple Host

Dest-Roh — Tue, 28 Jan 2025 07:00:39 GMT

Hi Team,

I have a requirement to pull down a specific process kept in availability monitoring on my environment and wanted to generate a report and gather info that on which machine availability monitoring is enabled for this specific process. Is this possible to get the data from DQL??

EX: Host A, Process xyz --> getting monitored for availability alerts

Host B, Process xyz --> getting monitored for availability alerts

Host C, Process xyz --> Not enabled for availability alerts

Re: DQL to Get specific process in availability monitoring on multiple Host

PiotrG — Tue, 11 Mar 2025 12:17:06 GMT

Hey!
That is not a very straight-forward thing to accomplish, as the process availability monitoring is set through the settings 2.0 and is not a property of a process. There is one thing you could potentially do through DQL - you can look for events that were created when the settings were changed - there is a limitation that you would only be able to get settings that were touched since mid 2024.

Query would look something like this to start with:

fetch dt.system.events | filter event.kind == "AUDIT_EVENT" | filter event.provider == "SETTINGS" | filter details.dt.settings.schema_id == "builtin:availability.process-group-alerting" | sort timestamp desc

There you'd be interested in the details.json_after to see what was the change made (either disabling/enabling) and details.dt.settings.scope_id where you would find the process group that was changed.

Other than that, I believe environment API v2 has an endpoint that could help you accomplish a similar result but it wouldn't be through DQL.

topic Re: DQL to Get specific process in availability monitoring on multiple Host in DQL

DQL to Get specific process in availability monitoring on multiple Host

Re: DQL to Get specific process in availability monitoring on multiple Host